fseventsd out of sync with volume message

Question

Level 1

8 points

fseventsd out of sync with volume message

It seems that every time I connect a USB drive or FireWire drive to my iMac lately, I get a message like this in the console system log:

Apr 7 21:01:03 <computer name> fseventsd[39]: event logs in /Volumes/250GB Drive/.fseventsd out of sync with volume. destroying old logs. (346 0 4864943)
Apr 7 21:01:03 <computer name> fseventsd[39]: log dir: /Volumes/250GB Drive/.fseventsd getting new uuid: 43341D60-7F10-4DDE-8474-C726E1B1DE42

The drives work perfectly but I just don't understand the error messages. Does anyone know what this is all about and is it cause for concern? I don't use Time Machine for backups and from researching this, it seems like these messages have something to do with Time Machine backups.

Can anyone tell me what this means - is there a system software problem on my iMac?
Thanks,
Gerard

24-Inch iMac 3.06 GHz Intel Core 2 Duo - 4 GB RAM, Mac OS X (10.5.6)

Posted on Apr 7, 2009 9:24 PM

Reply

Answer 1

Pondini

Level 8

38,863 points

Apr 8, 2009 3:50 PM in response to Gerard James

I don't know for sure, but these sound like the drive wasn't disconnected properly, causing OSX's File System "event log" on the drive possibly to not match the data on the drive.

When you disconnect, be sure nothing is using them, and they're properly ejected before you unplug or power them down.

Reply

Answer 2

Gerard James Author

Level 1

8 points

Apr 8, 2009 7:15 PM in response to Pondini

Thanks for your reply - I always make sure my drives are ejected properly - whether they are USB or FireWire drives. I use 160GB and 250GB LaCie Porsche Mobile FireWire drives for manual backups (I don't use Time Machine yet - need a bigger drive). I'm very careful this way. Even with ejecting cards from my Kingston USB Card Reader, ejecting the Kingston USB Memory Stick we use to transfer photos back and forth between our computers and even with disconnecting my iPod.

So I don't think it could be the way the drives are being disconnected that is causing the error message. It's a rather strange error message that doesn't quite add up. The error message appears with all different drives - not all the time but about every third or fourth day. I've run Disk Utility on my startup drive and on all my external drives, I've run TechTool on the startup drive, ran the Apple Hardware Test (extended test) twice, checked all the RAM with MemTest, zapped the PRAM and reset the SMU. Even ran YASU a few times to clean up the cache files. Everything is fine - no problems reported. System software is fine. The error message actually seems to appear when first mounting the drives, not when ejecting them.

I did have one older 60GB FireWire drive that I connected to the iMac when I first got it 3 months ago that took a heck of a long time to show up on the desktop and then when it finally showed up, there was a new folder on it called "Damaged Files" with about 30 files in it that somehow got damaged in the mounting process (never once had a problem with that drive on my old iMac G5 running 10.4.11). It might have been a formatting problem that only showed up under Leopard. I hardly ever use that drive (maybe used it twice since then) and that was the only external drive problem I've had on this new iMac.

So it's basically just the error messages that are worrisome in the console system log. Has anyone else had these error messages?

Thanks again,
Gerard

Reply

Answer 3

Pondini

Level 8

38,863 points

Apr 8, 2009 7:53 PM in response to Gerard James

Gerard James wrote:

The error message actually seems to appear when first mounting the drives, not when ejecting them.

Yes, that's when OSX would detect the problem (whenever and whatever the cause).

Just before that message, are you getting one from kernel about "Journal replay done"?

And something is causing the event log to get out of "sync" with the data on the drive. By itself, that likely won't cause a big problem, as OSX blows it away and makes a new one.

I'd guess if you watch Activity Monitor while attaching a drive and getting this message, you'll see the mds and/or mdworker processes (or anything else that uses the FSEventStore), using an unusual amount of CPU, since it has to start from "scratch" instead of just picking up after the last event processed for that drive.

It seems like OSX isn't properly closing out the disk when you eject it. The only thing I can think of is, loading the 10.5.6 combo update; and if that doesn't work, the dreaded Archive and Install.

Reply

Answer 4

Apr 9, 2009 3:27 AM in response to Gerard James

After you disconnected the drives from your Mac, did you connect them to any other computer or device that may have changed the contents of the drive (even as little as a single file)?

The message you're getting isn't really anything that serious, and I wouldn't really worry about it.

Apple added the fsevents feature to Leopard to help keep track of where changes were made to the hard drive's files and folders, to help make implementing the Time Machine feature much easier and more efficient. While a drive is connected to your Mac in Leopard, the fsevents daemon keeps a list of which folders have been modified on your Mac; each transaction is stored within the hidden /.fseventsd/ directory at the root level of the volume. When the time comes for the next backup, Time Machine can quickly consult the list of folders that have changed, compare against your last backup, and determine which files need to be backed up.

If the contents of a volume are changed in some way (for example, if I start up from another of my volumes that has OS X Tiger installed), and changes are made where there is no fsevents daemon present, the list of modified directories in the /.fseventsd/ folder will become out of date. Once I started back up in OS X Leopard, it would detect that the event logs are out of date and would have to start over from scratch. Now, that's not necessarily an unrecoverable type of error or anything; rather, when the next Time Machine backup comes around, it will simply take a little bit longer since Time Machine will have to do a more thorough comparison between your last backup and your current state to determine which things have changed.

As long as you're properly unmounting the external drives, I wouldn't worry about this.

Reply

Answer 5

Gerard James Author

Level 1

8 points

Apr 9, 2009 3:42 PM in response to Pondini

Thanks for your help. Yes - I have only gotten the "journal replay done" message twice but not before the "fseventsd out of sync" message. It was actually on my startup drive during the boot process and this happened when a CD with a thick label wouldn't read properly and got stuck in my CD drive - I had to force quit everything and shut down using the power key by holding it in for a few seconds. Here is the first log entry after I had the problem with the bad CD:

Apr 2 18:26:46 localhost kernel[0]: Got boot device = IOService:/AppleACPIPlatformExpert/PCI0/AppleACPIPCI/SATA@1F,2/AppleICH8AHCI/PR T0@0/IOAHCIDevice@0/AppleAHCIDiskDriver/IOAHCIBlockStorageDevice/IOBlockStorageD river/WDC WD5000AAKS-40YGA1 Media/IOGUIDPartitionScheme/Customer@2
Apr 2 18:26:46 localhost kernel[0]: BSD root: disk0s2, major 14, minor 2
Apr 2 18:26:46 localhost kernel[0]: jnl: unknown-dev: replay_journal: from: 31103488 to: 32421888 (joffset 0x1038e000)
Apr 2 18:26:46 localhost kernel[0]: [HCIController][configurePM] power parent ready after 1 tries
Apr 2 18:26:46 localhost kernel[0]: jnl: unknown-dev: *journal replay done*.
Apr 2 18:26:46 localhost kernel[0]: AppleIntelCPUPowerManagement: initialization complete
Apr 2 18:26:46 localhost kernel[0]: Jettisoning kernel linker.
Apr 2 18:26:46 localhost kernel[0]: Resetting IOCatalogue.
Apr 2 18:26:46 localhost kernel[0]: GFX0: family specific matching fails
Apr 2 18:26:46 localhost kernel[0]: Matching service count = 1
Apr 2 18:26:46 localhost kernel[0]: Matching service count = 2
Apr 2 18:26:46: --- last message repeated 4 times ---
Apr 2 18:26:46 localhost mDNSResponder mDNSResponder-176.3 (Sep 30 2008 16:59:38)[15]: starting
Apr 2 18:26:46 localhost kextd[10]: 418 cached, 0 uncached personalities to catalog
Apr 2 18:26:46 localhost kernel[0]: Previous Shutdown Cause: 3

Here is the second log entry after I did another restart about 20 minutes later:

Apr 2 18:42:28 localhost kernel[0]: Got boot device = IOService:/AppleACPIPlatformExpert/PCI0/AppleACPIPCI/SATA@1F,2/AppleICH8AHCI/PR T0@0/IOAHCIDevice@0/AppleAHCIDiskDriver/IOAHCIBlockStorageDevice/IOBlockStorageD river/WDC WD5000AAKS-40YGA1 Media/IOGUIDPartitionScheme/Customer@2
Apr 2 18:42:28 localhost kernel[0]: BSD root: disk0s2, major 14, minor 2
Apr 2 18:42:28 localhost kernel[0]: jnl: unknown-dev: replay_journal: from: 10689536 to: 12478464 (joffset 0x1038e000)
Apr 2 18:42:28 localhost kernel[0]: jnl: unknown-dev: *journal replay done*.
Apr 2 18:42:28 localhost kernel[0]: HFS: Removed 3 orphaned unlinked files or directories
Apr 2 18:42:28 localhost kernel[0]: AppleIntelCPUPowerManagement: initialization complete
Apr 2 18:42:28 localhost kernel[0]: [HCIController][configurePM] power parent ready after 1 tries
Apr 2 18:42:28 localhost kernel[0]: Jettisoning kernel linker.
Apr 2 18:42:28 localhost kernel[0]: Resetting IOCatalogue.
Apr 2 18:42:28 localhost kernel[0]: yukon: Ethernet address 00:23:32:91:07:b0
Apr 2 18:42:28 localhost kernel[0]: AirPort_Brcm43xx: Ethernet address 00:23:12:1b:d5:22
Apr 2 18:42:28 localhost kernel[0]: GFX0: family specific matching fails
Apr 2 18:42:28 localhost kernel[0]: Matching service count = 1
Apr 2 18:42:28 localhost kernel[0]: Matching service count = 2
Apr 2 18:42:28: --- last message repeated 4 times ---
Apr 2 18:42:28 localhost kextd[10]: 418 cached, 0 uncached personalities to catalog
Apr 2 18:42:29 localhost kernel[0]: Previous Shutdown Cause: 3

Those are the only two instances of "journal replay done" in my system log. They have nothing to do with the "fseventsd out of sync" messages and/or my external drives. I will keep an eye on the Activity Monitor the next time I use one of my backup drives. Maybe the upcoming 10.5.7 update will help? I hope I don't have to re-apply the 10.5.6 combo update.

Thanks so much for your help.
Gerard

Reply

Answer 6

Gerard James Author

Level 1

8 points

Apr 9, 2009 3:45 PM in response to MarkDouma®

+After you disconnected the drives from your Mac, did you connect them to any other computer or device that may have changed the contents of the drive (even as little as a single file)?+

Actually, before and after - yes, I have done that. And on a Tiger volume, just as you've indicated.

+The message you're getting isn't really anything that serious, and I wouldn't really worry about it.+

I am so glad to hear someone say that!

+As long as you're properly unmounting the external drives, I wouldn't worry about this.+

Super! Thanks a million for your help.
Gerard

Reply