Why are trustd, nsurlsessiond, syslogd causing high CPU on Mac?

Hi flipflips, I followed Jeremy's instructions, and now the issue is solved. So let me explain how to do this in more detail.

But before taking off: beware that tinkering with the Mac system using the Terminal is risky business. I had a long conversation with Apple Care, who took me through a lot of steps, and they in general advise to NOT use Terminal.

So, make sure to have a backup of all your files, and check the contents of the log-files to check that your issue is caused by exactly the same issue that Jeremy reported. That is how I did it, and it worked for me.

And if your system gets unstable, you can always go back to factory defaults, and start over from there :)

Now, first we will check the log files.

To do this, start Spotlight (the looking-glass symbol in the upper righthand corner of the screen) and type:

/var/log/asl

This brings up a Finder window with the folder with the log-files.

Those log-files have a name like:

2020.06.30.xxx.asl

You can open the log-file with the program Console (that is the default program, or you can use Open with...)

Check this log-file for lines as:

libcoreservices: __makeDirectory: 405: mkdir: path=/var/folders/zz/[randomized name]/0/ mode=0755: Operation not permitted.

The [randomize name] part is a long string like zyxvpxvq6csfxvn_n00000y800007k

This string is important: it is the name of a system subdirectory that is used by the nsurlsessiond process. Nsurlsessiond tries to write to this directory, but gets no permission, and repeats and repeats and repeats and repeats. That's why nsurlsessiond stays in the top of your list of processes, eating up to 50-60% of your CPU capacity, draining your battery, and heating your MacBook.

So check if you see these lines in your log file, to make sure your issue is the same.

To solve the issue you have to do 2 things:

1. Kill the trustd process
2. Delete the blocked directory, so that the OS can create a new one.

These things are done using the Terminal. You can find this program in the Launchpad, or find it using Spotlight.

First, find the name of the subdirectory (the string mentioned above). Copy it from the log-file, or find it using the Terminal.

Start the Terminal program. The Terminal window opens. After the prompt, type:

ls -la /var/folders/zz | grep nsurlsessiond

You will get an output like:

drwxr-xr-x@  5 _nsurlsessiond    _nsurlsessiond     160  9 jun 13:45 zyxvpxvq6csfxvn_n00000y800007k

The part that I made bold is the name of the subdirectory we need to delete, so copy this to your Clipboard.

Now, take a look again at the Activity monitor, and look for the trustd process, that is one of the top 3 or 4 processes in the list. It has a unique process id, the PID number (for example 219).

In Terminal, kill the trustd process, by typing:

sudo kill -9 [trustd PID]

So if the PID is 219, you type:

sudo kill -9 219

After killing this process, you will see the CPU usage drop immediately.

Now we delete the subdirectory. Again in Terminal, type

sudo rm -fr /var/folders/zz/[randomized name]

Again, replace [randomized name] with the string you copied before.

Congratulations, you are done!

Keep following your system performance for several days in the Activity Monitor.

Success!

Hello jpaussa,

Welcome to the Apple Support Communities, and it appears there are a few system processes taking up a high amount of CPU. I'll do what I can to help.

Here are some suggestions:

• Restart your Mac from the Apple () menu then Restart. Uncheck the option to automatically open previously opened apps. Once the Mac restarts again, see when the logging starts or if it is triggered after opening a specific app.
• To narrow it down further, also be sure to check your Mac in safe mode: How to use safe mode on your Mac You can also try a new user as well: How to test an issue in another user account on your Mac
  • If it only happens in your user and not in safe mode, try removing login items: Open items automatically when you log in on Mac
  • If it happens in both safe mode and a new user, back up your Mac and reinstall macOS using Recovery which will reinstall those system processes: How to reinstall macOS from macOS Recovery

Take care.

I'm a non geek too!!

Heres how I managed it. I'm copying and pasting from previous helpful post's but have added what became clear to me eventually.

Open the "Activity Monitor" app.

Click on the CPU column so the highest numbers are showing.

Locate the "trustd" process in the left column. Presuming it is there hogging plenty of CPU. Mine was around 70%.

Find its PID in the "PID" column, it should be a number. Mine was 3 digits something like 249

Open the "Terminal" app. Sometimes what you type in the Terminal doesn't show but carry on because it is in there.

Copy the following command, replacing "***" with the PID you just found:

sudo kill -9 *** Replace *** with the number

and run it (press "Return")

Still in "Terminal", copy and run the following command:

ls -la /var/folders/zz | grep nsurlsessiond

You will get something like this

What is in the red box on the above example is what you need to copy and paste from your Terminal screen. Add this at the end of this next command in place of *

sudo rm -fr /var/folders/zz/*

Thats it and it worked for me!

I have a solution. A file permissions/ownership problem stops nsurlsessiond from writing its temporary files.

Take a look at log files in /var/log/asl. Mine had statements like: libcoreservices: __makeDirectory: 405: mkdir: path=/var/folders/zz/[randomized name]/0/ mode=0755: Operation not permitted.

If that looks familiar, take these steps.

1) In Terminal, kill the parent trustd process, pressing pausing on write attempts. trustd will start again in some hours.

# sudo kill -9 [trustd PID]

2) Remove the old nsurlsessiond temporary directory.

# sudo rm -fr /var/folders/zz/[randomized name]

Alternatively you can find the specific "randomized name" directory by looking for nsurlsessiond ownership:

# ls -la /var/folders/zz | grep nsurlsessiond

3) Optionally, clean up /var/log/asl if this is taking up lots of space.

You're done. Hope this helps.

this worked for me but I had so many other problems with Catalina I had to downgrade to Mojave. based on my experience and some false starts I think the easiest way to do it is to get an external hard drive (at least as big as your internal hard drive) plus an external thumb drive (at least 16 GB). copy the entire Applications, Users and Library folders of your internal hard drive to the external hard drive. download the mojave installer from this link (will open in the app store but you have to follow the link):

https://apps.apple.com/ph/app/macos-mojave/id1398502828?mt=12

when you are sure everything has copied correctly, eject and unplug your external hard drive and put your thumb drive in. follow the instructions at https://support.apple.com/en-us/HT201372 to use the 'createinstallmedia' command to make your thumb drive bootable. then restart from the thumb drive (System Preferences > Startup Disk or else hold down option key after the chime when your computer restarts), use disk utility to erase your hard disk and install Mojave. best to use the same user name as your old account so your old files will work seamlessly. once your Mojave is set up you can plug your external hard drive back in and copy over your files to the new Applications, Library and User folders on your hard drive. you may have to go subfolder by subfolder to copy everything cleanly

Hi, so kill of trustd and rm of nsurlsessiond def helped super high CPU usage, thankyou! But my laptop is still running hot with another runaway process. Struggling to find process/solution... any ideas?

Reposting this reply to another member ---> You should find the answer in this post... I followed it step by step and it worked: https://discussions.apple.com/thread/251258165?answerId=252960046022#252960046022

You get the randomised name by typing:

# ls -la /var/folders/zz | grep nsurlsessiond

In my case the name is zyxvpxvq6csfxvn_n00000y800007k, so I would type:

# sudo rm -fr /var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k

I noticed the same logs in the console on my mac with Catalina, as well as high CPU usage from nsurlsessiond. I think I solved it by uninstalling then reinstalling Google Backup and Sync. Not sure if you use the Google Backup and Sync tool, but maybe worth a try if you do?

I’m having exactly the same problem after upgrading an old mid 2012 MacBook Pro to Catalina.

The strangest things seem to trigger it, such as trying to view the storage tab of the “about this Mac” dialog.

I have also the same problem after upgrading my mid 2012 MabBook Pro 15" from 10.12.6 to 10.15.4. I can not trigger it by opening the "About this Mac" dialogue.

I haven't figured out how to trigger it yet.

What I tried: To log out from my Apple ID, but there was no effect.

Have this issue on Catalina too.

Not sure what triggers it yet, seems to be a bit random.

Noticed that PID mentioned in the nsurlsessiond error message corresponds to the trustd process. Force-kill of the trustd process seems to get it out of this error-spamming state...

Seem to have fixed this by doing a complete wipe and reinstall of Catalina.

Killing the trustd process would stop the high CPU usage but seemed to make most applications hang.

Have never had Google file stream installed.

Killing trustd doesn't seem to have caused any problems to other apps - at least I haven't noticed any. It gets restarted automatically right away. Also I've noticed another message in the system.log:

Apr 14 16:13:45 MBP-Artem nsurlsessiond[236]: libcoreservices: __makeDirectory: 405: mkdir: path=/var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k/0/ mode=0755: Operation not permitted

Apr 14 16:13:56 --- last message repeated 13590 times ---

Apr 14 16:13:56 MBP-Artem com.apple.xpc.launchd[1] (com.apple.trustd[195]): Service exited due to SIGKILL | sent by com.apple.activitymonitor.helper[1303]

Note how it was repeated 13590 times in just 11 seconds!

(Here you can also see the point where I killed trustd).