Why are trustd, nsurlsessiond, syslogd causing high CPU on Mac?

Open the "Activity Monitor" app.

Locate the "trustd" process in the left column.

Find its PID in the "PID" column, it should be an integer.

Open the "Terminal" app.

Copy the following command, replacing "[trustd PID]" with the PID you just found:

sudo kill -9 [trustd PID]

and run it (press "Return")

Still in "Terminal", copy and run the following command:

ls -la /var/folders/zz | grep nsurlsessiond

The name in the last column is the name you need to replace "[randomized name]" with in the next and last command to run:

sudo rm -fr /var/folders/zz/[randomized name]

That's it, you're done!

You can do this two different ways.... you can navigate to the /var/log/asl folder via Terminal, and then run remove file commands on the appropriate files. In theory there files don't matter since they're just logs, but make sure you know what you're doing before removing anything you might need. An even easier way is to just navigate to the /var/log/asl folder from Finder, and then move these files to the trash. I was finding the nsurlsessiond process was creating 25MB log files every 1-2 minutes, and it was hijacking my computer's storage. Not only that, the process itself was draining my battery. Once I followed the info mathieu105 posted, I was able to stop these logs from accruing.

Elle, you need to kill the trustd proces (PID 179 in your list.

After killing trustd you will see the CPU load drop immediately.

The second step is deleting the subdirectory that nsurlsessiond is trying to write to.

I have done this, and my MacBook is running stable again for two weeks now.

Make an extra user on your Mac. Don’t connect the new user to your AppleID. Log in as the new user. If your system is still ‘running away’ then it is an operating system issue. If not, it is one of the programs that you use in your main user account.

Use Activity Monitor to see which process eats up your CPU.

No, nothing will be disabled. We only delete a dictionary witch nsurlsession wants to change. Sience it has no rights to do that it tries over and over again what causes the high CPU usage.

The only thing what we do is to delete this dictionary with the logs in it, the logs are not needed anymore. Nsurlsession creates automatically a new dictionary after that.

Reposting this reply to another member ---> You should find the answer in this post... I followed it step by step and it worked: https://discussions.apple.com/thread/251258165?answerId=252960046022#252960046022

You should find the answer in this post... I followed it step by step and it worked: https://discussions.apple.com/thread/251258165?answerId=252960046022#252960046022

Open the "Activity Monitor" app.

Locate the "trustd" process in the left column.

Find its PID in the "PID" column, it should be an integer.

Open the "Terminal" app.

Copy the following command, replacing "[trustd PID]" with the PID you just found:

sudo kill -9 [trustd PID]

and run it (press "Return")

Still in "Terminal", copy and run the following command:

ls -la /var/folders/zz | grep nsurlsessiond

The name in the last column is the name you need to replace "[randomized name]" with in the next and last command to run:

sudo rm -fr /var/folders/zz/[randomized name]

That's it, you're done!

Thank you so much. It wasn't clear to me whether the steps were doing anything until I tried:

# ls -la /var/folders/zz | grep nsurlsessiond

and plugged in that result.

# sudo rm -fr /var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k

Suddenly, the CPU load dropped from ~60% to 8%.

The memory pressure plot turned from yellow to green.

The energy impact plot has a dropoff like one side of the Mariana Trench.

Amazing. Thank you.

You have to replace "[trustd PID]" with the process ID, see this post: https://discussions.apple.com/thread/251258165?answerId=252527520022#252527520022

I killed the trustd process, and that has taken care of nsurlsessiond as well. It's been a few weeks now.

There is a comment, where you are walked step by step through the process. I don't have a link at the moment, but it should be this, because I'm getting the notifications. I usually don't touch Terminal, but it worked very well.

Thanks again to everyone taking time and effort to help!

Same issue solved here in Denmark with the recipe above, on my girlfriend's eight year old Macbook Air after updated it to "Catalina". The folder name was exactly the same, so doesn't seem to be that random. After reboot the folder was re-created, but this time as a symbolic link - that's what the "@" in the 'ls' output means - to a directory under mountpoint /System/Volumes:

$ ls -ldi /var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k
 12885475075 drwxr-xr-x@ 5 _nsurlsessiond _nsurlsessiond 160 7 Jun 09:16 /var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k
$ find / -inum 12885475075 -ls 2>/dev/null
 12885475075 0 drwxr-xr-x 5 _nsurlsessiond _nsurlsessiond 160 7 Jun 09:16 /System/Volumes/Data/private/var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k
 12885475075 0 drwxr-xr-x 5 _nsurlsessiond_nsurlsessiond 160 7 Jun 09:16 /private/var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k

You have to replace the brackets [ ] as well :

sudo kill -9 223