SecurityAgent was unable to create requested mechanism builtin:unlock-keychain

Hey chris_g1,

Its not an unexplained restart. Its an unexplained freeze. CPU and GPU are running high and the machine is out of RAM.

After a while, I manually hit restart.

Read a bit about these and this might be multiple issues at the same time. Saw that people were experiencing similar situations but usually tied to some specific app (e.g. saw a lot of issues around TeamView, which I never had)

Before we jump into what I did so far and what I could still do, I just want to clarify: I do not have a steps to reproduce.

These things keep happening randomly, approx. once a week and they have been becoming more and more frequent in the past 1-2 years.

I tried the following things:

Part 1: Getting to Safe Mode

• I temporarily disabled my Firmware password to be able to run Safe Mode
• When I could not run Safe Mode, I cleared PRAM, but still nothing
• After a bit of reading, a hard drive issue seemed most logical given the number of mdwoker_shared running in the background

Verifying file system.

Volume could not be unmounted.

Using live mode.

Performing fsck_apfs -n -l -x /dev/rdisk1s1

Checking the container superblock.

Checking the EFI jumpstart record.

Checking the space manager.

Checking the space manager free queue trees.

Checking the object map.

Checking volume.

Checking the APFS volume superblock.

The volume XXXXXXX - Data was formatted by hfs_convert (748.21.6) and last modified by apfs_kext (1412.101.1).

Checking the object map.

Checking the snapshot metadata tree.

Checking the snapshot metadata.

Checking the extent ref tree.

Checking the fsroot tree.

error: directory valence check: directory (oid 0x13): nchildren (1) does not match drec count (0)

warning: xf : INO_EXT_TYPE_DSTREAM : found unexpected dstream associated with non-regular file

THIS ROW REPEATS A NUMBER OF TIMES

warning: found orphan dstream id object (id 1101481, refcnt 1)

THIS ROW REPEATS A NUMBER OF TIMES, WITH DIFFERENT ID

Too many warnings of this type generated; suppressing subsequent ones.

warning: apfs_fs_alloc_count is not valid (expected 53974746, actual 53974747)

Verifying allocated space.

Performing deferred repairs.

error: Unable to perform deferred repairs without full space verification

error: Try running fsck against the entire APFS container instead of a volume

The volume /dev/rdisk1s1 could not be verified completely.

File system check exit code is 0.

Restoring the original state found as mounted.

• Eventually, I was able to run First Aid successfully from Disk Utility under Recovery Mode, but Still no Safe Mode, and
• mdworker_shared was still running 20+ times

Part 2: Apply Account Sync

• I decided to focus on the followings

error 09:45:24.132289+0200 accountsd "Cannot check access to a private account type: com.apple.account.AppleAccount"

fault 09:45:24.217084+0200 accountsd Unentitled access by client 'CallHistoryPlugi' (selector: accountsWithAccountType:handler:)

error 09:45:24.221987+0200 CallHistoryPluginHelper "Error returned from daemon: Error Domain=com.apple.accounts Code=9"error 09:45:24.496133+0200 accountsd "Client <private> is not allowed to access accounts of type com.apple.account.CardDAV."

• A lot people reported similar issues with Time Machine or Mail, or with relation to other Apple account syncns
• Under Preferences / Apple ID, I already selectively synced applications, but I have seen that with newer versions of macOS, some new features became enabled by default. I went ahead and disabled almost everything and now this error is not flooding the Console
• Things seemed better, but when no application was running (except the Activity Monitor), CPU was still around 5% AND I do remember that a while back, this would not have happened. If I open up my Mac Book and no application is running, CPU was always well below 5%

Could not fit into the 5000 chars....

Part 3: Problematic Application

• I found that there are some applications (newly installed or new version I updated to) that were using more CPU than before. After disabling / removing those, things got even better, but still, I see errors and faults on the Console

These are the errors and faults I still get:

error 00:25:44.472450+0200 accountsd "Cannot check access to a private account type: com.apple.account.CardDAV"

error 00:25:44.473057+0200 accountsd "Client <private> is not allowed to access accounts of type com.apple.account.CardDAV."

fault 00:25:44.473150+0200 accountsd Unentitled access by client 'AddressBookManag' (selector: accountsWithAccountType:handler:)

I don't even use Safari. I haven't even run it in the past month and I had 20+ restarts since I was investigating this. Still, I get these:

error 00:25:49.395553+0200 SafariBookmarksSyncAgent Failed to set up new record zone: Error Domain=CKErrorDomain Code=20 "Request UUID: (null)"

error 00:25:49.395955+0200 SafariBookmarksSyncAgent Failed to fetch Bookmarks zone subscription status due to missing zone: Error Domain=CKErrorDomain Code=20 "Request UUID: (null)"

error 00:25:49.396269+0200 SafariBookmarksSyncAgent Fetching Bookmarks zone subscription status failed with error: <Error Domain=CKErrorDomain Code=20 "Request UUID: (null)">.

error 00:25:49.396430+0200 SafariBookmarksSyncAgent Saving Bookmarks zone subscription failed with error: <Error Domain=CKErrorDomain Code=20 "Request UUID: (null)">.

And these too:

fault 00:30:34.854348+0200 kernel IntelAccelerator driver returned kIOReturnNotReady for transaction [ID=12019, IOSurfaceID=13]

fault 00:30:34.859586+0200 kernel IntelAccelerator previous NotReady transaction [ID=12019, IOSurfaceID=13] sent. kr=0x0

Additionally, in the past year or so I also observed that some application no longer require my password for installs or updates. This might be completely unrelated though.

I feel like macOS quality and stability just generally degraded in the past years, but I'm very interested in any additional suggestions on the matter.

Kind regards,

Peter

Ps. I also ran the Diagnostic mode and that also hasn't found anything.