Why is Mdsynch using so much CPU on Monterey

Question

Level 1

14 points

Why is Mdsynch using so much CPU on Monterey

I have a late 2015 iMac Retina w/64GB memory and recently upgraded to Monterey. When I boot up, everything is working fine for a few hours, then suddenly normal functions like clicking on a webpage or opening an app simply don't work. If I open up Activity monitor, it shows that Mdsynch is consuming anywhere from 85%-99% of the cpu. Then, if I reboot, everything is fine again... until a little bit later that same thing occurs. What should I do to eliminate this annoying pattern? It's driving me crazy.

ps. I have already reinstalled the latest version of Monterey from the web; have confirmed that the firmware is up to date; and reset the NVRAM.

iMac 27″, macOS 12.2

Posted on Feb 12, 2022 12:56 PM

Reply

Answer 1

Best reply

lllaass

Level 10

210,411 points

Feb 13, 2022 1:37 AM in response to Paul Hixson1

Finding: More than one antivirus app - This computer has multiple antivirus apps installed

Antivirus software: Apple, CleanMyMac, and Malwarebytes

Action: Having more than one antivirus app is asking for trouble. Remove CleanMyMac using their instruction.

Malwarebytes is usually OK but I would uninstall it and in the future download it if yu suspect malware.adware was installed.

Finding: Launchd: /Library/LaunchAgents/com.maintain.Restart.plist

Launchd: /Library/LaunchAgents/com.maintain.ShutDown.plist

Action: Do you know what this app is?

Finding: [Running] Cisco AnyConnect Socket Filter Extension - version 4.10.01075 (Cisco - 2021-04-28)

Action: what is the app

Finding:[Running] WireGuardNetworkExtension - version 3.3.0 (Mudhook Marketing, Inc. - 2021-09-26)

Action: Try disabling the VPN.

FInding: Write speed: 423 MB/s

Read speed: 1836 MB/s

Action: That is a slow write speed for a Fusion drive. Fusion drives seem to be problematic. The high Mdsych CPU usage may be related to the slow write speed. Only real solution is to replace the 3TB HDD with an SSD and not use the small, 121GB SSD that is part of current Fusion drive. Or if you can replace the small SSD with a large one and use that ast your startup drive.

Finding: 2022-01-11 Okta Verify (3.0.3)

2022-02-08 Kamino (2.1.0(488))

2022-01-13 SiteSucker (4.3.2)

Action: What do these apps do? Can you disable these as a for test?

Reply

Answer 2

Paul Hixson1 Author

Level 1

14 points

Feb 13, 2022 7:29 AM in response to lllaass

EtreCheck after removing questionable files

I removed CleanMyMac and Malwarebytes.

Cisco AnyConnect Socket Filter Extension is part of the Cisco VPN that the Univ. of Illinois requires for accessing some files and apps from off campus locations -- this is the latest version

I removed the IP Vanish VPN app (which had the WireGuardNetworkExtension

Removed OKTA Verify (wasn't really using it)

Removed SiteSucker (it's an app for download webcontent from a hosted website)

Removed Kamino (or I think I did -- I believe it was associated with a 3rd party app from Western Digital

Will monitor performance and let you know if these steps solved the problem.

In terms of the write speed and the fusion drive, I'm reluctant to invest more $ in this machine as it is almost 7 yrs old. Just waiting for Apple to announce new Apple silicon M1Mac (or M2) for 27" iMacRetina, and I plan move to that hardware asap. That's why I'm hoping that eliminating these software issues will solve this problem without requiring new hardware investments

Reply

Answer 3

lllaass

Level 10

210,411 points

Feb 12, 2022 1:36 PM in response to Paul Hixson1

That process is associated with indexing the drive(s) for Spotlight search.

Note that the % number given is the equivalent % for ONE core For multicore Macs it is not unusual for one process to exceed 100 %.

when you are having problems what is total % CPU load? That is either % System plus %user in the bottom center?

What else is using a lot of CPU when you are having problems?

Download and run this app so we can find more information about your installation.

https://etrecheck.com/upgrade

It shows what is launched and other information and is very useful in finding causes of problems. After you first launch the app make sure you check Enable full disk access in the box in lower left.

After running the app use the app's feature to paste to clipboard. Then paste it in the text box for a reply in this forum click on the addition text icon. This is because the normal reply text box limits how much you can type.

o personal identifiable information is contained if the app output. The app was written for a person who is contributor to these Apple Support Communities

Reply

Answer 4

Paul Hixson1 Author

Level 1

14 points

Feb 14, 2022 9:38 AM in response to Paul Hixson1

Dear lllaass, you did it! Thank you so very much!

I have been beating my head against various versions of this problem for months (and had even called Apple tech support on related versions of this problem several times without ever getting a solution).

After deleting the items you suggested as reported above, the problem has totally gone away. The computer is booting up more quickly; spotlight is reporting more accurate answers, and amazingly, Mdsynch is now occupying less than 0.001% of CPU. My computer is running cooler (as measured by TG Pro) and for 24 hours, I've had none of the problems that I had previously described as being like a memory leak that rendered trackpad clicks useless and forced a reboot for the computer to start behaving itself. The only item which I deleted for this test I am tempted to re-introduce is the IP Vanish VPN app, but if I do that and the problem returns, that will confirm that it was at least part of the problem. The rest of the apps that I deleted will not be put back on the machine — ever.

I would be curious to get your expert opinion, which of these culprits do you think was most likely the cause of this strange behavior?

Reply

Answer 5

Paul Hixson1 Author

Level 1

14 points

Feb 15, 2022 9:44 AM in response to lllaass

Dear lllaass, you did it! Thank you so very much!

I have been beating my head against various versions of this problem for months (and had even called Apple tech support on related versions of this problem several times without ever getting a solution).

After deleting the items you suggested as reported above, the problem has totally gone away. The computer is booting up more quickly; spotlight is reporting more accurate answers, and amazingly, Mdsynch is now occupying less than 0.001% of CPU. My computer is running cooler (as measured by TG Pro) and for 24 hours, I've had none of the problems that I had previously described as being like a memory leak that rendered trackpad clicks useless and forced a reboot for the computer to start behaving itself. The only item which I deleted for this test I am tempted to re-introduce is the IP Vanish VPN app, but if I do that and the problem returns, that will confirm that it was at least part of the problem. The rest of the apps that I deleted will not be put back on the machine — ever.

I would be curious to get your expert opinion, which of these culprits do you think was most likely the cause of this strange behavior?

Reply