Can I know which process is using the kernel ?

After putting the folder under privacy options in Spotlight and after rebooting my mac (which got stuck when I tried to run sudo syscallbypid.d , it looks like this mad disk activity has come to an end, at least until now.

I'll close the topic, thanks!

Thanks,

I tried both with terminal and with the GUI and the output is overwhelming. Nothing relates to any files in the NAS, and it's very difficult to understand which process is doing what, being the logs not very clear.

Since my NAS HDD was working like crazy, I quickly tried to filter out the logs and the vast majority of the entries are related to SandBox

$ log show --start "2023-01-26 09:30:00" --end "2023-01-26 09:40:00" | grep 'kernel:' | awk -F\: '{print $4}' | awk -F" " '{print $1}' | sort | uniq -c | sort -nr | head -n 10 
1049 (Sandbox)
 120 (AppleBCMWLANCore)
 100 PMRD
  19 (AppleSEPKeyStore)
  13 (apfs)
  12 (CoreAnalyticsFamily)
  10 (IOTimeSyncFamily)
  10 (AppleSmartBatteryManager)
   6 (AppleMobileFileIntegrity)
   5 (Quarantine)

But the content of such logs doesn't mean anything to me

2023-01-26 09:36:07.174426+0100 0x1fdc54f  Error       0x0                  0      0    kernel: (Sandbox) Sandbox: imagent(5098) deny(1) user-preference-write com.apple.messages.commsafety
2023-01-26 09:36:07.175739+0100 0x1fd974a  Error       0x0                  0      0    kernel: (Sandbox) 1 duplicate report for Sandbox: imagent(5098) deny(1) user-preference-write com.apple.messages.commsafety
2023-01-26 09:36:07.175747+0100 0x1fd974a  Error       0x0                  0      0    kernel: (Sandbox) Sandbox: imagent(5098) deny(1) mach-lookup com.apple.familycircle.agent
2023-01-26 09:36:07.176289+0100 0x1fdc54f  Error       0x0                  0      0    kernel: (Sandbox) Sandbox: imagent(5098) deny(1) user-preference-write com.apple.messages.commsafety
2023-01-26 09:36:14.938087+0100 0x1fdc799  Error       0x0                  0      0    kernel: (Sandbox) 1 duplicate report for Sandbox: imagent(5098) deny(1) user-preference-write com.apple.messages.commsafety
2023-01-26 09:36:14.938107+0100 0x1fdc799  Error       0x0                  0      0    kernel: (Sandbox) Sandbox: cloudpaird(31325) deny(1) system-fsctl (_IO "h" 47)
2023-01-26 09:36:14.941416+0100 0x1fd974a  Error       0x0                  0      0    kernel: (Sandbox) Sandbox: cloudpaird(31325) deny(1) mach-lookup com.apple.metadata.mds
2023-01-26 09:36:14.944464+0100 0x1fdc798  Error       0x0                  0      0    kernel: (Sandbox) 1 duplicate report for Sandbox: cloudpaird(31325) deny(1) mach-lookup com.apple.metadata.mds

I have decided to disable Spotlight for the mounted NFS volume, think this could be an issue (I saw high CPU pecentage usage of mds), but nothing has changed so far.

I have filtered the tcpdump I get from the NAS and I see the following, which means some programs is indexing (or accessing) my pictures.

[~] # tcpdump -i eth0 | grep lookup | awk -F" " '{print $NF}'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
"._20181102_115339_001.jpg"
directory
"._20181102_120114(0).jpg"
directory
"._20181102_140653.jpg"
directory
"._20181102_140720.jpg"
directory
"._20181102_141305.jpg"
directory
"._20181102_152707.jpg"
directory
"._20181102_153217.jpg"
directory
"._20181102_155324.jpg"
directory
"._20181102_162442.jpg"
directory
"._20181102_162712.jpg"

Unfortunately, nothing in the Mac logs, if I look for those images. It's also interesting to see the vast majority of the files start with ._, which are the extended attributes that NASes take from Macs and create

Hey @Randall_2023, very nice link and suggestion!

I think also sudo fs_usage may help me a bit (even a bit more), I'll check these commands as soon as the disk spins again (typically, every morning), as you can see from some stats I took from my NAS (I wasn't even at home during that time)

Hi

I checked fs_usage and it looks like mds is the cause of it, although I mount my NAS on mount in my home folder (Users/luca/mount) and this folder is in the Privacy section of Spotlight, so it should not be indexed. I am not too sure about mds since I do not see the entire amount of files I get from tcpdump.

I also checked the zprint command but frankly, speaking, I couldn't get any value out of it because I cannot understand how to get benefit from its output.

With Activity monitor you can't check which files are in use in the process is the kernel