Excessive writes by launchd, kernel_task, and corespotlightd

A couple of days ago my 14" MacBook Pro (M2 Pro, 32 GB RAM, 1 TB SSD, Mac OS 15.2) was constantly writing around 100–200 MB/s and experiencing high CPU usage, with corespotlightd and kernel_task being the main culprits. A couple of times a minute the computer would stutter and I'd get a spinning cursor for a moment. I eventually restarted in recovery mode, ran disk first aid (on the container, not just the volume) and fixed a bit of corruption. I then rebuilt the Spotlight index.


The constant writes and high CPU usage have stopped, but every once in a while I check Activity Monitor and the amount of data written will have jumped by a huge amount while I'm not checking. In the space of less than 3 days, these processes have written roughly 1TB to my SSD. I haven't had my laptop awake for a huge amount of time, I haven't been updating apps or the OS, or downloading much – less than 30GB has been downloaded in that time. I have very low memory pressure and no swap in use, so there's no reason why it should be a VM issue. I've got roughly 130GB free space on the SSD.


The writes in the last 2 days 16 hours are:

  • launchd: 410 GB
  • kernel_task: 320 GB
  • corespotlightd: 81 GB
  • mds_stores: 31 GB
  • Everything else is single figure GB or less


I'm concerned about my SSD potentially writing over 100 TB a year for no apparent reason and wondering what launchd and kernel_task are doing that requires so many writes!

MacBook Pro 14″, macOS 15.2

Posted on Feb 1, 2025 1:50 AM

Reply
Question marked as Top-ranking reply

Posted on Feb 1, 2025 7:54 AM

Jonathan Boyd wrote:

The spotlight index was rebuild. After that there was still another 500 GB of writes over the course of about 2 days. That doesn’t seem normal.

Rebuilding the spotlight index isn't normal. If you are trying to get a baseline estimate for typical behaviour on this computer, you have to let everything settle down, at least a couple of days, then restart. Then use it normally for a week or so. Then look at your numbers.

Not entirely, as I explained. It used to be that there were 100-200 MB/s of writes on a constant basis. Imm not getting the constant write any more but at some point during the day when I’m not checking Activity Monitor there are still large unexplained writes going on.

The operating system doesn't explain anything that it does. Could this be Time Machine maybe?


I posted values from my computer. Those were significantly less than your number. But I also don't use this computer during the day. These kinds of issues can't be actively investigated or fixed. By that I mean, it gets worse the more you fiddle with it. You have to let it set for a while. Then check the data. Then compare that data to other, similar installations. I could post the values from my work computer on Friday, for example. I run Xcode all day, so if your I/O is more than mine, then you've probably got a problem.

> You haven't said anything about what you're doing with this computer.
> Now you offhandedly thrown out "VM". I wouldn't be surprised if VM use could cause that.

OK. Sorry. I interpreted that as "Virtual Machine". If you aren't running virtual machines, i.e. other operating systems on top of the current one, then that's not a factor.

> do you have any 3rd party system modifications installed.

Like what? The likes of Teams and Zoom install extensions but other than that sort of thing I haven’t modified the system in any way that I can think of.

> Just so you know, if you respond "no" to that last question, people will just think you're a liar.

I’m finding this a little confrontational.

I provided a fairly detailed lists of the top offenders. I also clearly explained why this was important. And you took the effort to remove said list and explanation from your quote when you accused me of being confrontational. As they say, "every accusation is a confession". 😄


So, before you take the time to try to let the computer settle down and get more accurate readings, I recommend uninstalling any 3rd party system modifications. In many cases, these can be difficult to remove. At least in Sequoia, it's no longer flat-out impossible. But it may take some time and effort.


In many cases, the easiest solution is still to erase the hard drive and reinstall the operating system. You can restore from backup, but you have to be careful about it. You can restore user files and user accounts. But don't restore any software, apps, system settings, or "other files". You can manually reinstall the apps that you absolutely have to have. You don't need anything on that list. I'll repeat it here to correct the earlier autocorrect mistake. Avoid "security" apps, "privacy" apps, clean up apps, boost-up apps, tune-up apps, haxies, customization apps, etc.

25 replies

Feb 1, 2025 8:17 AM in response to Owl-53

> I am aware of that


I realise after posting that that your comment was probably directed at the other guy rather than being a question for me. Sorry for the misunderstanding.


> The suggestion of Etrecheck still out there. If you choose to avail yourself of it. I am sure any one of us would be more than willing to have a very close review of it


Thanks. I had run Etresoft, but didn't notice anything terrible strange.


Also hadn't got round to updating to 15.3 – usually like to leave it a couple of weeks before updating just in case there's any unexpected issues, but I've gone ahead and done it now and so far there's no weird behaviour. Maybe should have tried that first! Could be there was a wee bug in 15.2 that got fixed. I'll monitor performance over the next 24 hours and if I start having issues again I'll post an EtreCheck report.


Also deleted some stuff just in case space was an issue, so there's over 200GB free now.


Thanks for the suggestions.

Feb 1, 2025 8:29 AM in response to etresoft

> I provided a fairly detailed lists of the top offenders. I also clearly explained why this was important. And you took the effort to remove said list and explanation from your quote when you accused me of being confrontational. As they say, "every accusation is a confession"


I felt like you were suggesting I might be a liar and the way you'd phrased a few other things came across as a little confrontational. If it hasn't intended that way then sorry for misinterpreting you. You have put some effort into replies so clearly you're not just here to troll me.


I don't use haxies and haven't since the days of System 8. Quite happy to have left the days of extension conflicts, Resedit hacks, and error -11 bombs behind . Don't use security apps, etc. Used Onyx once to rebuild the Spotlight index, but that was it. Don't particularly trust those apps and always worry that they'll just make things worse.


I wouldn't normally rebuild the Spotlight index, but with Spotlight seeming to be so involved in CPU and I/O usage I wondered if there might be something corrupted. There had also been some files Spotlight wasn't bringing up in searches that it used to, so I was slightly suspicious that there was something wrong there. Since rebuilding it those files are appearing again. Might just be coincidence, but maybe not.


Also updated to 15.3 a couple of hours ago. Normally leave updates for a couple of weeks in case a bug gets discovered after release, but thought Id' make an exception in this case just include case there was a bug in 15.2 that has got fixed. I'll keep an eye on things for the next couple of days and let it settle down as you suggested. Maybe everything is fixed now through some combination of disk first aid, rebuilding the index, and updating to 15.3. Had just never seen that behaviour before with the massive writes and it slightly freaked me out.

Feb 1, 2025 8:43 AM in response to etresoft

I’ve got the latest version, thanks. Currently shows 40 TB written. Computer is less than a year old. Only got it at the start of the summer. There was over 20 TB of writes listed in Activity Monitor for last week but you’re saying that might not mean much.


If I was writing less than 100 TB in a year the I guess that should be okay. Just looked for a couple of days like it was going to be more like 100 TB in a month, which had me worried.


I know Activity Monitor only lists usage since the last restart, but I didn’t know that I/O in the Disk tab wasn’t necessarily Disk I/O. I’m a little confused by that now! I don’t have any other drives plugged in and network I/O has its own tab so I assumed that disk I/O was all read/writes from the SSD. didn’t think stuff to pipes that don’t physically get written would be included. Curious now!

Feb 1, 2025 3:06 PM in response to Jonathan Boyd

Jonathan Boyd wrote:

I’ve got the latest version, thanks. Currently shows 40 TB written. Computer is less than a year old. Only got it at the start of the summer. There was over 20 TB of writes listed in Activity Monitor for last week but you’re saying that might not mean much.

I bought this computer, the newest one I own, on June 20, 2023. EtreCheck shows:


S.M.A.R.T. Details: 1% used, 40.43 TB written, 100% health, 9 unsafe shutdowns


While I only use this computer in the evenings and weekends, I do use it pretty heavily with Xcode and virtual machines. This is my "test rig", so I've used it with Ventura and throughout the Sequoia beta cycle.


My primary computer, a MBP 2021, purchased sometime in 2021, ran Monterey and now Ventura, reports:


S.M.A.R.T. Details: 3% used, 52.91 TB written, 100% health, 26 unsafe shutdowns


So you do seem to have more data written than I would expect. However, this is something that I literally only added to EtreCheck the other day. While I'm confident the data is what Apple reports in the SMART data, I haven't seen a lot of other people's results to say what is "normal".

I know Activity Monitor only lists usage since the last restart, but I didn’t know that I/O in the Disk tab wasn’t necessarily Disk I/O. I’m a little confused by that now! I don’t have any other drives plugged in and network I/O has its own tab so I assumed that disk I/O was all read/writes from the SSD. didn’t think stuff to pipes that don’t physically get written would be included. Curious now!

Unfortunately, I don't think I can satisfy that curiosity. I can tell you where EtreCheck gets its numbers from. I can tell you some other place to get other numbers from. But I can't say where Activity Monitor is reading its totals from. There are many different sources for such values. Something like a named pipe could be considered disk I/O or networking I/O, or neither.

Feb 2, 2025 2:33 AM in response to etresoft

Overnight my laptop recorder 400GB of writes when it was supposedly asleep. Checked the figures when I put it to sleep last night and checked them again this morning. 400GB in about 11 hours when it wasn't even being used. Currently showing 310 GB of writes for kernel_task and 150GB for launchd with just 1 day of uptime. Also weirdly showing 28GB of reads for contactsd!


Here's the EtreCheck report:


Feb 2, 2025 6:58 AM in response to Jonathan Boyd

Jonathan Boyd wrote:

Currently showing 310 GB of writes for kernel_task and 150GB for launchd with just 1 day of uptime.

These two processes are essentially "the operating system". The design of said operating system routes many app-level operations through system-level tasks.

Also weirdly showing 28GB of reads for contactsd!

Now that's more interesting. There are many reports of problems with 3rd party contact integration. Usually the culprit is Google, but it could be Microsoft too. You did have an Exchange sync process listed in your EtreCheck report.


I don't know anything about diagnosing or debugging this particular issue. I try to avoid Google and I only use Microsoft for Office and e-mail. But these sync problems are a common problem. I don't know if anyone has looked at associated I/O usage, but what you describe makes sense.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Excessive writes by launchd, kernel_task, and corespotlightd

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.