Excessive writes by launchd, kernel_task, and corespotlightd

Jonathan Boyd wrote:

The spotlight index was rebuild. After that there was still another 500 GB of writes over the course of about 2 days. That doesn’t seem normal.

Rebuilding the spotlight index isn't normal. If you are trying to get a baseline estimate for typical behaviour on this computer, you have to let everything settle down, at least a couple of days, then restart. Then use it normally for a week or so. Then look at your numbers.

Not entirely, as I explained. It used to be that there were 100-200 MB/s of writes on a constant basis. Imm not getting the constant write any more but at some point during the day when I’m not checking Activity Monitor there are still large unexplained writes going on.

The operating system doesn't explain anything that it does. Could this be Time Machine maybe?

I posted values from my computer. Those were significantly less than your number. But I also don't use this computer during the day. These kinds of issues can't be actively investigated or fixed. By that I mean, it gets worse the more you fiddle with it. You have to let it set for a while. Then check the data. Then compare that data to other, similar installations. I could post the values from my work computer on Friday, for example. I run Xcode all day, so if your I/O is more than mine, then you've probably got a problem.

> You haven't said anything about what you're doing with this computer.

> Now you offhandedly thrown out "VM". I wouldn't be surprised if VM use could cause that.

OK. Sorry. I interpreted that as "Virtual Machine". If you aren't running virtual machines, i.e. other operating systems on top of the current one, then that's not a factor.

> do you have any 3rd party system modifications installed.

Like what? The likes of Teams and Zoom install extensions but other than that sort of thing I haven’t modified the system in any way that I can think of.

> Just so you know, if you respond "no" to that last question, people will just think you're a liar.

I’m finding this a little confrontational.

I provided a fairly detailed lists of the top offenders. I also clearly explained why this was important. And you took the effort to remove said list and explanation from your quote when you accused me of being confrontational. As they say, "every accusation is a confession". 😄

So, before you take the time to try to let the computer settle down and get more accurate readings, I recommend uninstalling any 3rd party system modifications. In many cases, these can be difficult to remove. At least in Sequoia, it's no longer flat-out impossible. But it may take some time and effort.

In many cases, the easiest solution is still to erase the hard drive and reinstall the operating system. You can restore from backup, but you have to be careful about it. You can restore user files and user accounts. But don't restore any software, apps, system settings, or "other files". You can manually reinstall the apps that you absolutely have to have. You don't need anything on that list. I'll repeat it here to correct the earlier autocorrect mistake. Avoid "security" apps, "privacy" apps, clean up apps, boost-up apps, tune-up apps, haxies, customization apps, etc.

I cured it in November by turning off Spotlight and using EasyFind (free in the App Store) instead. It dropped from over 100GB per day to around a normal 10-15GB.

Open System Settings/Spotlight and click the Search Privacy button at the bottom.

Add your computer drive and any others attached to it.

Jonathan Boyd wrote:

I'll post an EtreCheck report.

Make sure you have the most recent version. I just released version 6.8.8 the other day. It includes some SMART information for the internal SSD. It will show the lifetime writes to the SSD, from the point of view of the SSD. It will likely be a scarily large number, but it's something that can be more easily compared to other people.

Plus, it is strictly SSD writes. Activity Monitor is showing all different kinds of I/O and it isn't documented other than by being under the "Disk" tab. And it's only data since the last restart. For all we know, it might include reads and writes that go through named pipe and that could be considered "Disk" I/O, but it doesn't actually touch the SSD.

Ok so let me accept, for the moment, that Empty Space in not central to this issue

So what could it be Third Party Software

To skip the Q&A session, just download the Application Etrecheck directly from the Developer. 

It’s a diagnostic tool that doesn’t change your computer at all. It gives you a clear and easy-to-read list of both your hardware and software. 

You can get it for free or pay for extra features. And don’t worry, the report won’t reveal any personal information. 

Once you’re done, just copy and paste the full report using the Additional Text Icon.

I have been purposely reluctant to mention 3 Categories of Third Party Software / Services that are baffling.

Why some users insist on installing and using the below software. 

Commercial VPNs 

Third Party Security Software 

Third Party Disk Cleaners / Optimizer 

Through in Memory Cleaners

None of which belong any where near Apple Machines

Any or all of the above would probable appear in the Etrecheck report

OP wrote " I've got roughly 130GB free space on the SSD. " and " my 14" MacBook Pro (M2 Pro, 32 GB RAM, 1 TB SSD,"

When the computer uses a lot of CPU power, it may indicate a lack of empty space on the drive.

In this case, the CPU usage increase as the system searches for empty space to save changes. 

It’s usually good computer practice to keep at least 20% to 25% of the total drive capacity empty to avoid unintended consequences, including what the computer is experiencing now

You are welcome

If we may draw a comparison between your machine with the 130 GB of empty space

To this machine I am replying from - M4 Mac Mini with 500GB SSD and 446 GB of Empty Space

Corespotlightd has written 68.7 MB

Kernel-Task has written 1.09 GB

This machine as been On and Operational since >> Today Sat  1 Feb 03:31 EST or about 4 Hours

The point being.

If you are that concerned about wearing out the drive with disk writes

Help the computer do what is best for the computer.

The less empty space for the computer to work with will, in fact will hasten the wrote / rewrite process

In effect, increase the ware and tear on the drive

Give it some space to work with instead of try to jam more onto the drive

It like your Fuel Tank

Once the tank is full or nearing full, you can not pump more fuel into the tank without a Spill Over effect

This problem only appeared after updating to Sequoia . . . Sonoma was OK.

Another peculiarity was that although it was writing the data nothing ever appeared on the drives.

It was as though it were writing vast amounts and instantly deleting them so that nothing was visible. It also had no effect on the performance of the machine

If I hadn't happened to switch on Activity Monitor I would not have been aware of it . . . a silent killer like High Blood Pressure!

Jonathan Boyd wrote:

I eventually restarted in recovery mode, ran disk first aid (on the container, not just the volume) and fixed a bit of corruption. I then rebuilt the Spotlight index.

Just so you know, all that's going significantly increase those write amounts.

The constant writes and high CPU usage have stopped

So it's fixed then?

there's no reason why it should be a VM issue.

You haven't said anything about what you're doing with this computer. Now you offhandedly thrown out "VM". I wouldn't be surprised if VM use could cause that.

The writes in the last 2 days 16 hours are:

launchd: 410 GB

• kernel_task: 320 GB

• corespotlightd: 81 GB

• mds_stores: 31 GB

• Everything else is single figure GB or less

I'm concerned about my SSD potentially writing over 100 TB a year for no apparent reason and wondering what launchd and kernel_task are doing that requires so many writes!

For comparison, my computer has been running for almost 10 days and is showing:

launchd: 58.91 GB

mds_stores: 58.31 GB

kernel_task: 53.79 GB

everything else: single figures

So this would suggest that the cause is not indexing as you have significantly less mds_stores than me.

What are you doing with those VMs? And do you have any 3rd party system modifications installed. Just so you know, if you respond "no" to that last question, people will just think you're a liar. Such things are extremely popular and cause the vast majority of problems here in the forums. This place would be a ghost town without "security" apps, "privacy" apps, clean up apps, boot apps, haxies, customization apps, etc.

You mention using Pages.

There has been quite a discussion on excessive disk writes where simply using Pages has made the computer go berserk. Could be worth investigating.

Regarding where the writes are occurring . . . even though my disk showed no signs of the activity they were being logged by DriveDX which measures the wear on the disk.

In normal use a computer should not be writing more than 10-15GB per day unless of course you are downloading or deliberately writing large amounts such as when converting video to ProRes etc.

I am aware of that

The suggestion of Etrecheck still out there.

If you choose to avail yourself of it

I am sure any one of us would be more than willing to have a very close review of it