iMac: Slow saving, Etrecheck only in Safe Mode

I see two things: one fixable, the other not.

What is not fixable:

    iMac Model: iMac18,1

2,3 GHz Dual-Core Intel Core i5 (i5-7360U) CPU: 2-core

You have the slower "educational/institutional" iMac developed for bulk buyers with limited needs and budgets. The processor is a laptop-class, 2.3ghz dual-core i5. The standard consumer 21.5-inch iMac that same year, the iMac 4K, had at minimum a desktop-class3.0 ghz four-core i5 processor that benchmarks about 35% faster than the 2-core iMac.

The really good news is yours has an Apple factory SSD, an option I've never seen exercised in other EtreCheck reports for that "edu-model." Slow mechanical hard drives common to that model were always the #1 cause of "slow" complaints we see here. Factory SSD is a big win even is small, but yours needs a little love, because the drive is filling up and is underperforming:

Performance:

System Load: 15.05 (1 min ago) 15.49 (5 min ago) 7.18 (15 min ago)

Nominal I/O usage: 12.16 MB/s

File system: 33.04 seconds 👍🏻

Write speed: 409 MB/s ⚠️

Read speed: 2035 MB/s

The drive falls within EtreCheck's "healthy" range but your Write speeds are massively depressed, more than I would expect just from the drvie being getting full. Both your Writes and Reads should be over 2000 MB/sec for that drive model. Good news: The fix is easy and free.

I find with my SSD-equipped Macs that the Writes will start to slow over time, like over 1-2 years. The simple fix is a Safe Mode Boot. Apple instructions here (link):

Start up your Mac in safe mode

NOTE: Use the instruction set for Intel Macs without the T2 security chip.

➡️ I have found the support article needs an addition when speeding up an underperforming SSDL

Let the computer "soak" in Safe Mode for about 30 minutes to give time for Safe Mode to finish its housekeeping. Then do a normal restart and run Etrecheck again to see if the drive scores have improved.

The "Safe Soak" is very important for this procedure to work. and I again give thanks and a shout-out to our Grant Bennet-Alder for giving me that tip several years ago.

That procedure has restored speed to my SSDs whenever I applied it, costs you nothing but 30 minutes of time, and does no harm,

Short answer: I suggest that you consider a "clean OS reinstall but preserve data” strategy. As it would be the quickest way to resolve this situation.

A bit longer answer: The good new is that it doesn't appear that your Mac's internal SSD is failing. Actually, it looks like it is in good shape.

What catches my attention is that you were not able run an EtreCheck report unless your Mac was in Safe Mode. To me that strongly suggests a third-party extension, background service, or login item is destabilizing the system during a normal boot. So the Mac behaving “better” in Safe Mode is a classic sign of a software conflict — not a failing SSD.

From the report, the biggest candidates are:

• FortiClient system extensions
• Disk Drill background services (cfbackd)
• Repeated OneDrive installs + sync daemons
• Multiple orphaned launch agents with missing executables
• 18 crashes of mds (Spotlight)

The fact that mds crashed 18 times tells me Spotlight indexing is likely corrupted or constantly restarting. Combine that with aborted iCloud uploads and OneDrive activity, and you get constant metadata churn and perceived “slow write speed.”

Ok, with all that said, what can you do about it (other than a full OS reinstall)?

First, let's see if login items could be the cause:

1. Boot normally
2. Immediately hold Shift after login (prevents login items)
3. Go to System Settings > General > Login Items
4. Remove everything non-essential
5. Then reboot normally again.

If the Mac stabilizes, the issue is login-item driven.

Next, uninstall the following apps. You can always re-install them later:

• FortiClient
• DiskDrill

Next, I suggest that you rebuild the Spotlight Index. Those mds crashes are NOT normal:

1. System Settings > Siri & Spotlight > Spotlight Privacy
2. Add the entire Macintosh HD
3. Wait 60 seconds
4. Remove it, and then, leave the Mac plugged in and idle overnight.

Expect high CPU during reindexing.

Finally, you will need to address the Cloud sync conflict, especially since you are using multiple Cloud services (iCloud, OneDrive, & Dropbox). Running multiple file providers on a 2-core, 8GB Ventura machine is heavy.

It's best to pick one sync solution. Since you started by syncing with iCloud, I suggest you continue with it. After doing the above suggestion, try syncing to iCloud again. This time, it is important to let it finish, even if it takes a long time. Be sure to disable any syncing with OneDrive and Dropbox during this time.

Unless you're using a true VPN tunnel, such as between you and your employer's, school's or bank's servers, they provide false security from a privacy standpoint.  Read these articles:  Pubic VPN's are anything but private and Security Risks: The Dangers of Using Free VPNs (eccu.edu).    

Additionally a new study ("Apple Offers Apps With Ties to Chinese Military”) is specifically about VPN apps in Apple’s App Store.

I recommend uninstalling the VPN according to the developer's instructions. Then you can check to see if you've removed all of the supporting files by downloading and running the shareware app    to search for any files with the application's or the developer's name in the file name.  For the Fortinet files you'd do the following search(es): 

1 - Name contains  fortinet or just fort

2 - Name contains vpn

Any files that are found can be dragged from the search results window to the Desktop or Trash bin in the Dock for deletion.

FAF can search areas that Spotlight can't like invisible folders, system folders and packages.  

If you get warnings that the file can't be deleted because it is in use or used by another app boot into Safe Mode, run Find Any File again and delete from there.

Also your disk is extremely full and is causing the Write speed to be so slow. One should try to maintain a minimum of 80-100GB of free space on the boot drive to facilitate optimal system and application performance.

With your internal SSD being so slow you should get an external SSD to run your Photos, Music and Movies libraries from. That would free up the necessary space.

Also never install and run any "cleaning", "optimizing", "speed-up", anti-virus or VPN apps on your Mac. They are not needed and can adversely affect the system and application performance.

A clean install and migration of your user data with Migration Assistant from a Time Machine backup as Tesserax suggested. You should first remove all of the file before making your last Time Machine backup so you have a clean migration after the clean install.

Slumpmania wrote:

Perhaps reinstalling the system is the quickest solution? But I'm afraid that if I keep my programs and data, the problem will persist.

In that case, instead of doing a re-install with data save, I would suggest that you do a complete "clean" install. Afterwards, only re-install any apps/data you need ... and this case, you DON'T want to use migration assistant to restore your data, especially if you feel it may be corrupted.

Ref:

• https://support.apple.com/en-us/102655
• How to ‘clean’ install modern macOS - The Eclectic Light Company

Clean install, no backup restoration.

FortiClient has issues. Big ones: CVE-2026-21643. That can mean a complete reset and reinstall, and credentials rotation. This for everything associated with it, if it all got breached.

I am not fond of running multiple different file-hosting file-sync services. Based on postings around here, these sync services can conflict. Pick one. Or maybe pick two, if using your own local NAS.

Tesserax wrote:

Hi Allan,

Just to keep my note keeping correct, if I'm not mistaken, on an earlier (2024) reply to a different OP, you mentioned the same thing about the 2015 iMac having a "educational" version. So, if I understand your reply to this OP, then the 2017, mentioned here, would be similar?

Great question! Yes.

The MacTracker database shows these 2-core models. None have Retina displays, and appear to be priced for bulk sales because, for each, there is a more expensive 4-core counterpart.

— iMac (21.5-inch, Late 2011) 2-core i3 at 3.1 Ghz

— iMac (21.5-inch, Early 2013) 2-core i3 at 3.3 Ghz

— iMac (21.5-inch, Mid 2014) 2-core i5 at 1.4 Ghz

— iMac (21.5-inch, Late 2015) 2-core i5 at 1.6 Ghx or, optionally, 4-core i5 at 2.8 Ghz

— iMac (21.5-inch, 2017) 2-core i5 at 2.3 Ghz

Without exception their base price was US$200 less than the "normal" consumer 4-core models. That's an 18% price reduction for a performance loss of 35 to nearly 50%.

With the exception of the Late 2011 version (the last "thick-case" iMac with a 3.5-inch 7200 RPM SATA 3 mech drive), most that we see here have the slow 2.5-inch 5400 rpm SATA 3 mech hard drive that can transfer data no faster than 80MB/sec downhill on a good day. The external USB SSD boot drive method is the #1 performance enhancer for these while being a cost-effective at home task . Drive scores start about 400MB/sec for the external USB 3 solution, making them quite usable (macOS version limitations not withstanding).

OP has the optional flash storage so, if we can help him evict the garbage to see if the drive is really useable, it will exempt him from the "mech drive blues" and it should run quite well in spite of its processor limitations.

The Mactracker database is free in the mac App Store. Nice tool.

Hi Allan,

Just to keep my note keeping correct, if I'm not mistaken, on an earlier (2024) reply to a different OP, you mentioned the same thing about the 2015 iMac having a "educational" version. So, if I understand your reply to this OP, then the 2017, mentioned here, would be similar?

Fantastic! Notes have been updated. Thank you!