"find process" eats my CPU!

Question

Level 1

0 points

"find process" eats my CPU!

Hi

The last couple of days I've noticed that the "find process" has been running constantly on my Imac. In Activity monitor it occupies around 50% CPU power (1 thread).

I know it has something to do with the daily, weekly etc. scripts in Linux, but the process has now been running for days.

I tried running the scripts from within Snow Leopard Cache Cleaner, but the process just keep popping up in Activity monitor after restart.

Any suggestions?

thx

Posted on Jun 15, 2011 6:55 AM

Reply

Answer 1

Jun 15, 2011 7:22 AM in response to Svenne88

Reset the smc

Reply

Answer 2

Linc Davis

Level 10

209,739 points

Jun 15, 2011 7:30 AM in response to Svenne88

What is the exact name of the process? What user is it running as? What is the parent process?

Reply

Answer 3

Svenne88 Author

Level 1

0 points

Jun 15, 2011 12:05 PM in response to Linc Davis

SMC...hmmm don't think so.

Bash (890) changes all the time

launchd (160) constant

parent process kernel task (0) user root (0)

Reply

Answer 4

Linc Davis

Level 10

209,739 points

Jun 15, 2011 12:27 PM in response to Svenne88

There should be no long-running script that invokes "find." Some of the daily periodic scripts do, but they shouldn't take more than a minute or so to run.

Start up in safe mode and see whether it continues.

Mac OS X: Starting up in Safe Mode

Reply

Answer 5

Svenne88 Author

Level 1

0 points

Jun 15, 2011 2:40 PM in response to Linc Davis

Starting in safe mode didn't change anything :-(...

Here's a sample snapshot of "Open files and ports" in the "find process":

/Users/finnpoulsen/Downloads/arasaac pictogrammer

/usr/bin/find

/usr/lib/libSystem.B.dylib

/usr/lib/system/libmathCommon.A.dylib

/usr/lib/dyld

/dev/null

->0x077c80cc

->0x077c8194

/private/etc/security/audit_control

/Users

/Users/finnpoulsen/Downloads/arasaac pictogrammer

/private/etc/security/audit_class

Looks like the process is doing some kind of indexing, but something has gone wrong?

Reply

Answer 6

Linc Davis

Level 10

209,739 points

Jun 15, 2011 3:00 PM in response to Svenne88

It doesn't fit with any built-in feature that I know of. View the process table in hierarchical form in Activity Monitor and trace the chain of execution of the find command. If it's something like launchd > bash > find, then the script, whatever it is, is being started from an item in /System/Library/LaunchDaemons. Is there anything in that folder that looks strange?

Another thing you can do is to run the following shell command to see what find is doing:

sudo opensnoop -n find

Reply

Answer 7

Svenne88 Author

Level 1

0 points

Jun 15, 2011 3:27 PM in response to Linc Davis

"If it's something like launchd > bash > find, then the script, whatever it is, is being started from an item in /System/Library/LaunchDaemons."

Yes, it says >bash>find....Here's what I got in /System/Library/LaunchDaemons:

file:///System/Library/LaunchDaemons/bootps.plist

file:///System/Library/LaunchDaemons/com.apple.activitymonitord.plist

file:///System/Library/LaunchDaemons/com.apple.afpfs_afpLoad.plist

file:///System/Library/LaunchDaemons/com.apple.afpfs_checkafp.plist

file:///System/Library/LaunchDaemons/com.apple.airport.wps.plist

file:///System/Library/LaunchDaemons/com.apple.airportd.plist

file:///System/Library/LaunchDaemons/com.apple.airportPrefsUpdater.plist

file:///System/Library/LaunchDaemons/com.apple.alf.agent.plist

file:///System/Library/LaunchDaemons/com.apple.alf.helper.plist

file:///System/Library/LaunchDaemons/com.apple.APNBridge.plist

file:///System/Library/LaunchDaemons/com.apple.AppleFileServer.plist

file:///System/Library/LaunchDaemons/com.apple.appleprofilepolicyd.plist

file:///System/Library/LaunchDaemons/com.apple.applepushserviced.plist

file:///System/Library/LaunchDaemons/com.apple.aslmanager.plist

file:///System/Library/LaunchDaemons/com.apple.atrun.plist

file:///System/Library/LaunchDaemons/com.apple.audio.coreaudiod.plist

file:///System/Library/LaunchDaemons/com.apple.auditd.plist

file:///System/Library/LaunchDaemons/com.apple.autofsd.plist

file:///System/Library/LaunchDaemons/com.apple.automountd.plist

file:///System/Library/LaunchDaemons/com.apple.awacsd.plist

file:///System/Library/LaunchDaemons/com.apple.backupd-attach.plist

file:///System/Library/LaunchDaemons/com.apple.backupd-auto.plist

file:///System/Library/LaunchDaemons/com.apple.backupd-wake.plist

file:///System/Library/LaunchDaemons/com.apple.backupd.plist

file:///System/Library/LaunchDaemons/com.apple.blued.plist

file:///System/Library/LaunchDaemons/com.apple.bootlog.plist

file:///System/Library/LaunchDaemons/com.apple.bsd.dirhelper.plist

file:///System/Library/LaunchDaemons/com.apple.bsd.launchdadd.plist

file:///System/Library/LaunchDaemons/com.apple.configd.plist

file:///System/Library/LaunchDaemons/com.apple.configureLocalKDC.plist

file:///System/Library/LaunchDaemons/com.apple.CoreRAID.plist

file:///System/Library/LaunchDaemons/com.apple.coreservicesd.plist

file:///System/Library/LaunchDaemons/com.apple.cvmsServ.plist

file:///System/Library/LaunchDaemons/com.apple.dashboard.advisory.fetch.plist

file:///System/Library/LaunchDaemons/com.apple.DiagnosticReportCleanUp.plist

file:///System/Library/LaunchDaemons/com.apple.DirectoryServices.plist

file:///System/Library/LaunchDaemons/com.apple.DirectoryServicesLocal.plist

file:///System/Library/LaunchDaemons/com.apple.diskarbitrationd.plist

file:///System/Library/LaunchDaemons/com.apple.diskmanagementd.plist

file:///System/Library/LaunchDaemons/com.apple.distnoted.plist

file:///System/Library/LaunchDaemons/com.apple.dnsextd.plist

file:///System/Library/LaunchDaemons/com.apple.docsetinstalld.plist

file:///System/Library/LaunchDaemons/com.apple.dpd.plist

file:///System/Library/LaunchDaemons/com.apple.DumpPanic.plist

file:///System/Library/LaunchDaemons/com.apple.dvdplayback.setregion.plist

file:///System/Library/LaunchDaemons/com.apple.dynamic_pager.plist

file:///System/Library/LaunchDaemons/com.apple.efax.plist

file:///System/Library/LaunchDaemons/com.apple.eppc.plist

file:///System/Library/LaunchDaemons/com.apple.familycontrols.plist

file:///System/Library/LaunchDaemons/com.apple.FileSyncAgent.sshd.plist

file:///System/Library/LaunchDaemons/com.apple.firmwaresyncd.plist

file:///System/Library/LaunchDaemons/com.apple.fontd.plist

file:///System/Library/LaunchDaemons/com.apple.fontmover.plist

file:///System/Library/LaunchDaemons/com.apple.FontWorker.plist

file:///System/Library/LaunchDaemons/com.apple.fseventsd.plist

file:///System/Library/LaunchDaemons/com.apple.gssd.plist

file:///System/Library/LaunchDaemons/com.apple.hdiejectd.plist

file:///System/Library/LaunchDaemons/com.apple.hidd.plist

file:///System/Library/LaunchDaemons/com.apple.IFCStart.plist

file:///System/Library/LaunchDaemons/com.apple.IIDCAssistant.plist

file:///System/Library/LaunchDaemons/com.apple.installd.plist

file:///System/Library/LaunchDaemons/com.apple.InternetSharing.plist

file:///System/Library/LaunchDaemons/com.apple.kdumpd.plist

file:///System/Library/LaunchDaemons/com.apple.KerberosAutoConfig.plist

file:///System/Library/LaunchDaemons/com.apple.KernelEventAgent.plist

file:///System/Library/LaunchDaemons/com.apple.kextd.plist

file:///System/Library/LaunchDaemons/com.apple.kuncd.plist

file:///System/Library/LaunchDaemons/com.apple.locate.plist

file:///System/Library/LaunchDaemons/com.apple.locationd.plist

file:///System/Library/LaunchDaemons/com.apple.lockd.plist

file:///System/Library/LaunchDaemons/com.apple.loginwindow.plist

file:///System/Library/LaunchDaemons/com.apple.loginwindow.secureerase.plist

file:///System/Library/LaunchDaemons/com.apple.mDNSResponder.plist

file:///System/Library/LaunchDaemons/com.apple.mDNSResponderHelper.plist

file:///System/Library/LaunchDaemons/com.apple.metadata.mds.plist

file:///System/Library/LaunchDaemons/com.apple.netauth.sysagent.plist

file:///System/Library/LaunchDaemons/com.apple.newsyslog.plist

file:///System/Library/LaunchDaemons/com.apple.nfsd.plist

file:///System/Library/LaunchDaemons/com.apple.nis.rpc.yppasswdd.plist

file:///System/Library/LaunchDaemons/com.apple.nis.ypbind.plist

file:///System/Library/LaunchDaemons/com.apple.nis.ypserv.plist

file:///System/Library/LaunchDaemons/com.apple.NotificationServer.plist

file:///System/Library/LaunchDaemons/com.apple.notifyd.plist

file:///System/Library/LaunchDaemons/com.apple.ocspd.plist

file:///System/Library/LaunchDaemons/com.apple.ODSAgent.plist

file:///System/Library/LaunchDaemons/com.apple.pcastagentconfigd.plist

file:///System/Library/LaunchDaemons/com.apple.pcastagentd.plist

file:///System/Library/LaunchDaemons/com.apple.pcastuploader.plist

file:///System/Library/LaunchDaemons/com.apple.PCIELaneConfigTool.plist

file:///System/Library/LaunchDaemons/com.apple.periodic-daily.plist

file:///System/Library/LaunchDaemons/com.apple.periodic-monthly.plist

file:///System/Library/LaunchDaemons/com.apple.periodic-weekly.plist

file:///System/Library/LaunchDaemons/com.apple.platform.ptmd.plist

file:///System/Library/LaunchDaemons/com.apple.portmap.plist

file:///System/Library/LaunchDaemons/com.apple.preferences.timezone.admintool.pl ist

file:///System/Library/LaunchDaemons/com.apple.preferences.timezone.auto.plist

file:///System/Library/LaunchDaemons/com.apple.printtool.plist

file:///System/Library/LaunchDaemons/com.apple.proxyhelper.plist

file:///System/Library/LaunchDaemons/com.apple.racoon.plist

file:///System/Library/LaunchDaemons/com.apple.RemoteDesktop.PrivilegeProxy.plis t

file:///System/Library/LaunchDaemons/com.apple.ReportCrash.Root.plist

file:///System/Library/LaunchDaemons/com.apple.RFBEventHelper.plist

file:///System/Library/LaunchDaemons/com.apple.RFBRegisterMDNS_RemoteManagement. plist

file:///System/Library/LaunchDaemons/com.apple.RFBRegisterMDNS_ScreenSharing.pli st

file:///System/Library/LaunchDaemons/com.apple.sandboxd.plist

file:///System/Library/LaunchDaemons/com.apple.SCHelper.plist

file:///System/Library/LaunchDaemons/com.apple.scsid.plist

file:///System/Library/LaunchDaemons/com.apple.securityd.plist

file:///System/Library/LaunchDaemons/com.apple.securityproxy_mail.plist

file:///System/Library/LaunchDaemons/com.apple.service_helper.plist

file:///System/Library/LaunchDaemons/com.apple.smb.server.preferences.plist

file:///System/Library/LaunchDaemons/com.apple.smb.sharepoints.plist

file:///System/Library/LaunchDaemons/com.apple.smbfs_load_kext.plist

file:///System/Library/LaunchDaemons/com.apple.spindump_symbolicator.plist

file:///System/Library/LaunchDaemons/com.apple.spindump.plist

file:///System/Library/LaunchDaemons/com.apple.stackshot.plist

file:///System/Library/LaunchDaemons/com.apple.statd.notify.plist

file:///System/Library/LaunchDaemons/com.apple.storereceiptinstaller.plist

file:///System/Library/LaunchDaemons/com.apple.suhelperd.plist

file:///System/Library/LaunchDaemons/com.apple.syslogd.plist

file:///System/Library/LaunchDaemons/com.apple.systemkeychain.plist

file:///System/Library/LaunchDaemons/com.apple.systempreferences.installer.plist

file:///System/Library/LaunchDaemons/com.apple.SystemStarter.plist

file:///System/Library/LaunchDaemons/com.apple.taskgated.plist

file:///System/Library/LaunchDaemons/com.apple.TrustEvaluationAgent.system.plist

file:///System/Library/LaunchDaemons/com.apple.usbmuxd.plist

file:///System/Library/LaunchDaemons/com.apple.UserNotificationCenter.plist

file:///System/Library/LaunchDaemons/com.apple.uucp.plist

file:///System/Library/LaunchDaemons/com.apple.var-db-dslocal-backup.plist

file:///System/Library/LaunchDaemons/com.apple.var-db-shadow-backup.plist

file:///System/Library/LaunchDaemons/com.apple.vsdbutil.plist

file:///System/Library/LaunchDaemons/com.apple.warmd.plist

file:///System/Library/LaunchDaemons/com.apple.webdavfs_load_kext.plist

file:///System/Library/LaunchDaemons/com.apple.WindowServer.plist

file:///System/Library/LaunchDaemons/com.apple.xgridagentd.plist

file:///System/Library/LaunchDaemons/com.apple.xgridcontrollerd.plist

file:///System/Library/LaunchDaemons/com.apple.xprotectupdater.plist

file:///System/Library/LaunchDaemons/com.danga.memcached.plist

file:///System/Library/LaunchDaemons/com.vix.cron.plist

file:///System/Library/LaunchDaemons/comsat.plist

file:///System/Library/LaunchDaemons/edu.mit.Kerberos.kadmind.plist

file:///System/Library/LaunchDaemons/edu.mit.Kerberos.krb5kdc.plist

file:///System/Library/LaunchDaemons/exec.plist

file:///System/Library/LaunchDaemons/finger.plist

file:///System/Library/LaunchDaemons/ftp.plist

file:///System/Library/LaunchDaemons/login.plist

file:///System/Library/LaunchDaemons/nmbd.plist

file:///System/Library/LaunchDaemons/ntalk.plist

file:///System/Library/LaunchDaemons/org.amavis.amavisd_cleanup.plist

file:///System/Library/LaunchDaemons/org.amavis.amavisd.plist

file:///System/Library/LaunchDaemons/org.apache.httpd.plist

file:///System/Library/LaunchDaemons/org.cups.cups-lpd.plist

file:///System/Library/LaunchDaemons/org.cups.cupsd.plist

file:///System/Library/LaunchDaemons/org.isc.named.plist

file:///System/Library/LaunchDaemons/org.net-snmp.snmpd.plist

file:///System/Library/LaunchDaemons/org.ntp.ntpd.plist

file:///System/Library/LaunchDaemons/org.postfix.master.plist

file:///System/Library/LaunchDaemons/org.samba.winbindd.plist

file:///System/Library/LaunchDaemons/org.x.privileged_startx.plist

file:///System/Library/LaunchDaemons/shell.plist

file:///System/Library/LaunchDaemons/smbd.plist

file:///System/Library/LaunchDaemons/ssh.plist

file:///System/Library/LaunchDaemons/telnet.plist

file:///System/Library/LaunchDaemons/tftp.plist

Reply

Answer 8

Linc Davis

Level 10

209,739 points

Jun 15, 2011 4:19 PM in response to Svenne88

Those look OK. What do you get from

ps -ax | grep [f]ind

Reply

Answer 9

Svenne88 Author

Level 1

0 points

Jun 16, 2011 12:49 AM in response to Linc Davis

I'll try that when i get home. I use a pref pane called sneakpeek Pro, i use to create previews for EPS files in finder. It just Got an Update a week ago. I have a large collection of EPS files. Maybe sneakpeek is causing the trouble?

Reply

Answer 10

Svenne88 Author

Level 1

0 points

Jun 16, 2011 7:42 AM in response to Linc Davis

ps -ax | grep [f]ind in terminal returns:

280 ?? 0:06.89 find . -type d

Reply

Answer 11

Linc Davis

Level 10

209,739 points

Jun 16, 2011 7:58 AM in response to Svenne88

That means some script is finding all subdirectories of a working directory. None of the system scripts does that.

Please post the output of this command:

sudo launchctl list | grep -v 'apple\|mdworker'

Reply

Answer 12

Svenne88 Author

Level 1

0 points

Jun 16, 2011 8:10 AM in response to Linc Davis

Here we go (this is chinese for me):

1 - 0x1005003f0.anonymous.launchd

23 - 0x100500950.anonymous.mds

565 - 0x10041d850.anonymous.Terminal

567 - 0x10041d590.anonymous.login

568 - 0x10041d2d0.anonymous.bash

571 - 0x1004064e0.anonymous.launchctl

139 - 0x10041ce10.anonymous.M-Audio Firmware

1 - 0x100100c40.anonymous.launchd

142 - 0x100100980.anonymous.Nalpeirond6

135 - 0x100600e20.anonymous.prl_disp_service

123 - com.parallels.vm.prl_naptd

- 0 org.x.privileged_startx

- 0 org.postfix.master

12 - org.ntp.ntpd

573 - org.cups.cupsd

- 0 edu.mit.Kerberos.krb5kdc

- 0 edu.mit.Kerberos.kadmind

- 0 com.vix.cron

43 - com.waves.daemon.SoundGridProtocolService

- 0 com.sibelius.sari

44 - com.parallels.desktop.launchdaemon

45 - com.ONEDaemon.plist

- 0 com.microsoft.office.licensing.helper

- 0 com.google.keystone.daemon

46 - at.obdev.littlesnitchd

- 0 0x1006002d0.mach_init.dashboardadvisoryd

Reply

Answer 13

Linc Davis

Level 10

209,739 points

Jun 16, 2011 8:49 AM in response to Svenne88

You have some weird stuff running as root there.

M-Audio Firmware? Why does that need a root daemon?

Nalpeiron is a DRM rootkit that's entirely hostile to your interests.

Parallels -- OK, if you must.

SoundGrid: not sure what that is.

Sibelius "sari," presumably another DRM rootkit.

ONEDaemon: I don't know what that is, probably yet another DRM rootkit.

Microsoft "licensing helper," another DRM rootkit.

Keystone, outrageous Google spyware as far as I'm concerned.

If you want to be a doormat for all these arrogant software developers, then you have to take what they dish out. Probably one or another of these things is constantly checking to make sure you haven't installed an unlicensed copy of a commercial product. Who cares what it does to your system performance? That's not the developer's problem.

Reply