6 Replies Latest reply: May 6, 2012 5:06 AM by cj00
Wolf Harper Level 1 (40 points)

I have 4 external drives with about 12 volumes on them and it's literally spinning up a drive every 5 minutes, 24x7 when I am not even using the computer. Nothing weird is running, and it's clear the application is exactly Finder. (and rarely, fseventsd).  Here is the output of

sudo fs_usage -f filesys | grep Volumes 



01:00:55  getattrlist   /Volumes/Uber                                                                0.000012   Finder 
01:00:55  getattrlist   /Volumes/Uber                                                                0.000024   Finder 
01:02:21  getattrlist   /Volumes/Big                                                                 0.000013   Finder 
01:13:04  getattrlist   /Volumes/Giant                                                               0.000014   Finder 
01:13:15  getattrlist   /Volumes/Giant                                                               0.000013   Finder 
01:17:21  getattrlist   /Volumes/Big                                                                 0.000012   Finder 
01:17:30  getattrlist   /Volumes/Big                                                                 0.000013   Finder 
01:32:21  getattrlist   /Volumes/Big                                                                 0.000016   Finder 
01:32:30  getattrlist   /Volumes/Big                                                                 0.000011   Finder 
01:47:21  getattrlist   /Volumes/Big                                                                 0.000072   Finder 
01:47:30  getattrlist   /Volumes/Big                                                                 0.000014   Finder 
01:54:37  getattrlist   /Volumes/6snow                                                               0.000012   Finder 
01:54:49  getattrlist   /Volumes/6snow                                                               0.000014   Finder 
01:56:56  getattrlist   /Volumes/4tiger                                                              0.000012   Finder 
01:56:57  getattrlist   /Volumes/4tiger                                                              0.000023   Finder 
01:57:14  getattrlist   /Volumes/Medium                                                              0.000014   Finder 
01:57:23  getattrlist   /Volumes/Medium                                                              0.000013   Finder 
01:57:49  getattrlist   /Volumes/Small                                                               0.000016   Finder 
01:57:50  getattrlist   /Volumes/Small                                                               0.000024   Finder 
01:58:32  getattrlist   /Volumes/Little                                                              0.000012   Finder 
01:58:32  getattrlist   /Volumes/Little                                                              0.000021   Finder 
01:59:17  statfs        /Volumes/BACKUPUSB                                                           0.000009   Finder 
01:59:18  statfs        /Volumes/BACKUPUSB                                                           0.000008   Finder 
02:00:10  getattrlist   /Volumes/BABY                                                                0.000014   Finder 
02:00:21  getattrlist   /Volumes/BABY                                                                0.000015   Finder 
02:00:55  getattrlist   /Volumes/Uber                                                                0.000019   Finder 
02:02:21  getattrlist   /Volumes/Big                                                                 0.000015   Finder 
02:10:01  getattrlist   /Volumes/Medium                                                              0.000022   Finder 
02:10:01  getattrlist   /Volumes/Uber                                                                0.000010   Finder 
02:10:01  statfs        /Volumes/BACKUPUSB                                                           0.000009   Finder 
02:10:01  getattrlist   /Volumes/BABY                                                                0.000013   Finder 
02:10:07  statfs        /Volumes/BACKUPUSB                                                           0.000010   Finder 
02:10:11  getattrlist   /Volumes/Medium                                                              0.000023   Finder 
02:10:11  getattrlist   /Volumes/Little                                                              0.000025   Finder 
02:10:11  getattrlist   /Volumes/Small                                                               0.000012   Finder 
02:10:12  getattrlist   /Volumes/Giant                                                               0.000015   Preview
02:10:12  getattrlist   /Volumes/BABY                                                                0.000010   Preview
02:10:12  getattrlist   /Volumes/Uber                                                                0.000009   Preview
02:10:12  getattrlist   /Volumes/Big                                                                 0.000009   Preview
02:10:12  getattrlist   /Volumes/U3 System                                                           0.000009   Preview
02:10:12  getattrlist   /Volumes/Medium                                                              0.000011   Preview
02:10:12  getattrlist   /Volumes/4tiger                                                              0.000010   Preview
02:10:12  getattrlist   /Volumes/Little                                                              0.000009   Preview
02:10:12  getattrlist   /Volumes/Small                                                               0.000009   Preview
02:10:12  getattrlist   /Volumes/6snow                                                               0.000009   Preview
02:10:12  getattrlist   /Volumes/BACKUPUSB                                                           0.000008   Preview


Note the 02:10:12 "all drives spin up" event.  That was opening a PDF in Preview.  The PDF was in my home directory/Downloads on "Macintosh HD".  The rest is entirely Finder; I was doing nothing at all. 


I'm hearing a spool-up literally every 4-5 minutes.


I have essentially given up, and dismounted all the drives until I have need for something on one of them.  Of course that kills Time Machine.


Since there is no rime or reason for these accesses, I am NOT impressed with the argument that "drives should spin 24x7, it's better for them".  This is a home system, not a server.  I know how often I actually need data off these drives - several times a day and many days not at all.  So I should use a program to force them to spin 24x7 (by doing more unnecessary accesses)?  That's like leaving a hot water faucet open 24x7 to deal with a glitch in an on-demand water heater.


I want the drives to spin down.  And stay spun down.  And then, when I choose to access something on one of the drives, or an application has something it's going to actually use the drive for (e.g. midnight backups) -- I want it to spin up. Simple enough?


I am running 10.5 but my searches tell me Snow Leopard is worse, and Lion is worse yet.

iMac, Mac OS X (10.5.8)
  • BDAqua Level 10 (122,202 points)

    Hmmm, I'm wondering if Finder has any windows open to these drives, and/or if Spotight, Bonjour, etc. aren't triggering Finder on these drives?

  • Wolf Harper Level 1 (40 points)

    Good point, just checked, and the answer is no.  I had 3 Finder windows open, all viewing the main hard drive.

    They did, of course, have the hard drive icons along the left edge.

    Edit (from here):

    But I wasn't doing anything with Finder during these times.


    This activity occurred when I was not using the computer at all.


    04:00:41  getattrlist   /Volumes/Uber                                                                0.000009   ScreenSaverE
    04:00:41  getattrlist   /Volumes/Uber                                                                0.000022   ScreenSaverE
    04:02:10  getattrlist   /Volumes/Uber                                                                0.000015   Finder 
    04:02:22  getattrlist   /Volumes/Uber                                                                0.000019   Finder 
    04:59:17  statfs        /Volumes/BACKUPUSB                                                           0.000011   Finder 
    04:59:18  statfs        /Volumes/BACKUPUSB                                                           0.000005   Finder 
    05:02:10  getattrlist   /Volumes/Uber                                                                0.000013   Finder 
    05:02:21  getattrlist   /Volumes/Uber                                                                0.000016   Finder 
    05:59:17  statfs        /Volumes/BACKUPUSB                                                           0.000014   Finder 
    06:02:10  getattrlist   /Volumes/Uber                                                                0.000013   Finder 
    06:02:21  getattrlist   /Volumes/Uber                                                                0.000021   Finder 
    06:59:17  statfs        /Volumes/BACKUPUSB                                                           0.000006   Finder 
    06:59:18  statfs        /Volumes/BACKUPUSB                                                           0.000006   Finder 
  • BDAqua Level 10 (122,202 points)

    Hmmm, I have a hard time figuring out what Finder would be doing by itself on those drives without help.


    Are you confident that command reports all file accesses? I'm wondering because a few OSes ago Apple started addressing everything as network items it seems under the hood.


    Do you have any Sharing enabled?


    Any Aliases to those items on the boot drive?

  • Wolf Harper Level 1 (40 points)

    that makes two of us.  No sharing enabled, no aliaes to those items.


    I cannot say that command reports every single activity, but its raw volume is staggering, hence the grep.

  • BDAqua Level 10 (122,202 points)

    Are any of these green drives? What brand of Cases are they? What Drive models?

  • cj00 Level 1 (10 points)

    Even with:

    1. Finder closed (user log out)
    2. Converting HFS to a non journaled HFS volumes (diskutil unmount External;sudo diskutil disableJournal force /dev/disk4s1)
    3. Excluding these mount points from Time Machine backup (sudo tmutil addexclusion /Volumes/External)
    4. Do not show this drives in finder sidebars
    5. Remounting them manually to a non default mount point (/vol instead of /Volumes),
      note: this seems to stop hourly access by process named serveradmin
    6. Having /etc/fstab mount options "rw,noauto,noexec,nodev,noatime,nobrowse" set
    7. Excluding the mount point from Spotlight indexing (sudo mdutil -i off /vol/External;sudo mdutil -E /vol/External)
    8. Stopping Time Machine disk detecting permanently with Terminal command "sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.backupd-attach.plist"
    9. Setting an ACL to prohibits _spotlight user from read access (sudo chmod -v +a "user:_spotlight deny read,readattr,list,search,readsecurity,file_inherit,directory_inherit" /vol)
    drwxrwxrwt@  3 root  admin   102 May  6 00:22 vol

    0: user:_spotlight deny list,search,readattr,readsecurity,file_inherit,directory_inherit

    1: group:everyone deny add_file,add_subdirectory,directory_inherit,only_inherit

    2: user:_spotlight inherited deny list,search,readattr


    does not stop the backupd-help (backupd-helper), backup, neither mdworker from getattrlist disk access (thus spinning up the drives) every 30 till 60 minutes in OS X Lion 10.7.3