Temporary NFS mount keep being mounted while server is powered off

Thank you Linc. My problem is that I have rebooted already twice my Mac, but it keep on trying to mount the NFS share!

I am just trying to figure out where is setup this permanent mount or which process performs and maintains the mount.

I did it manually so I could try several mount options, like NFSv4, tcp or udp, etc. Options which are not available from the Finder. Although they might via autofs, but I don't know that beast yet.

I am pretty savvy when it comes to Linux/Unix, so I would also not expect 'mount' to do anything permanent. So I am quite as puzzled as you are.

But still every time I reboot, I get the error dialog box.

I have recreated a VM with the same IP and the same export path for NFS. OS X mounts it then automatically as /Volumes/test. If I unmount it and restart, it is again mounted!!!

I did clean the Recent Items menu in the "Apple" menu and in the "Connect to server..." menu, to no help. I also rebooted OS X explicitely telling it not to reopen applications (this kind of pseudo-resume integrated since OS X Lion), but I still have the problem.

Sadly I have FileVault 2 activated which will prevent me for doing both tests.

It is going to take some time to disable FileVault I guess, so I won't be able to do it right now. However, I can create a standard new account and use that instead of the guest one (for Step 1). At least this would hint us if it is my "profile" which has this specially continuously stubborn automount feature. ;-)

So I have found out that it is not an account problem, I get it on other accounts too. The problem is related to the NetAuthSysAgent process (see below)

Furthermore, I have started my VM again, waited for OS X to mount it auto-stubbornly-magically and boom(tm) it was there mounted.

I issued the umount command and it was gone. Then I did nothing (but prevented the Mac to go to sleep) for a while. I checked again if the mount was there, and boom! It was there again auto-stubbornly-magically without any user interactions! Just for fun you can see the terminal output at the end of this message, time is not visible there but all applications where closed during that time and I waited about 5 min before doing the last df command.

When I saw that I had a strong suspicion that there is a process actively trying to mount it in the background. I typed another command in the terminal and I found an obvious culprit:

mbp:~ huygens$ ps -aef

UID PID PPID C STIME TTY TIME CMD

0 1 0 0 9:55AM ?? 0:00.34 /sbin/launchd

(…)

1 0 9:55AM ?? 0:00.09 /System/Library/CoreServices/NetAuthAgent.app/Contents/MacOS/NetAuthSysAgent --sys

(…)

0 483 96 0 9:57AM ?? 0:00.00 mount_nfs -onobrowse 192.168.1.250:/mnt/test /Volumes/test

So there is a process (mount_nfs PID 483) who is trying to mount the NFS export. This process is called by NetAuthSysAgent (PID 96) which is itself launched by the "init" process. My concern is that I have found no resource how to configure this service so that it will drop trying to mount the NFS share!

Any help is appreciated.

Terminal output, one can see that the test NFS export is mounted. I unmount it and one can see that it is not mounted anymore. After a while I check again and there it is back mounted!

mbp:~ huygens$ df

Filesystem 512-blocks Used Available Capacity iused ifree %iused Mounted on

/dev/disk1 974770480 492244672 482013808 51% 61594582 60251726 51% /

devfs 377 377 0 100% 652 0 100% /dev

map -hosts 0 0 0 100% 0 0 100% /net

map auto_home 0 0 0 100% 0 0 100% /home

localhost:/WMQa50uhmYBFmxPvp1z0ZJ 974770480 974770480 0 100% 0 0 100% /Volumes/MobileBackups

192.168.1.250:/mnt/test 5747242952 7843944 5739399008 1% 2154 5739399008 0% /Volumes/test

mbp:~ huygens$ sudo umount /Volumes/test

Password:

mbp:~ huygens$ df

Filesystem 512-blocks Used Available Capacity iused ifree %iused Mounted on

/dev/disk1 974770480 492251040 482007440 51% 61595378 60250930 51% /

devfs 372 372 0 100% 646 0 100% /dev

map -hosts 0 0 0 100% 0 0 100% /net

map auto_home 0 0 0 100% 0 0 100% /home

localhost:/WMQa50uhmYBFmxPvp1z0ZJ 974770480 974770480 0 100% 0 0 100% /Volumes/MobileBackups

mbp:~ huygens$ df

Filesystem 512-blocks Used Available Capacity iused ifree %iused Mounted on

/dev/disk1 974770480 490782360 483476120 51% 61411793 60434515 50% /

devfs 371 371 0 100% 644 0 100% /dev

map -hosts 0 0 0 100% 0 0 100% /net

map auto_home 0 0 0 100% 0 0 100% /home

192.168.1.250:/mnt/test 5747242952 7843944 5739399008 1% 2154 5739399008 0% /Volumes/test

Some more hint for the knowledgable ones out there.

It seems that this NetAuthSysAgent is launched upon the connection of one user. So if I start the machine and connect with user alpha and do 'ps -aef' I get a PID of 96 (as an example) then if I logout and login as beta I get a pid of 452.

So it seems to be a process which is launch upon login for all users. If anyone could confirm that?

The content of auto_master is:

+auto_master # Use directory service
/net -hosts -nobrowse,hidefromfinder,nosuid
/home auto_home -nobrowse,hidefromfinder
/Network/Servers -fstab
/- -static

The file was modified before the I bought the Mac (bought new!):

$ stat -x /etc/auto_master

File: "/etc/auto_master"

Size: 194 FileType: Regular File

Mode: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ wheel)

Device: 1,4 Inode: 279356 Links: 1

Access: Thu Feb 14 16:11:10 2013

Modify: Sun Jul 22 04:24:55 2012

Change: Sun Jul 22 04:24:55 2012

The dscl command return nothing (empty) either as my user or by calling it using sudo.

I am not part of a domain, it is my home laptop and I have simple local accounts.

The virtualisation software is on another machine, not on the Mac where I have this annoying popup. So it won't change a thing.

I am really wondering where to look for documentation on this service NetAuthAgent. Is it related in a way to TimeMachine? I just got a hunch that perhaps TM saw the mount and has been trying to back it up once, perhaps now it is the culprit trying to mount it again to see if any change happened to back them up...

Anyway thank you Linc for your help, thanks to you I think I managed to find the culprit behind the popup, my last step would be to create a small daemon that track and kill this service, or better to tune that service so that it stops mounting the NFS export.

I have done the following:

• Disable TimeMachine and removed its configuration;
• Unistall CrashPlan (another backup software);
• Disable SpotLight on all volumes and removed its cache.

After that and a reboot I was greated by the infamous popup. So no help there...

I did a major grep on all existing files (and made the Core i7 and SDD sweat hard!):

sudo find / -type f -print0 | sudo xargs -0 -n 32 -P 8 egrep "test|192\.168\.1\.250" 2>/dev/null

The only files that got reported are:

• Logs: /private/var/log/system.log, /private/var/log/asl/2013.02.09.G80.asl (several of those with different dates)
• Data: /private/var/db/statd.status

That's it!

So now I am investigating the thread regarding rpc.statd and the cohort of OS X NFS services/daemons.

Step1:

No output.

Step2:

org.macosforge.xquartz.privileged_startx

com.oracle.java.Helper-Tool

com.google.keystone.daemon

com.crashplan.engine

com.bresink.system.securityagent3

com.adobe.fpsaud

Note: I have already uninstalled CrashPlan to see if ti was a culprit, but as it wasn't I reinstall it (backup is important ;-) )

Step3:

org.macosforge.xquartz.startx

com.oracle.java.Java-Updater

com.google.keystone.system.agent

com.synology.Synology

com.plexapp.helper

com.google.GoogleContactSyncAgent

Note: I have a Synology NAS and I have installed CloudStation (a Dropbox like app)

Step4:

/Library/Components:

/Library/Extensions:

/Library/Frameworks:

AEProfiling.framework

AERegistration.framework

Adobe AIR.framework

AudioMixEngine.framework

MacFUSE.framework

Mono.framework

NyxAudioAnalysis.framework

OSXFUSE.framework

PluginManager.framework

iTunesLibrary.framework

/Library/Input Methods:

/Library/Internet Plug-Ins:

Flash Player.plugin

GarminGpsControl.plugin

JavaAppletPlugin.plugin

OfficeLiveBrowserPlugin.plugin

Quartz Composer.webplugin

QuickTime Plugin.plugin

Silverlight.plugin

flashplayer.xpt

nsIQTScriptablePlugin.xpt

/Library/Keyboard Layouts:

/Library/LaunchAgents:

com.google.keystone.agent.plist

com.oracle.java.Java-Updater.plist

org.macosforge.xquartz.startx.plist

/Library/LaunchDaemons:

com.adobe.fpsaud.plist

com.bresink.system.securityagent3.plist

com.crashplan.engine.plist

com.google.keystone.daemon.plist

com.oracle.java.Helper-Tool.plist

org.macosforge.xquartz.privileged_startx.plist

/Library/PreferencePanes:

Flash Player.prefPane

JavaControlPanel.prefPane

/Library/PrivilegedHelperTools:

com.bresink.system.securityagent3

/Library/QuickLook:

iBooksAuthor.qlgenerator

iWork.qlgenerator

/Library/QuickTime:

AppleIntermediateCodec.component

AppleMPEG2Codec.component

/Library/ScriptingAdditions:

SynoSIMBL.osax

/Library/Spotlight:

Microsoft Office.mdimporter

iBooksAuthor.mdimporter

iWork.mdimporter

/Library/StartupItems:

/etc/mach_init.d:

/etc/mach_init_per_login_session.d:

/etc/mach_init_per_user.d:

Library/Address Book Plug-Ins:

SkypeABDialer.bundle

SkypeABSMS.bundle

Library/Fonts:

Library/Input Methods:

.localized

Library/Internet Plug-Ins:

Library/Keyboard Layouts:

Library/LaunchAgents:

com.apple.AddressBook.ScheduledSync.PHXCardDAVSource.F4A55E9F-72F0-414C-9D3A-1E0 DA576A669.plist

com.google.GoogleContactSyncAgent.plist

com.plexapp.helper.plist

com.synology.CloudStation.plist

Library/PreferencePanes:

That was all.

Step5:

iTunesHelper, Dropbox, CrashPlan menu bar

Thank you very much for your deep help and for your time! I hope anything in this output might help you.