Temporary NFS mount keep being mounted while server is powered off

Problem is still there... 😟

Here is the night now, so I will remove FileVault and try to safe boot tomorrow.

As for crashplan, yes I had restarted and check it was not there anymore.

Hi Linc, thanks again for your support!

So I have removed FileVault, I have removed again crashplan and even CloudStation. They are both properly removed, I have followed the online instructions for the uninstall and there is nothing left (CrashPlan keeps a config file in the user directory which help re-setup the tool upon reinstallation).

I have rebooted in safe mode as you instructed (shutdown, wait 30s, boot in safe mode using Shift, and then login without loading extra program by pressing Shift) and I did NOT get the message!

I have opened a terminal though and checked the running processes, the NetAuthSysAgent was running but was not trying to call any NFS mount. I have waited several minutes just in case but no message and no mount_nfs process.

So I guess NetAuthSysAgent is instructed by another process to mount the NFS share, it is perhaps the parent but not the one who initiate the request.

I rebooted in normal mode, but upon login I used the Shift trick too. So none of the usual extra process (like Dropbox got loaded), but I did get the popup message!

I have repeated all 5 steps you mentionned also previsouly (I forgot to do that in safe mode). Synology is nowhere to be found, however CrashPlan is still found in the login items (step 5), although I don't think it is a culprit as when I logged in in normal mode using th Shift trick, it should not have been loaded but I did get the message.

I did a lot of clean-up, removed thoroughly any third party application I did not need or that are easy to reinstall. By thorough I mean I follow uninstall instructions and I investigate all Library folders for any trace of remnant data which I deleted (particularly under Application Support, Preferences, Caches, LaunchDaemons, LaunchAgents).

When I was in safe mode I saved the ouput of 'ps -aef'. I did so in normal mode too after the above clean-up.

You can find this gist where I have put a filtered and sorted alphabetically output for easier comparison: https://gist.github.com/jcberthon/4966338

There are a few extra processes in normal mode, but nothing fancy...

NO more popup! Thank you so much Linc for your patience and guidance! It helped me a lot. 🙂

You told me to try safe mode, and I was not bother anymore by the popup, so a third-party application was bugging I deinstalled the following applications thoroughly (like mentionned in my previous message):

• CrashPlan
• Dropbox
• Cyberduck
• FileZilla
• KeePass2.18
• Skype
• TrueCrypt

I have found traces remaining of Plex Media Server which I manually deleted.

Since then no more popup. Now I have no clue which of the app was the culprit.

But I will reinstall those I need one by one (with a reboot after each) just to see if any I need were the culprit.

Now issueing 'ps -aef | egrep -i "NetAuth|mount"' does not yeld anything, whereas before I had always at least the NetAuthSysAgent!

I am not sure how to REMOVE the accepted answer because the problem is not solve 😠

I thought it was, but then I reinstalled CrashPlan, reconfigured it. It was working, the NetAuth*Agent were nowhere to be seen, everything was alright. After awhile of seeing CrashPlan synchronised and working, I restarted the Mac to see if it was not restarting new process.

All was fine, 'sudo ps -aef | egrep -i "NetAuth|mount"' returned nothing. I waited several minutes and checked again, all was correct.

So I installed Dropbox. As soon as it was installed - but I cannot tell if it was mere coincidence - I got the infamous popup again! And the NetAuth*Agent processes were back!

So I thouroughly uninstalled Dropbox, like I did before. Rebooted, but was still greated by the popup! The NetAuth*Agent were there too! However, I got the popup once when I login and then it does not seem to come back and after awhile (during the same session) the NetAuth*Agent processes vanish too.

Then I again thoroughly uninstall CrashPlan, rebooted but I still have the popup and the NetAuth*Agent processses. They do disappear after awhile and are not as persistent as when I first opened this thread.

So was I lucky before after my first complete and thorough clean-up? I don't know. The behaviour is rather non predictable and not easily reproducible. But that's already 4 reboots I am doing since the last step, and each time I had this popup.

Knowing the NetAuth*Agent configuration files, architecture, API would really help at cornering the problem. Apple, where is the documentation or man page? The only reference to those are in the tmdiagnose manual page. That is a bit scarse 😉

I am sorry it was confusing, but it reflects exactly my state of mind regarding this problem.

I am not a non-techy guy, not at all, I was compiling my own Linux kernel in the mid of the 90's to be able to have my mouse and video card working on Kheops Linux. My job is to engineer and develop software, mostly on Unix and Linux platforms. I know pretty well those OS, did some system programming and administration even, read man pages or header/source files (aka .h or .c) to understand an API. I usually know what I am doing. But here, I get confused.

My best guess is that these NetAuth*Agent services get triggered on demand by other applications or services. Since I completely removed Dropbox and CrashPlan, I am still greated upon boot/login by the infamous popup, usually it appears twice and then it is gone, also the NetAuth*Agent services disappear after some time. But periodically during my use of the Mac, the popup is triggered again, when this happen, often TimeMachine is running (not always but usually).

My wild guess is: those NetAuth*Agent services are triggered on demand by various applications, I suspect TimeMachine, CrashPlan and maybe DropBox, at least could also be SpotLight, although its activity is more difficult to track.

Maybe none of these applications are actually explicitely calling for these services, but they are calling File System specific monitoring feature that indirectly trigger the services.

Then I don't exactly know, but either they are state-less and another process is monitoring those services to request the NFS mount, or those services are stateful and they got once requested to mount the NFS share and stubbornly keep on trying to mount it.

This is pure speculation, but this is the only logical explanation I can find that could support the irrational behaviour with which this popup seems to be triggered!

As you advised, I am going to "cross-post" my problem to the CrashPlan and DropBox teams, but I am not convinced they are the culprit, rather an indirect and innocent trigger of a misconfiguration somewhere else.

I restarted my VM and waited ... boom ... the NFS share was automagically mounted as /Volumes/test.

I then run 'lsof' which is a handy Unix/Linux tool that tell you which process is actually having opened file descriptor on a particular path. And the result is:

!! mds is SpotLight, so is it the culprit? I am not sure as:

$ mdutil -sav

/:

Indexing enabled.

/.MobileBackups:

No index.

/Volumes/test:

Indexing and searching disabled.

This morning I started the Mac, I got once after login the popup. Then for 1h30 no popup. Then it appeared, I closed it, 2 minutes later it was there again, I check the status of TimeMachine, it is running... 2 minutes later I get the popup, again and again. Then it is quiet, no more popup, TimeMachine has finished working in the background.

As said, I don't know if TimeMachine is directly the one requesting the NFS share to be mounted or just triggering another service which does that as soon as it is alive because it was instructed so by another process. But the popup appearance is at least related with TimeMachine activities!

Hello Linc,

As said the popup appearance, or more technically the triggering of the NFS mount activity is related to some of TimeMachine activities, probably indirectly but still there is a strong timing correlation between TimeMachine activities and NFS mount activities. But I understand that disabling TimeMachine won't solve my problem, because other processes which I haven't identified yet trigger the same service stack which end up calling the NFS mount.

I tried to get deeper to what is really happening. I've used DTrace for that purpose. A first simple command displaying all file that are opened and by which process did not hint much, but I have found out that before a series of mount_nfs starts, there was a file opened by NetAuthSysAgent /Volumes/test/.autodiskmounted

I did further profiling of NetAuthSysAgent which anyway was already pointed out by "ps -aef" as the parent process of the mount_nfs. The result is the following: https://gist.github.com/jcberthon/93413bee23fbb83698c3

You can find the "interesting part" below with some highlighted terms which shows related actions.

(...)

(...)

(...)

One can see that once Time Machine is kicked-in it obviously instruct NetAuthSysAgent to mount the TimeMachine backup volume (see at the beginning the mounting of /Volumes/timemachine). This is maybe not a direct call, it could be automounted because TM tries to access a particular location. But there is a causality relation anyway.

Then several seconds (I forgot to trace the time sorry) after NetAuthSysAgent automount the /Volumes/test which is the NFS share, it forks a new process for the NFS mount (My guess is the posix_spawn call or the open_nocancel call of the nfs.bundle).

I am still far away to find the real root of the problem, but if anyone with DTrace or NetAuthSysAgent knowledge could help me out to see how the latter is instructed to automount the NFS share, I would be extremely greatful!