Sudden Marked increase in data transfer, kernel task using 3 GB in 3 hrs.

Question

Level 1

40 points

Sudden Marked increase in data transfer, kernel task using 3 GB in 3 hrs.

A month ago my data usage, as recorded by Excede, jumped from less than 7 GB/mo to 25 GB/mo. I reach my data cap long before the month is out. Excede has no idea why but says over half my usage is video or audio such as Skype. I use neither. I haven't changed anything in my use patterns. Today I looked at my Activity Monitor and it says a kernel task has used 3.06 GB. I don't know the time frame but I opened the monitor 4 hours ago.

What is a kernel task and can it use that much data over the internet?

What else could cause a sudden and dramatic increase in data use?

Is there a problem with Excede's data recording? The Excede user's forum suggests there is; or at least there are a lot of angry users there.

Is there a program that will tell me specifically how much data I'm using in all possible processes and lead me to the process so I can see what is happening?

Thanks

Geoff

iMac, OS X Mavericks (10.9.2)

Posted on Jul 24, 2015 11:59 AM

Reply

Answer 1

Best reply

BobHarris

Level 9

53,051 points

Jul 24, 2015 1:08 PM in response to Geoff K

Please post the EtreCheck output

<https://discussions.apple.com/docs/DOC-6174>

It is possible you have adware on your Mac, which is doing something like clicking on links in the background to get high click counts on their web sites so advertisers will pay them more.

The side effect is that you use a lot of data that you do not know is happening.

You might also monitor your network activity in Applications -> Utilities -> Activity Monitor -> Network.

You could try running AdwareMedic

<http://www.adwaremedic.com/index.php>

written by a long time forum contributer Thomas_r

NOTE: There was a recent report that there are a iOS and Android apps that do the same thing in the background. So if you have smart phones, it is possible they are contributing to your data usage as well.

The kernel_task "Is" the heart of OS X. Plus any 3rd party kernel extensions become part of the kernel_task, so 3rd parties frequently affect how much memory the kernel_task uses. The kernel_task typically uses memory proportional to how much RAM you have installed. 4GB under 500MB. 8GB 6-800GB. 16GB hovering around 1GB.

EtreCheck output will show the 3rd party additions, including kernel extensions.

Reply

Answer 2

Drew Reece

Level 6

10,660 points

Jul 24, 2015 1:46 PM in response to Geoff K

What tab are you viewing in Activity Monitor?

The RAM usage is not related to the network activity. The network tab will include local traffic too, so you may think the largest process is the cause when others may be the reason.

When you are browsing do you have many windows open? Some ad networks use auto playing video that gets pre-loaded. If you have many tabs open they can simply sit there loading new videos that are no use to you. Audio may also cover Apple Music (or radio) - do you use that?

Reply

Answer 3

Geoff K Author

Level 1

40 points

Jul 24, 2015 7:48 PM in response to BobHarris

Bob, I ran the EtreCheck thing. I don't see anything strange, but I don't know what to look for. All the entries had names I recognize except com.prolific.driver. That one is shown as [not loaded]. I can't find an attachment click so I can't send the report along.

I've been watching my Activity Monitor today. It showed 3+GB received in about 3 hours this morning. It was attributed to the kernel task. Since then it has been in the Megabyte range.

I ran AdWareMedic (now called Malwarebytes Ante Malware for Mac) and it didn't find anything.

I've been trying different things and searching here and there for the past 2 hours. Now I'm pooped and my old brain isn't functional. Drew, I'm not ignoring your post; will be back tomorrow for more.

Thanks much, Bob and Drew, for your help.

Reply

Answer 4

BobHarris

Level 9

53,051 points

Jul 24, 2015 8:05 PM in response to Geoff K

Please copy and paste the EtreCheck results as a reply to this thread, and someone will look at it.

Chances are you have a 3rd party addition (maybe even a kernel extension) that is causing your problems.

Reply

Answer 5

Geoff K Author

Level 1

40 points

Jul 25, 2015 6:46 AM in response to BobHarris

Here's the copy of EtreCheck.

Problem description:

Sudden marked increase in data use. Previous high was 7GB/mo. Now I'm running past my cap of 20 GB in 20 days. According to Activity Monitor I received 5GB just today. No change in my use habits. No new programs. (that I'm aware of) I'm not a power user; completely baffled.

EtreCheck version: 2.2 (132)

Report generated 7/24/15, 9:04 PM

Download EtreCheck from http://etresoft.com/etrecheck

Click the [Click for support] links for help with non-Apple products.

Click the [Click for details] links for more information about that line.

Hardware Information: ℹ️

iMac (21.5-inch, Late 2009) (Technical Specifications)

iMac - model: iMac10,1

1 3.06 GHz Intel Core 2 Duo CPU: 2-core

4 GB RAM Upgradeable

BANK 0/DIMM0

Empty

BANK 1/DIMM0

Empty

BANK 0/DIMM1

2 GB DDR3 1067 MHz ok

BANK 1/DIMM1

2 GB DDR3 1067 MHz ok

Bluetooth: Old - Handoff/Airdrop2 not supported

Wireless: en1: 802.11 a/b/g/n

Video Information: ℹ️

NVIDIA GeForce 9400 - VRAM: 256 MB

iMac 1920 x 1080

System Software: ℹ️

OS X 10.9.5 (13F1096) - Time since boot: 13:5:0

Disk Information: ℹ️

ST3500418ASQ disk0 : (500.11 GB)

EFI (disk0s1) <not mounted> : 210 MB

Macintosh HD (disk0s2) / : 499.25 GB (361.26 GB free)

Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB

OPTIARC DVD RW AD-5680H

USB Information: ℹ️

Apple Inc. Built-in iSight

Apple Internal Memory Card Reader

Apple Computer, Inc. IR Receiver

Kensington Kensington 2.4G Laser Product

Apple Inc. BRCM2046 Hub

Apple Inc. Bluetooth USB Host Controller

Gatekeeper: ℹ️

Mac App Store and identified developers

Kernel Extensions: ℹ️

/Library/Extensions

[loaded] com.logitech.manager.kernel.driver (4.10.1 - SDK 10.8) [Click for support]

/System/Library/Extensions

[not loaded] com.prolific.driver.PL2303 (2.0.0) [Click for support]

Launch Agents: ℹ️

[running] com.intego.commonservices.integomenu.plist [Click for support]

[loaded] com.intego.commonservices.taskmanager.plist [Click for support]

[loaded] com.intego.commonservices.uninstaller.plist [Click for support]

[loaded] com.intego.netbarrier.alert.plist [Click for support]

[running] com.intego.netupdate.agent.plist [Click for support]

[loaded] com.intego.virusbarrier.alert.plist [Click for support]

[running] com.logitech.manager.daemon.plist [Click for support]

[loaded] com.oracle.java.Java-Updater.plist [Click for support]

[running] net.culater.SIMBL.Agent.plist [Click for support]

Launch Daemons: ℹ️

[loaded] com.adobe.fpsaud.plist [Click for support]

[loaded] com.barebones.authd.plist [Click for support]

[loaded] com.bombich.ccc.plist [Click for support]

[loaded] com.bombich.ccchelper.plist [Click for support]

[running] com.intego.commonservices.daemon.integod.plist [Click for support]

[running] com.intego.commonservices.daemon.taskmanager.plist [Click for support]

[loaded] com.intego.commonservices.icalserver.plist [Click for support]

[loaded] com.intego.commonservices.metrics.kschecker.plist [Click for support]

[running] com.intego.netbarrier.daemon.logger.plist [Click for support]

[running] com.intego.netbarrier.daemon.monitor.plist [Click for support]

[running] com.intego.netbarrier.daemon.plist [Click for support]

[running] com.intego.netupdate.daemon.plist [Click for support]

[loaded] com.intego.virusbarrier.daemon.emlparser.plist [Click for support]

[running] com.intego.virusbarrier.daemon.logger.plist [Click for support]

[running] com.intego.virusbarrier.daemon.plist [Click for support]

[running] com.intego.virusbarrier.daemon.scanner.plist [Click for support]

[loaded] com.macpaw.CleanMyMac2.Agent.plist [Click for support]

[loaded] com.oracle.java.Helper-Tool.plist [Click for support]

[loaded] com.oracle.java.JavaUpdateHelper.plist [Click for support]

[not loaded] com.sheepsystems.BookMacster.plist [Click for support]

User Launch Agents: ℹ️

[loaded] com.adobe.ARM.[...].plist [Click for support]

[running] com.akamai.single-user-client.plist [Click for support]

[loaded] com.google.keystone.agent.plist [Click for support]

[loaded] com.macpaw.CleanMyMac2Helper.diskSpaceWatcher.plist [Click for support]

[loaded] com.macpaw.CleanMyMac2Helper.scheduledScan.plist [Click for support]

[loaded] com.macpaw.CleanMyMac2Helper.trashWatcher.plist [Click for support]

[loaded] com.sheepsystems.BookMacster.CBDF6566-34...plist [Click for support]

[running] ws.agile.1PasswordAgent.plist [Click for support]

User Login Items: ℹ️

CheatSheet Application (/Applications/CheatSheet.app)

HardwareGrowler Application (/Applications/Utilities/HardwareGrowler.app)

AdobeResourceSynchronizer Application (/Applications/Adobe Reader.app/Contents/Support/AdobeResourceSynchronizer.app)

Moom Application (/Applications/Moom.app)

Dropbox Application (/Applications/Dropbox.app)

SMARTReporter Application (/Applications/SMARTReporter.app)

1Password 4 Application (/Applications/1Password 4.app)

TypeIt4Me Application Hidden (/Applications/TypeIt4Me.app)

Internet Plug-ins: ℹ️

Google Earth Web Plug-in: Version: 6.0 [Click for support]

Default Browser: Version: 537 - SDK 10.9

F5 SSL VPN Plugin: Version: 7003.2011.1110.1 [Click for support]

AdobePDFViewerNPAPI: Version: 11.0.12 - SDK 10.6 [Click for support]

FlashPlayer-10.6: Version: 18.0.0.209 - SDK 10.6 [Click for support]

Silverlight: Version: 5.1.30317.0 - SDK 10.6 [Click for support]

Flash Player: Version: 18.0.0.209 - SDK 10.6 [Click for support]

QuickTime Plugin: Version: 7.7.3

iPhotoPhotocast: Version: 7.0

AdobePDFViewer: Version: 11.0.12 - SDK 10.6 [Click for support]

QualysBrowserCheckSafari: Version: 1.0.48.1 - SDK 10.7

JavaAppletPlugin: Version: Java 8 Update 31 Check version

Safari Extensions: ℹ️

1Password

Dictionary

Ghostery

3rd Party Preference Panes: ℹ️

Akamai NetSession Preferences [Click for support]

Flash Player [Click for support]

Java [Click for support]

Logi Preference Manager [Click for support]

Time Machine: ℹ️

Skip System Files: NO

Mobile backups: OFF

Auto backup: YES

Volumes being backed up:

Macintosh HD: Disk size: 499.25 GB Disk used: 137.99 GB

Destinations:

Data [Network]

Total size: 998.06 GB

Total number of backups: 119

Oldest backup: 2013-09-23 19:30:14 +0000

Last backup: 2015-07-25 01:01:14 +0000

Size of backup disk: Adequate

Backup size 998.06 GB > (Disk used 137.99 GB X 3)

Top Processes by CPU: ℹ️

3% com.apple.WebKit.WebContent(6)

2% diskimages-helper

1% Dropbox

1% WindowServer

1% Full Deck Solitaire

Top Processes by Memory: ℹ️

1.16 GB com.apple.WebKit.WebContent(6)

443 MB kernel_task

209 MB com.apple.WebKit.Plugin.64

111 MB Safari

57 MB Full Deck Solitaire

Virtual Memory Information: ℹ️

30 MB Free RAM

3.12 GB Used RAM

0 B Swap Used

Diagnostics Information: ℹ️

Jul 24, 2015, 02:50:13 PM /Users/[redacted]/Library/Logs/DiagnosticReports/Activity Monitor_2015-07-24-145013_[redacted].crash

Jul 24, 2015, 11:40:45 AM /Users/[redacted]/Library/Logs/DiagnosticReports/HardwareGrowler_2015-07-24-114 045_[redacted].crash

Jul 24, 2015, 07:54:22 AM Self test - passed

Jul 23, 2015, 09:30:16 PM /Users/[redacted]/Library/Logs/DiagnosticReports/helpd_2015-07-23-213016_[redac ted].crash

Reply

Answer 6

Geoff K Author

Level 1

40 points

Jul 25, 2015 6:54 AM in response to BobHarris

I know I am ignorant of the inner workings of my Mac, but now I'm felling stupid. Yesterday I was grousing about using 5GB in a day. Today Excede's usage tally tells me I've used 0.5 GB since Thursday evening. You (or someone at CNET?) told me the Activity Monitor records all intra network acidity along with the external data exchange without differentiation. I assume that explains the difference. The total usage is still well above my average over the past 6 months but nowhere near the level I was reporting. Not at the panic level I thought yesterday. I think I will record Excede's data info 3x/day for a while to see what is happening. Is there anything else I should keep track of? I'm assuming the Activity Monitor is no help in this instance.

Thanks for your help.

Geoff

Reply

Answer 7

Geoff K Author

Level 1

40 points

Jul 25, 2015 7:08 AM in response to Drew Reece

Drew,

I have been monitoring the network tab in Activity Monitor. I looked at the others but couldn't make a lot of sense out of them. Nor did I make good sense out of the network tab. I see it was you told me about the Activity Monitor including local traffic. Thanks.

I open only one window but several tabs. Tabs when browsing varies. Usually I'll have 2-3 and sometimes when comparing things 10+. There are lots of ads going on and sometimes video in the ads.

I haven't used Apple Music and rarely radio. I did have photo stream active but it has been for a long time; well before the increase in data use. Now both photo syncing and iPhone back ups are off. I will do back ups occasionally after midnight when there's no data cap.

Thanks for your help. As you see by my other post today I don't have a good understanding of how this stuff works. There is an excessive usage problem but not nearly as bad as I thought yesterday.

Geoff

Reply

Answer 8

Eric Root

Level 10

684,033 points

Jul 25, 2015 7:58 AM in response to Geoff K

Try uninstalling Intego and CleanMyMac 2. You don't need cleaning programs.

CleanMyMac2 Un-install

After un-installing, use this program to make sure you got all the pieces.

EasyFind – Spotlight Replacement

For Intego, try uninstalling using the Developer's uninstall instructions.

Reply

Answer 9

Drew Reece

Level 6

10,660 points

Jul 25, 2015 8:38 AM in response to Geoff K

To be honest the best way to monitor traffic is on another device. That way all network traffic can be viewed including traffic from any other devices. It takes a lot to setup & will require you have hardware that can do that (like a PC with some network cards or a router with custom or enterprise firmware).

OS X has limited reporting for the send + receive figures in Activity Monitor. Local traffic isn't distinguished at all so you can't just sort by the largest & assume that is the fault.

There are a few apps that claim to do bandwidth monitoring on OSX…

Surplus meter (seems to be a dead project)

Icefloor but only on 10.9 & lower

iStat pro (seems to breakdown top 5 apps)

Little Snitch seems to be OK, but is a pain to live with.

I don't use any of them so I can't say which is best or even if they are reliable.

Safari & other browsers have extensions that can change how the browser operates…

https://extensions.apple.com/

To stop the video ads you need to use an adblocker (adblock plus, uBlock…) or close any site with video adverts. It may also help to disable Flash support via the ClickToFlash extension.

You can also 'inspect pages' via developer tools to try to see if they making large downloads, but since you may have to reload the page you may just load the same junk twice.

That may help cut down some traffic but it is just a guess based on how the internet is changing.

If you want to see why adverts can bloat page load size, this is a recent explanation of the issue…

http://www.imore.com/content-blockers-bad-ads-and-what-were-doing-about-it

Many other sites are also suffering from this.

Your Etrecheck report

Akamai netsession is a peer to peer system for the Akamai network - you are giving them access to your internet connection to improvetheir network performance - why do you need this? It could be part of your issue here.

http://uk.akamai.com/html/solutions/client_faq.html

SIMBL is a hack that is not designed for 10.10 – http://www.culater.net/software/SIMBL/SIMBL.php

It was made to modify applications by injecting code to make apps do things Apple didn't intend, it is not good to have installed in my opinion on unsupported OS version. The download has an uninstaller.

CleanMyMac seems like it is not needed to me.

It manages to find around 1.8GB of 'junk' on a clean Mac installation. Those files were created by the Apple installer, who knows best if it is junk – Apple or Macpaw? Deleting parts of the system just to safe a few GB of space is risky, it often effects other apps down the line (when language files are missing etc). I don't think the other tasks it does are required either.

Intego has a lot going on – I'm unconvinced you need 19 different background jobs for 1 application? Each one is using up resources & these apps tend to slow the OS. It also tries to poke it's nose into all internet traffic etc to 'protect' your computer.

You can find many other views on Intego's & Macpaw's software in this site if you search here, some people swear by them & others claim they are a waste of time & money. Whichever one is true I doubt these apps are the cause of your issue here, however I do not trust them & can't see how they are making you Mac any better. I would remove them both but it is your choice.

Reply

Answer 10

BobHarris

Level 9

53,051 points

Jul 25, 2015 10:40 AM in response to Geoff K

It is remotely possible

com.sheepsystems.BookMacster

is having issues and is wrongly updating bookmarks to/from the net a little too aggressively. I do not know anything about this app, just that Google says it syncs bookmarks using the network, so since it can talk to the network, I'm just guessing maybe it went bonkers.

I would eliminate CleanMyMac and Intego.

The Drew Reece advice on Akamai sounds good to me.

Reply

Answer 11

Eric Root

Level 10

684,033 points

Jul 26, 2015 8:37 AM in response to Geoff K

SIMBL is a sytem hack. Try removing it.

SIMBL Uninstall (2) See solution posted by Linc Davis .

Reply

Answer 12

Geoff K Author

Level 1

40 points

Jul 26, 2015 4:01 PM in response to Eric Root

Eric,

I will remove CleanMyMac and Intego. CMM has not given any difference in performance or made any other difference that I've seen. Interestingly, the only use I've found for it is to uninstall programs.

I realize most Mac people feel anti viral programs aren't necessary. It seems to me that although Mac isn't a target it could be and therefore will be someday. Nevertheless, there is no acute need for it and I'll remove it. I've used it's firewall instead of OS Xs. Could that be a problem?

I can't find SIMBL. It's not in the apps or utility folder, Spotlight doesn't find it. CleanMyMac doesn't find it. Yet EtreCheck says it's running. Where do I go to find it?

Thanks much for your help.

Geoff

Reply

Answer 13

Geoff K Author

Level 1

40 points

Jul 26, 2015 4:09 PM in response to Drew Reece

Drew, I'll get one of the add blockers. Never liked those things anyway although if that's what it takes to get "free" information I'll put up with them. I'll probably not get into the detailed tracking yet. My brain gets too addled at low level computerese; best to avoid the complex stuff. Akamai was there for something I had a couple years ago. I don't recall what it was; might have been a VPN that I used to get into my work network from home. I've been retired for 3 years so don't need that and will remove it.

Thanks much for your help.

Geoff

Reply

Answer 14

Geoff K Author

Level 1

40 points

Jul 26, 2015 4:17 PM in response to BobHarris

Bob, I've liked BookMacster. Most of my web use is on the desktop but when away from home the MBA is my source. My wife used it around home quite a bit. Recently it has not been syncing from MBA to the desk top. Perhaps there's something going on there. I was having problems with it when I first got it several years ago, mostly due to my ignorance of the process and terminology. Jerry Krinock was patiently helpful. I'll ask him if I'm missing something with his program. I sync BookMacster through Dropbox. I rarely use the web with my phone.

Well, I"ve got some work to do, stuff to uninstall. If anyone knows how to find/remove SIMBL let me know.

BTW, So far today Excede tells me I've used ¼ GB. That's back to normal and I haven't initiated any of the advice from this thread yet. So how will I know if it's working???

Thanks for your help.

Geoff

Reply

Answer 15

Drew Reece

Level 6

10,660 points

Jul 26, 2015 4:35 PM in response to Geoff K

Geoff K wrote:

I can't find SIMBL. It's not in the apps or utility folder, Spotlight doesn't find it. CleanMyMac doesn't find it. Yet EtreCheck says it's running. Where do I go to find it?

That's part of why we don't trust CleanMyMac 🙂

Eric Root linked to instructions for removing SIMBL or you can redownload the installer & use the uninstaller that is bundled with it, I linked to that earlier.

I don't know if the adblockers will help but an awful lot of sites seem to load large amounts of data for adverts as far as I can see.

Keep an eye on your usage & post back if it goes out of control.

Reply