Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

kernel_task filling my memory

Hi there,


I'm new to the apple community and would consider myself able to follow instructions but of limited knowledge when it comes to this stuff...I'm having to learn fast.


My hard drive keep getting filled up and I don't know where from. I've cleared about 20GB of space a couple of weeks ago and now it's full again. I restarted my computer about 15 minutes ago after freeing 2GB, which are already gone.


According to activity monitor, the kernel_task application is responsible. I'm not really sure what this does...?


I read in another thread somewhere that Evernote might be responsible, so I deleted that before my restart but it continued to happen.


I need advice in 2 areas:

1) How do I recover all the lost space?

2) How do I find out what has been eating up my memory?


Any and all help would be greatly appreciated.


YJB

MacBook Pro, OS X Yosemite (10.10.4)

Posted on Aug 17, 2015 11:56 AM

Reply
13 replies

Aug 17, 2015 12:16 PM in response to YJB21

I saw someone recommend etrecheck so have also done this...


Problem description:

kernel_task filling my memory


EtreCheck version: 2.4.1 (137)

Report generated 8/17/15, 8:08 PM

Download EtreCheck from http://etresoft.com/etrecheck


Click the [Click for support] links for help with non-Apple products.

Click the [Click for details] links for more information about that line.


Hardware Information: (What does this mean?)

MacBook Pro (17-inch, Mid 2009) (Technical Specifications)

MacBook Pro - model: MacBookPro5,2

1 2.8 GHz Intel Core 2 Duo CPU: 2-core

4 GB RAM Upgradeable

BANK 0/DIMM0

2 GB DDR3 1067 MHz ok

BANK 1/DIMM0

2 GB DDR3 1067 MHz ok

Bluetooth: Old - Handoff/Airdrop2 not supported

Wireless: en1: 802.11 a/b/g/n

Battery: Health = Normal - Cycle count = 108 - SN = 9G322009JDN5A


Video Information: (What does this mean?)

NVIDIA GeForce 9400M - VRAM: 256 MB

NVIDIA GeForce 9600M GT - VRAM: 512 MB

Color LCD 1920 x 1200


System Software: (What does this mean?)

OS X 10.10.4 (14E46) - Time since boot: about one hour


Disk Information: (What does this mean?)

FUJITSU MJA2500BH FFS G1 disk0 : (500.11 GB) (Rotational)

EFI (disk0s1) <not mounted> : 210 MB

Macintosh HD (disk0s2) / [Startup]: 499.25 GB (159 MB free) (Low!) - 3 errors


Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB


MATSHITADVD-R UJ-868 ()


USB Information: (What does this mean?)

Apple Inc. Built-in iSight

Western Digital External HDD 500.11 GB

disk1s1 (disk1s1) <not mounted> : 32 KB

YJB Passport (disk1s3) /Volumes/YJB Passport : 499.97 GB (58.72 GB free)

Apple, Inc. Apple Internal Keyboard / Trackpad

Apple Computer, Inc. IR Receiver

Apple Inc. BRCM2046 Hub

Apple Inc. Bluetooth USB Host Controller


Gatekeeper: (What does this mean?)

Mac App Store and identified developers


Kernel Extensions: (What does this mean?)

/Applications/Parallels Desktop.app

[not loaded] com.parallels.kext.hidhook (8.0 18354.823166) [Click for support]

[not loaded] com.parallels.kext.hypervisor (8.0 18354.823166) [Click for support]

[not loaded] com.parallels.kext.netbridge (8.0 18354.823166) [Click for support]

[not loaded] com.parallels.kext.usbconnect (8.0 18354.823166) [Click for support]

[not loaded] com.parallels.kext.vnic (8.0 18354.823166) [Click for support]


/Applications/Toast 8 Titanium/Toast Titanium.app

[not loaded] com.roxio.BluRaySupport (1.1.6) [Click for support]

[not loaded] com.roxio.TDIXController (1.7) [Click for support]


/Incompatible Software/Parallels Service.app

[not loaded] com.parallels.kext.prl_hid_hook (5.0 9344.558741) [Click for support]

[not loaded] com.parallels.kext.prl_hypervisor (5.0 9344.558741) [Click for support]

[not loaded] com.parallels.kext.prl_netbridge (5.0 9344.558741) [Click for support]

[not loaded] com.parallels.kext.prl_usb_connect (5.0 9344.558741) [Click for support]

[not loaded] com.parallels.kext.prl_vnic (5.0 9344.558741) [Click for support]


/System/Library/Extensions

[not loaded] com.Huawei.driver.HuaweiDataCardDriver (4.0.6) [Click for support]

[not loaded] com.wdc.driver.1394HP (1.0.5) [Click for support]

[not loaded] com.wdc.driver.USBHP (1.0.1) [Click for support]

[not loaded] jp.plentycom.driver.SteerMouse (4.0.2) [Click for support]


Startup Items: (What does this mean?)

HWNetMgr: Path: /Library/StartupItems/HWNetMgr

ParallelsDesktopTransporter: Path: /Library/StartupItems/ParallelsDesktopTransporter

Startup items are obsolete in OS X Yosemite


Launch Agents: (What does this mean?)

[loaded] com.oracle.java.Java-Updater.plist [Click for support]

[running] com.trusteer.rapport.rapportd.plist [Click for support]


Launch Daemons: (What does this mean?)

[loaded] com.adobe.fpsaud.plist [Click for support]

[loaded] com.mcafee.virusscan.eupdate.plist [Click for support]

[loaded] com.microsoft.office.licensing.helper.plist [Click for support]

[loaded] com.oracle.java.Helper-Tool.plist [Click for support]

[loaded] com.oracle.java.JavaUpdateHelper.plist [Click for support]

[running] com.trusteer.rooks.rooksd.plist [Click for support]

[failed] com.vmware.launchd.vmware.plist [Click for support]


User Launch Agents: (What does this mean?)

[loaded] com.adobe.ARM.[...].plist [Click for support]

[loaded] com.google.keystone.agent.plist [Click for support]

[running] com.spotify.webhelper.plist [Click for support]


User Login Items: (What does this mean?)

SteerMouse Application (/Applications/Utilities/SteerMouse.app)

Caffeine Application (/Applications/Caffeine.app)

Dropbox Application (/Applications/Dropbox.app)

Google Drive Application (/Applications/Google Drive.app)

Spotify Application Hidden (/Applications/Spotify.app)

Launch Nikon Message Center 2 UNKNOWN (missing value)


Internet Plug-ins: (What does this mean?)

DirectorShockwave: Version: 11.5.0r595 [Click for support]

Default Browser: Version: 600 - SDK 10.10

Flip4Mac WMV Plugin: Version: 2.4.1.4 [Click for support]

OfficeLiveBrowserPlugin: Version: 12.3.6 [Click for support]

AdobePDFViewerNPAPI: Version: 11.0.12 - SDK 10.6 [Click for support]

FlashPlayer-10.6: Version: 18.0.0.232 - SDK 10.6 [Click for support]

DivXBrowserPlugin: Version: 2.0 [Click for support]

Silverlight: Version: 5.1.20913.0 - SDK 10.6 [Click for support]

Flash Player: Version: 18.0.0.232 - SDK 10.6 [Click for support]

QuickTime Plugin: Version: 7.7.3

iPhotoPhotocast: Version: 7.0

SharePointBrowserPlugin: Version: 14.5.3 - SDK 10.6 [Click for support]

AdobePDFViewer: Version: 11.0.12 - SDK 10.6 [Click for support]

JavaAppletPlugin: Version: Java 8 Update 51 Check version


User internet Plug-ins: (What does this mean?)

WebEx64: Version: 1.0 - SDK 10.6 [Click for support]


Safari Extensions: (What does this mean?)

Readability


3rd Party Preference Panes: (What does this mean?)

DivX [Click for support]

Flash Player [Click for support]

Flip4Mac WMV [Click for support]

GnuPG Preferences [Click for support]

Growl [Click for support]

Java [Click for support]

MacFUSE [Click for support]

Perian [Click for support]

SteerMouse [Click for support]

Trusteer Endpoint Protection [Click for support]


Time Machine: (What does this mean?)

Skip System Files: NO

Mobile backups: ON

Auto backup: YES

Volumes being backed up:

Macintosh HD: Disk size: 499.25 GB Disk used: 499.09 GB

Destinations:

My Passport for Mac [Local]

Total size: 1.00 TB

Total number of backups: 69

Oldest backup: 2013-11-12 01:49:43 +0000

Last backup: 2015-08-16 22:43:05 +0000

Size of backup disk: Too small

Backup size 1.00 TB < (Disk used 499.09 GB X 3)


Top Processes by CPU: (What does this mean?)

8% WindowServer

0% taskgated

0% fontd

0% rapportd

0% askpermissiond


Top Processes by Memory: (What does this mean?)

774 MB com.apple.WebKit.WebContent(6)

643 MB kernel_task

139 MB Safari

86 MB WindowServer

74 MB spindump


Virtual Memory Information: (What does this mean?)

32 MB Free RAM

3.97 GB Used RAM (1.01 GB Cached)

2 MB Swap Used


Diagnostics Information: (What does this mean?)

Aug 17, 2015, 07:32:32 PM /Library/Logs/DiagnosticReports/Spotify_2015-08-17-193232_[redacted].hang

Aug 17, 2015, 07:30:45 PM /Library/Logs/DiagnosticReports/coresymbolicationd_2015-08-17-193045_[redacted] .crash

Aug 17, 2015, 07:27:54 PM ~/Library/Logs/DiagnosticReports/Spotify Helper_2015-08-17-192754_[redacted].crash

Aug 17, 2015, 07:01:27 PM Self test - passed

Aug 17, 2015, 06:41:49 PM /Library/Logs/DiagnosticReports/coresymbolicationd_2015-08-17-184149_[redacted] .crash

Aug 17, 2015, 06:37:23 PM /Library/Logs/DiagnosticReports/coresymbolicationd_2015-08-17-183723_[redacted] .crash

Aug 17, 2015, 02:27:36 PM /Library/Logs/DiagnosticReports/coresymbolicationd_2015-08-17-142736_[redacted] .crash

Aug 17, 2015, 02:02:54 PM /Library/Logs/DiagnosticReports/coresymbolicationd_2015-08-17-140254_[redacted] .crash

Aug 16, 2015, 08:14:27 PM /Library/Logs/DiagnosticReports/coresymbolicationd_2015-08-16-201427_[redacted] .crash

Aug 16, 2015, 07:58:35 PM /Library/Logs/DiagnosticReports/coresymbolicationd_2015-08-16-195835_[redacted] .crash

Aug 16, 2015, 07:49:03 PM /Library/Logs/DiagnosticReports/coresymbolicationd_2015-08-16-194903_[redacted] .crash

Aug 17, 2015 2:52 PM in response to YJB21

kernel_task is what is responsible for running every process on the Mac. The memory use shown in AM is the RAM it is using, not disk space.

coresymbolicationd is crashing a lot and the logs may be filling your hard drive.

I'm not sure I would be able to interpret the crash logs to determine the cause, but someone here might.

Things like that crashing are usually tied to other third-party software that is incompatible with the current OS.

Antivirus is almost always problematic after an OS update as they rarely keep ahead of Apple's release schedule.


Trusteer has caused complete OS kernel panics, but I doubt it is related here.

You've got old versions of Parallels, but there are not loading, so shouldn't be the cause.

VMWare failed to load, but it appears you have removed its kernel extensions which may be why the launch daemon is failing to load.


In the, "while we're here" category, you've got Western Digital drive software loaded. When Yosemite was released, that software caused many people to lose entire hard drives. They've probably updated it (I hope), but with data, one failure and I'm done with you. I would have never installed it in the first place, but I certainly wouldn't ever install any of WD's tools given that debacle.

Aug 17, 2015 3:37 PM in response to YJB21

Thanks very much for the advice there, Barney-15E. Much appreciated.

I will get rid of the WD software...I think the WD software was from external hard drives and I don't use the software.


I haven't been able to actually find coresybomlicationd.

I ran GrandPerspective and also Omnidisksweeper. I've identified "/Library/Application Support/MobileSync/Backup Info" as having about 23GB of info in it that I am unsure if I can safely delete.


However, more interestingly, both software programmes only identify about 220GB of files.

GrandPerspective identified 261GB being used by "Miscellaneous space".


Does that further inform anyone who is able to help?


Once again, thanks for any help!

YJB

Aug 17, 2015 4:05 PM in response to YJB21

For information about the Other category in the Storage display, see this support article. If the display seems to be inaccurate, try rebuilding the Spotlight index.

Empty the Trash if you haven't already done so. If you use iPhoto, empty its internal Trash first:

iPhoto ▹ Empty Trash

In Photos:

File Show Recently Deleted Delete All

Do the same in other applications, such as Aperture, that have an internal Trash feature. Then restart the computer. That will temporarily free up some space.

According to Apple documentation, you need at least 9 GB of available space on the startup volume (as shown in the Finder Info window) for normal operation—not the mythical 10%, 15%, or any other percentage. You also need enough space left over to allow for growth of the data. There is little or no performance advantage to having more available space than the minimum Apple recommends. Available storage space that you'll never use is wasted space.

When Time Machine backs up a portable Mac, some of the free space will be used to make local snapshots, which are backup copies of recently deleted files. The space occupied by local snapshots is reported as available by the Finder, and should be considered as such. In the Storage display of System Information, local snapshots are shown as Backups. The snapshots are automatically deleted when they expire or when free space falls below a certain level. You ordinarily don't need to, and should not, delete local snapshots yourself. If you followed bad advice to disable local snapshots by running a shell command, you may have ended up with a lot of data in the Other category. Ask for instructions in that case.

See this support article for some simple ways to free up storage space.

You can more effectively use a tool such as OmniDiskSweeper (ODS) or GrandPerspective (GP) to explore the volume and find out what's taking up the space. You can also delete files with it, but don't do that unless you're sure that you know what you're deleting and that all data is safely backed up. That means you have multiple backups, not just one. Note that ODS only works with OS X 10.8 or later. If you're running an older OS version, use GP.

Deleting files inside a photo or iTunes library will corrupt the library. Changes to such a library must be made from within the application that created it. The same goes for Mail files.

Proceed further only if the problem isn't solved by the above steps.

ODS or GP can't see the whole filesystem when you run it just by double-clicking; it only sees files that you have permission to read. To see everything, you have to run it as root.

Back up all data now.

Install the app in the Applications folder as usual. Quit it if it's running.

Triple-click anywhere in the corresponding line of text below on this page to select it, then copy the selected text to the Clipboard by pressing the key combination command-C.

For ODS:

security execute-with-privileges /A*/OmniDiskSweeper.app/*/M*/* 2>&-

For GP:

security execute-with-privileges /A*/GrandPerspective.app/*/M*/* 2>&-

Launch the built-in Terminal application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad and start typing the name.

Paste into the Terminal window by pressing command-V. You'll be prompted for your login password.

The application window will open behind other open windows. When you scan a volume, the window will eventually show all files in all folders, sorted by size. It may take a few minutes for the app to finish scanning.

I don't recommend that you make a habit of doing this. Don't delete anything as root. If something needs to be deleted, make sure you know what it is and how it got there, and then delete it by other, safer, means. When in doubt, leave it alone or ask for guidance.

When you're done with the app, quit it and also quit Terminal.

Aug 17, 2015 4:26 PM in response to YJB21

YJB21 wrote:

I ran GrandPerspective and also Omnidisksweeper. I've identified "/Library/Application Support/MobileSync/Backup Info" as having about 23GB of info in it that I am unsure if I can safely delete.

Those are the backups for your iPhone/iPad.

Go to iTunes, Preferences, Devices. You can then pick and choose the backups to delete from a list by date.


How many backups do you have? I only have about a dozen between two devices taking up about 4GB.

Aug 17, 2015 7:07 PM in response to Linc Davis

Hi Linc Davis,


I've done all the standard deletes and used disk utility to repair my disk and all permissions too. It needed a repair apparently.


I've also re-indexed spotlight and cleared all the internal trash but there was very little there in fact. Having deleted 22GB of iPhone and iPad backups I have 22GB free space. However, I'm slightly concerned I have a memory leak of some sort as I already now only have 19GB free after a few hours of use.


I think the culprit must lie somewhere in the 250GB of 'miscellaneous' or 'other' files on my hard drive. 478GB of the hard drive is currently being used by "other" according to the storage monitor.


I'm in the process of re-running ODS with the added permissions and will let you know how it turns out...


YJB

Aug 17, 2015 7:14 PM in response to Linc Davis

It seems the cache file/folder "com.apple.coresymbolicatiobd" is to blame. A cache folder with 282GB in it?


Other forum posts say this is safe to delete, but I want to stop this from re-accumulating.

Should I delete the folder itself or the contents?

Do you know any way of finding out why this is happening and stop it?


Nearly at the bottom of this. Appreciate the help!


YJB

Aug 17, 2015 7:31 PM in response to YJB21

The symbol cache file is very large. It stores data used in logs and crash reports, and it may have grown because it's corrupt. The file is created automatically, and if deleted, it should be recreated when you restart the computer. Initially, at least, it will be a lot smaller.

I've seen one unverified report that a system became unbootable when the cache was deleted. That would have been due to a corrupt installation of OS X, but you should be prepared to reinstall if necessary. There is no reason to panic as long as you have good backups, which you should already have if you got this far.

Enter the following command in the same way as before:

sudo mv /S*/*/Caches/com.apple.coresymbolicationd /tmp/

Restart the computer.

Aug 18, 2015 6:55 AM in response to Linc Davis

HI there


I have good time machine backups, which I hope will suffice. I'm happy to delay doing this is a better backup method is recommended before doing anything?


So you recommend deleting it by that method, rather than in safe mode or using ODS? I don't really know what the command is it does but it seems to make the folder into a temp file?


I will do this in the next hour or so and let you know the outcome. Once again, thanks both for the assistance.


YJB

Aug 18, 2015 4:29 PM in response to Linc Davis

Hi helpful community!


Linc as you said, ran the command and rebooted and now have 300GB hard drive space free. No problems on the reboot. Appreciate the advice.

Barney, the log files were not abnormally large or to blame it seems.


There's still the matter of finding the cause...I will follow your advice Eric Root, and get rid of Trusteer and McAfee. I think once many years ago I may have installed aand immediately deleted MacKeeper...so I will try find something about removing all of its components.


In the meantime at least I have a way of recovering my memory periodically until I find a solution. Will keep you posted via this thread. The help has been very useful!!


YJB

kernel_task filling my memory

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.