coresymbolicationd: whazzup?

Question

Level 1

48 points

coresymbolicationd: whazzup?

Dear forum pals,

the system log of my MacBook Air (2012 model, I recently installed 10.11 aka El Capitan) is filled with the following:

13/10/2015 20:12:14.000 kernel[0]: Sandbox: coresymbolicatio(22974) System Policy: deny(1) file-write-create /System/Library/Caches/com.apple.coresymbolicationd

13/10/2015 20:12:14.301 coresymbolicationd[22974]: /System/Library/Caches/com.apple.coresymbolicationd/data does not exist, resetting cache

13/10/2015 20:12:14.301 coresymbolicationd[22974]: Attempt to create [/System/Library/Caches/com.apple.coresymbolicationd/data] failed. No such file or directory

13/10/2015 20:12:14.301 coresymbolicationd[22974]: Unable to open storage at /System/Library/Caches/com.apple.coresymbolicationd/data

13/10/2015 20:12:14.304 com.apple.xpc.launchd[1]: (com.apple.coresymbolicationd) Service only ran for 0 seconds. Pushing respawn out by 10 seconds.

From what I can get, something is trying to write this com.apple.coresymbolicationd file in System/Library/Caches, but the new OS 10.11 does not allow it.

In fact, if I check in that directory, the folder/file does not exist.

This is an explanation about this file: http://apple.stackexchange.com/questions/83978/what-is-com-apple-coresymbolicati ond-in-caches

I tried to delete caches and reboot. I tried to boot in safe mode and then reboot. No way.

What would you suggest to check to fix this issue? How to find the culprit which is trying to write this file?

Thanks for any help/hint.

Best

donazipe

OS X El Capitan (10.11)

Posted on Oct 13, 2015 11:20 AM

Reply

Answer 1

Best reply

Linc Davis

Level 10

209,547 points

Oct 13, 2015 6:13 PM in response to donazipe

This procedure is a diagnostic test. It makes no changes to your data.

Please triple-click anywhere in the line below on this page to select it:

ls -@Oaen /S*/*/Caches | pbcopy

Copy the selected text to the Clipboard by pressing the key combination command-C.

Launch the built-in Terminal application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad and start typing the name.

Paste into the Terminal window by pressing the key combination command-V. I've tested these instructions only with the Safari web browser. If you use another browser, you may have to press the return key after pasting.

Wait for a new line ending in a dollar sign ($) to appear below what you entered.

The output of the command will be automatically copied to the Clipboard. If the command produced no output, the Clipboard will be empty. Paste into a reply to this message.

The Terminal window doesn't show the output. Please don't copy anything from there.

If any personal information appears in the output, anonymize before posting, but don’t remove the context.

Reply

Answer 2

donazipe Author

Level 1

48 points

Oct 13, 2015 11:22 PM in response to Linc Davis

Hi, Davis. This is the output:

total 0

drwxr-xr-x 6 0 0 restricted 204 4 Oct 13:02 .

drwxr-xr-x 79 0 0 restricted 2686 4 Oct 12:56 ..

drwxr-xr-x 6 0 0 restricted 204 4 Oct 13:02 com.apple.CVMS

drwxr-xr-x 3 0 0 restricted 102 4 Oct 12:59 com.apple.bootstamps

drwxr-xr-x 2 0 0 restricted 68 4 Oct 12:59 com.apple.corestorage

drwxr-xr-x 4 0 0 restricted 136 4 Oct 12:56 com.apple.kext.caches

What does it mean?

Thanks for helping!

donazipe

Reply

Answer 3

Linc Davis

Level 10

209,547 points

Oct 14, 2015 6:21 AM in response to donazipe

It means that the OS X installation is corrupt. Have you modified any built-in configuration files?

Reply

Answer 4

donazipe Author

Level 1

48 points

Oct 14, 2015 6:28 AM in response to Linc Davis

No, I didn't, or at least not intentionally...

Since I purchased a new SSD, I did a clean install of el capitan booting from an external USB key, formatted SSD and then I installed the OS.

During the installation I was asked to connect to a timemachine backup, which I did to move on the new mac the backup content.

Maybe it just took over something from the timemachine backup done on the previous mac over yosemite...

What if I re-download 10.11 and I reinstall it on the top of the current installation?

Thanks for helping in solving this issue!

donazipe

Reply

Answer 5

Linc Davis

Level 10

209,547 points

Oct 14, 2015 8:32 AM in response to donazipe

I'm trying to understand how this could have happened. Please triple-click anywhere in the line below on this page to select it:

/System/Library/Sandbox/rootless.conf

Right-click or control-click the line and select

Services ▹ Reveal in Finder (or just Reveal)

from the contextual menu.* A folder should open with a file selected. Drag the file onto the TextEdit icon in the Dock or in the Applications folder to open it. Post the text in the window that opens.

*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return.

Reply

Answer 6

donazipe Author

Level 1

48 points

Oct 14, 2015 8:38 AM in response to Linc Davis

Thanks, Davis.

This is what rootless.conf contains:

	/Applications/App Store.app
	/Applications/Automator.app
	/Applications/Calculator.app
	/Applications/Calendar.app
	/Applications/Chess.app
	/Applications/Contacts.app
	/Applications/Dashboard.app
	/Applications/Dictionary.app
	/Applications/DVD Player.app
	/Applications/FaceTime.app
	/Applications/Font Book.app
	/Applications/Game Center.app
	/Applications/Image Capture.app
	/Applications/Launchpad.app
	/Applications/Mail.app
	/Applications/Maps.app
	/Applications/Messages.app
	/Applications/Mission Control.app
	/Applications/Notes.app
	/Applications/Photo Booth.app
	/Applications/Photos.app
	/Applications/Preview.app
	/Applications/QuickTime Player.app
	/Applications/Reminders.app
	/Applications/Safari.app
	/Applications/Stickies.app
	/Applications/System Preferences.app
	/Applications/TextEdit.app
	/Applications/Time Machine.app
	/Applications/Utilities/Activity Monitor.app
	/Applications/Utilities/AirPort Utility.app
	/Applications/Utilities/Audio MIDI Setup.app
	/Applications/Utilities/Bluetooth File Exchange.app
	/Applications/Utilities/Boot Camp Assistant.app
	/Applications/Utilities/ColorSync Utility.app
	/Applications/Utilities/Console.app
	/Applications/Utilities/Digital Color Meter.app
	/Applications/Utilities/Disk Utility.app
	/Applications/Utilities/Feedback Assistant.app
	/Applications/Utilities/Grab.app
	/Applications/Utilities/Grapher.app
	/Applications/Utilities/Keychain Access.app
	/Applications/Utilities/Migration Assistant.app
	/Applications/Utilities/Script Editor.app
	/Applications/Utilities/System Information.app
	/Applications/Utilities/Terminal.app
	/Applications/Utilities/VoiceOver Utility.app
	/Library/Preferences/SystemConfiguration/com.apple.Boot.plist
	/System
*	/System/Library/Caches
booter	/System/Library/CoreServices
*	/System/Library/CoreServices/Photo Library Migration Utility.app
	/System/Library/CoreServices/RawCamera.bundle
*	/System/Library/Extensions
	/System/Library/Extensions/*
UpdateSettings	/System/Library/LaunchDaemons/com.apple.UpdateSettings.plist
*	/System/Library/Speech
*	/System/Library/User Template
	/bin
dyld	/private/var/db/dyld
	/sbin
	/usr
*	/usr/libexec/cups
*	/usr/local
*	/usr/share/man

# symlinks

	/etc
	/tmp
	/var

Reply

Answer 7

Linc Davis

Level 10

209,547 points

Oct 14, 2015 8:54 AM in response to donazipe

That's what it should be, but something else is wrong. Do you have an external storage device you can boot from?

Reply

Answer 8

donazipe Author

Level 1

48 points

Oct 14, 2015 9:09 AM in response to Linc Davis

Yes, I have an external disk on which I clone/backup the MacBookAir main drive...

I guess this might not be useful, since it is a clone... and thus it will likely have the same issue.

What about booting from the recovery partition of from a USB key?

If needed, I might try to install elcapitan on an external drive and boot from it... What I should then look for?

Thanks a lot... I was afraid this was not an easy issue to solve...

Reply

Answer 9

Linc Davis

Level 10

209,547 points

Oct 14, 2015 9:53 AM in response to donazipe

Boot from the external drive. Navigate in the Finder to the System folder at the top level of the internal drive—not the one you're booted from. Inside it is a subfolder named "Library." Inside that is a subfolder named "Caches." Drag the Caches folder to the Trash and empty. Then start from the internal drive as usual. The Caches folder should be recreated automatically, hopefully without the corruption it has now.

Reply

Answer 10

donazipe Author

Level 1

48 points

Oct 14, 2015 2:33 PM in response to Linc Davis

I did that. Booted from an external drive, deleted the Caches subfolder in System/Library on the internal main drive (trash, empty trash).

I rebooted from the main drive.

The os recreated the caches folder, and within that folder now I have only 2 folders:

com.apple.bootstamps

com.apple.corestorage

back to Console, system log... I keep getting over and over:

14/10/2015 23:24:45.000 kernel[0]: Sandbox: coresymbolicatio(1082) System Policy: deny(1) file-write-create /System/Library/Caches/com.apple.coresymbolicationd

14/10/2015 23:24:45.244 coresymbolicationd[1082]: /System/Library/Caches/com.apple.coresymbolicationd/data does not exist, resetting cache

14/10/2015 23:24:45.244 coresymbolicationd[1082]: Attempt to create [/System/Library/Caches/com.apple.coresymbolicationd/data] failed. No such file or directory

14/10/2015 23:24:45.244 coresymbolicationd[1082]: Unable to open storage at /System/Library/Caches/com.apple.coresymbolicationd/data

14/10/2015 23:24:45.246 com.apple.xpc.launchd[1]: (com.apple.coresymbolicationd) Service only ran for 0 seconds. Pushing respawn out by 10 seconds.

Who the **** is trying to write this com.apple.coresymbolicationds fine in that /System/Library/Caches directory???

I am just getting crazy about it!

Any other idea?

Thanks a lot for your help and support! :-)

donazipe

Reply

Answer 11

Linc Davis

Level 10

209,547 points

Oct 14, 2015 2:49 PM in response to donazipe

1. So far we've been talking about log messages. What functional problem do you have, if any? Log messages are not a problem in themselves.

2. Do you get the same log messages when booted from the external drive? Do you also have the same functional problem then, if there is one?

Reply

Answer 12

donazipe Author

Level 1

48 points

Oct 22, 2015 2:53 AM in response to Linc Davis

I downloaded El Capitan 10.11.1 from AppleStore (not the update... the whole installer) and I reinstalled 10.11.1 over the previous 10.11.

Everything went ok, and that pesky error disappeared from console.

Thanks for helping, and hope this helps.

Reply

Answer 13

Tinybop

Level 1

8 points

Nov 7, 2015 7:56 AM in response to Linc Davis

I have a similar problem but am loath to reinstall the entire system.

I'm getting this over and over again in the console:

11/7/15 10:52:31.000 AM kernel[0]: Sandbox: coresymbolicatio(30069) System Policy: deny(1) file-write-create /System/Library/Caches/com.apple.coresymbolicationd

11/7/15 10:52:31.511 AM coresymbolicationd[30069]: /System/Library/Caches/com.apple.coresymbolicationd/data does not exist, resetting cache

11/7/15 10:52:31.511 AM coresymbolicationd[30069]: Attempt to create [/System/Library/Caches/com.apple.coresymbolicationd/data] failed. No such file or directory

11/7/15 10:52:31.511 AM coresymbolicationd[30069]: Unable to open storage at /System/Library/Caches/com.apple.coresymbolicationd/data

11/7/15 10:52:31.511 AM com.apple.xpc.launchd[1]: (com.apple.coresymbolicationd) Service only ran for 0 seconds. Pushing respawn out by 10 seconds.

11/7/15 10:52:41.000 AM kernel[0]: Sandbox: coresymbolicatio(30072) System Policy: deny(1) file-write-create /System/Library/Caches/com.apple.coresymbolicationd

11/7/15 10:52:41.523 AM coresymbolicationd[30072]: /System/Library/Caches/com.apple.coresymbolicationd/data does not exist, resetting cache

11/7/15 10:52:41.523 AM coresymbolicationd[30072]: Attempt to create [/System/Library/Caches/com.apple.coresymbolicationd/data] failed. No such file or directory

11/7/15 10:52:41.523 AM coresymbolicationd[30072]: Unable to open storage at /System/Library/Caches/com.apple.coresymbolicationd/data

11/7/15 10:52:41.523 AM com.apple.xpc.launchd[1]: (com.apple.coresymbolicationd) Service only ran for 0 seconds. Pushing respawn out by 10 seconds.

/System/Library/Caches/com.apple.coresymbolicationd does not exist. Could I just re-create that directory and then maybe it could write?

Reply

Answer 14

donazipe Author

Level 1

48 points

Nov 8, 2015 12:53 AM in response to Tinybop

I did not find any other way. Follow my suggestion: download 10.11.1 El Capitan, and reinstall it OVER your previous installation (you don't have to reinstall all your files pictures music ecc. from a timemachine backup... just download and run the installer). It will take an hour or so, but then you are all set!

For extra safety, run a TM backup before doing it, just in case.

Reply

Answer 15

May 18, 2016 3:43 AM in response to Linc Davis

This is my report:

total 1296

drwxr-xr-x 15 0 0 - 510 3 Nov 2015 .

drwxr-xr-x 79 0 0 restricted 2686 16 Mag 20:22 ..

drwxr-xr-x 16 0 0 - 544 7 Nov 2015 com.apple.CVMS

-rw-r--r-- 1 0 0 - 42890 2 Nov 2015 com.apple.Components2.SystemCache.Components

-rw-r--r-- 1 0 0 - 58720 18 Ott 2015 com.apple.Components2.SystemCache.QuickTimeComponents

-rw-r--r-- 1 0 0 - 8820 3 Nov 2015 com.apple.IntlDataCache.le

-rw-r--r-- 1 0 0 - 36652 3 Nov 2015 com.apple.IntlDataCache.le.kbdx

-rw-r--r-- 1 0 0 - 17883 16 Mag 20:20 com.apple.app-sandbox-cache.plist

-rw-r--r-- 1 0 0 - 279229 2 Nov 2015 com.apple.automator.actionCache-system-readonly.plist

-rw-r--r-- 1 0 0 - 41 22 Mar 15:03 com.apple.bootefisignature

drwx------ 5 0 0 - 170 17 Mag 21:14 com.apple.coresymbolicationd

drwxr-xr-x 4 0 0 - 136 23 Ago 2015 com.apple.kext.caches

drwx------ 2 0 0 - 68 3 Nov 2015 com.apple.receiptInstaller

-rw-r--r-- 1 0 0 - 6720 16 Mag 20:20 com.apple.xpc.extensions.cache

-rw-r--r-- 1 0 0 - 191259 16 Mag 20:19 com.apple.xpchelper.cache

Any problem?

Reply