distnoted CPU Runaway...

Same here. Mid 2011 iMac 27'' running El Cap with 10.11.5

Distnoted process running amok every few days. At least, after A LOT of searching the web I found this thread and can react quickly most of the time. Thinking about installing the cronjob mentioned in one post here.

Still have no clue, which combination of software may cause the problem. Sometimes I think it may be due to my ****** ISP-bound router (Unitymedia Connect Box in Germany, if anyone can relate), because it seems to only happen when waking up my iMac and therefore reconnecting to WiFi. The box' DHCP seems to take quite long to give an IP address.

Just to confirm that the distnoted lock-ups continue with the released version of 10.11.6. Just had a lock-up that was first noticeable as a dropbox crash, and a lack of any updating in activity monitor. First I force-quit the distnoted for my user (which was around 0.5% CPU), but this didn't work (i.e. the force quit didn't happen). I then spotted that the distnoted owned by _distnote had been using quite a bit of CPU time (even though it was <0.5% CPU at that point), I force quit it & then activity monitor lept back into life, dropbox was fine again etc.

(This was all on a MacBook Pro Retina 13", mid 2014)

This procedure will delete certain temporary and cache files. The files are automatically generated and don't contain any of your data. Occasionally they can become corrupt and cause problems such as yours.

Please back up all data and read this whole message before doing anything.

Triple-click anywhere in the line below on this page to select it:

/var/folders/zz/zyxvpxvq6csfxvn_n00000y400007j

Right-click or control-click the highlighted line and select

Services ▹ Reveal in Finder (or just Reveal)

from the contextual menu.* A folder should open with a subfolder selected. The subfolder has a long name beginning with "zyx" and ending with "7j". Move that subfolder to the Trash. Don't move any of the other subfolders with similar names. You may be prompted for your administrator login password. Restart the computer and empty the Trash.

*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return.

Hi,

same problem here with my late 2009 iMac. I've had that problem since Yosemite and the latest El Capitan update did not resolve the issue. I recently installed an SSD as my main system drive, so there is a clean install on the disk but I migrated apps and settings as well as connecting to the home folder which is located on my previous system HDD. I have also got 12GB RAM installed, no anti-virus SW, Safari and Mail as main browser and email clients. I've got a bunch of software installed such as f.lux, little snitch, Teamviewer, Skype, Dropbox, Adobe CS, MS Office, Endnote, Parallels to name the apps that I have running most of the time.

I am aware that distnoted connected to the User account is the culprit but I am still at a loss as to what triggers it to go haywire. I've read that Adobe background processes like the AdobeCRDaemon, Mail and Music can send distnoted out of control and it seems that the error occurs less frequent when I kill all all Adobe processes and don't have Music and Mail running. It still happens once in a while and today I was able to kill distnoted before my computer became fully unresponsive. Afterwards, I searched the system log for distnoted. At the time of the incident I had Parallels Desktop with ArcGIS, Photoshop, Adobe Acrobat Pro, Mail, Safari, Music, Teamviwer, Dropbox and f.lux running. This what came up when I filtered for distnoted in the System log:

Jul 21 15:34:53 Thorstens-iMac com.apple.xpc.launchd[1] (com.apple.distnoted.xpc.agent[390]): Service exited due to signal: Killed: 9

Jul 21 15:34:53 Thorstens-iMac distnoted[2919]: # distnote server agent absolute time: 21593.877284763 civil time: Thu Jul 21 15:34:53 2016 pid: 2919 uid: 501 root: no

Jul 21 15:35:23 Thorstens-iMac distnoted[2919]: SuperConnection '<_NSDNXPCConnection: 0x7fa1f8700ef0>' became invalid

Jul 21 15:35:23 Thorstens-iMac distnoted[781]: SuperConnection '<_NSDNXPCConnection: 0x7fbfe8d00da0>' became invalid

Jul 21 15:35:23 Thorstens-iMac com.apple.xpc.launchd[1] (com.apple.distnoted.xpc.daemon[108]): Service exited due to signal: Killed: 9

Jul 21 15:37:34 Thorstens-iMac distnoted[2951]: # distnote server daemon absolute time: 21755.310273816 civil time: Thu Jul 21 15:37:34 2016 pid: 2951 uid: 241 root: yes

It's been almost ten days now. No freezes ever since. Whatever temporary files these were, it seemed to work. Thank you for the hint.

Hello Linc,

On my brand new 12" Macbook I have the same problem. Very frustrating!! Few times per day the computer get unresponsive and distnoted peaks at 380% CPU. I have not been able to find any correlation between this occurrence and the apps I have open or work in. Typically I have open Mail, Calendar, Word 2016 and Acrobat.

I hope your offer to have a look at logfiles is still valid. It would be extremely helpfull if you could narrow down the problem. Thanks in advance.
At 18:04 the computer crashed.

--------

27-07-16 18:03:27,598 WindowServer[170]: send_datagram_available_ping: pid 364 failed to act on a ping it dequeued before timing out.

27-07-16 18:03:27,599 WindowServer[170]: send_datagram_available_ping: pid 177 failed to act on a ping it dequeued before timing out.

27-07-16 18:03:40,258 WindowServer[170]: send_datagram_available_ping: pid 318 failed to act on a ping it dequeued before timing out.

27-07-16 18:04:06,617 locationd[80]: NETWORK: no response from server, reachability, 2, queryRetries, 0

27-07-16 18:04:08,576 WindowServer[170]: Surface testing disallowed updates for 10 sequential attempts...

27-07-16 18:04:08,590 WindowServer[170]: Surface test allowed updates after 12 attempts (48 ms)

27-07-16 18:04:19,157 Mail[264]: Stream 0x7fa2be2a20e0 is sending an event before being opened

27-07-16 18:04:24,957 com.apple.WebKit.WebContent[712]: <<<< MediaValidator >>>> mv_ValidateRFC4281CodecId: Unrecognized codec 1.(null). Failed codec specific check.

27-07-16 18:04:24,958 com.apple.WebKit.WebContent[712]: <<<< MediaValidator >>>> mv_LookupCodecSupport: Unrecognized codec 1

27-07-16 18:04:24,962 com.apple.WebKit.WebContent[712]: [18:04:24.961] mv_LowLevelCheckIfVideoPlayableUsingDecoder signalled err=-12956 (kFigMediaValidatorError_VideoCodecNotSupported) (video codec 1) at line 1921

27-07-16 18:04:25,101 com.apple.WebKit.WebContent[712]: <<<< MediaValidator >>>> mv_TestCodecSupportUsingDecoders: Unrecognized codec 1

27-07-16 18:04:25,125 com.apple.WebKit.WebContent[712]: <<<< MediaValidator >>>> mv_ValidateRFC4281CodecId: Unrecognized codec 1.(null). Failed codec specific check.

27-07-16 18:04:25,127 com.apple.WebKit.WebContent[712]: <<<< MediaValidator >>>> mv_LookupCodecSupport: Unrecognized codec 1

27-07-16 18:04:25,127 com.apple.WebKit.WebContent[712]: [18:04:25.127] mv_LowLevelCheckIfVideoPlayableUsingDecoder signalled err=-12956 (kFigMediaValidatorError_VideoCodecNotSupported) (video codec 1) at line 1921

27-07-16 18:04:25,128 com.apple.WebKit.WebContent[712]: <<<< MediaValidator >>>> mv_TestCodecSupportUsingDecoders: Unrecognized codec 1

27-07-16 18:04:25,332 WindowServer[170]: _CGXRemoveWindowFromWindowMovementGroup: window 0x3f8 is not attached to window 0x3f9

27-07-16 18:04:25,332 locationd[80]: NETWORK: requery, 0, 0, 0, 0, 1, items, fQueryRetries, 1, fLastRetryTimestamp, 491328179.2

27-07-16 18:04:33,069 Safari[259]: KeychainGetICDPStatus: keychain: -25300

27-07-16 18:04:33,069 Safari[259]: KeychainGetICDPStatus: status: off

27-07-16 18:04:54,792 locationd[80]: NETWORK: no response from server, reachability, 2, queryRetries, 1

27-07-16 18:04:56,752 Calendar[715]: This NSLayoutConstraint is being configured with a constant that exceeds internal limits. A smaller value will be substituted, but this problem should be fixed. Break on void _NSLayoutConstraintNumberExceedsLimit() to debug. This will be logged only once. This may break in the future.

27-07-16 18:05:00,020 lsd[235]: Unentitled request to set default handler for content type com.apple.ical.backup by pid 715

27-07-16 18:05:00,021 lsd[235]: Unentitled request to set default handler for content type dyn.age80w25brv4g83dt by pid 715

27-07-16 18:05:00,085 com.apple.WebKit.WebContent[712]: <<<< MediaValidator >>>> mv_ValidateRFC4281CodecId: Unrecognized codec 1.(null). Failed codec specific check.

27-07-16 18:05:00,085 com.apple.WebKit.WebContent[712]: <<<< MediaValidator >>>> mv_LookupCodecSupport: Unrecognized codec 1

27-07-16 18:05:00,085 com.apple.WebKit.WebContent[712]: [18:05:00.085] mv_LowLevelCheckIfVideoPlayableUsingDecoder signalled err=-12956 (kFigMediaValidatorError_VideoCodecNotSupported) (video codec 1) at line 1921

27-07-16 18:05:00,085 com.apple.WebKit.WebContent[712]: <<<< MediaValidator >>>> mv_TestCodecSupportUsingDecoders: Unrecognized codec 1

27-07-16 18:05:00,085 com.apple.WebKit.WebContent[712]: <<<< MediaValidator >>>> mv_ValidateRFC4281CodecId: Unrecognized codec 1.(null). Failed codec specific check.

27-07-16 18:05:00,085 com.apple.WebKit.WebContent[712]: <<<< MediaValidator >>>> mv_LookupCodecSupport: Unrecognized codec 1

27-07-16 18:05:00,085 com.apple.WebKit.WebContent[712]: [18:05:00.085] mv_LowLevelCheckIfVideoPlayableUsingDecoder signalled err=-12956 (kFigMediaValidatorError_VideoCodecNotSupported) (video codec 1) at line 1921

27-07-16 18:05:00,085 com.apple.WebKit.WebContent[712]: <<<< MediaValidator >>>> mv_TestCodecSupportUsingDecoders: Unrecognized codec 1

27-07-16 18:05:07,306 Safari[259]: KeychainGetICDPStatus: keychain: -25300

27-07-16 18:05:07,306 Safari[259]: KeychainGetICDPStatus: status: off

27-07-16 18:05:10,668 com.apple.WebKit.WebContent[718]: <<<< MediaValidator >>>> mv_ValidateRFC4281CodecId: Unrecognized codec 1.(null). Failed codec specific check.

27-07-16 18:05:10,668 com.apple.WebKit.WebContent[718]: <<<< MediaValidator >>>> mv_LookupCodecSupport: Unrecognized codec 1

27-07-16 18:05:10,671 com.apple.WebKit.WebContent[718]: [18:05:10.671] mv_LowLevelCheckIfVideoPlayableUsingDecoder signalled err=-12956 (kFigMediaValidatorError_VideoCodecNotSupported) (video codec 1) at line 1921

27-07-16 18:05:10,955 com.apple.WebKit.WebContent[718]: <<<< MediaValidator >>>> mv_TestCodecSupportUsingDecoders: Unrecognized codec 1

27-07-16 18:05:10,956 com.apple.WebKit.WebContent[718]: <<<< MediaValidator >>>> mv_ValidateRFC4281CodecId: Unrecognized codec 1.(null). Failed codec specific check.

27-07-16 18:05:10,956 com.apple.WebKit.WebContent[718]: <<<< MediaValidator >>>> mv_LookupCodecSupport: Unrecognized codec 1

27-07-16 18:05:10,956 com.apple.WebKit.WebContent[718]: [18:05:10.956] mv_LowLevelCheckIfVideoPlayableUsingDecoder signalled err=-12956 (kFigMediaValidatorError_VideoCodecNotSupported) (video codec 1) at line 1921

27-07-16 18:05:10,956 com.apple.WebKit.WebContent[718]: <<<< MediaValidator >>>> mv_TestCodecSupportUsingDecoders: Unrecognized codec 1

27-07-16 18:05:18,037 Safari[259]: KeychainGetICDPStatus: keychain: -25300

27-07-16 18:05:18,037 Safari[259]: KeychainGetICDPStatus: status: off

27-07-16 18:05:25,000 kernel[0]: process CalendarAgent[315] caught causing excessive wakeups. Observed wakeups rate (per sec): 1483; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 48512

27-07-16 18:05:25,145 com.apple.xpc.launchd[1]: (com.apple.ReportCrash[722]) Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.ReportCrash

27-07-16 18:05:25,146 ReportCrash[722]: Invoking spindump for pid=315 wakeups_rate=1483 duration=31 because of excessive wakeups

27-07-16 18:05:44,851 WindowServer[170]: _CGXRemoveWindowFromWindowMovementGroup: window 0x3f8 is not attached to window 0x3fa

27-07-16 18:05:51,555 WindowServer[170]: _CGXRemoveWindowFromWindowMovementGroup: window 0x3f8 is not attached to window 0x3fa

27-07-16 18:05:54,942 WindowServer[170]: _CGXRemoveWindowFromWindowMovementGroup: window 0x3f8 is not attached to window 0x3f9

27-07-16 18:06:05,259 CoreServicesUIAgent[290]: Error -60005 creating authorization

27-07-16 18:06:12,301 Safari[259]: KeychainGetICDPStatus: keychain: -25300

27-07-16 18:06:12,301 Safari[259]: KeychainGetICDPStatus: status: off

27-07-16 18:06:24,000 kernel[0]: ignored is_io_service_close(0x1000002f7,IOHIDParamUserClient)

27-07-16 18:07:08,000 bootlog[0]: BOOT_TIME 1469635628 0

27-07-16 18:07:10,000 syslogd[41]: Configuration Notice:

ASL Module "com.apple.AccountPolicyHelper" claims selected messages.

Those messages may not appear in standard system log files or in the ASL database.

Thanks for the suggestion of deleting cache files; I tried this on both machines

- on my MacBook Pro it seemed to work (though I wasn't using it for a week) - however, I've seen slowdowns from distnoted both today & yesterday, with a force-quit of distnoted (_distnoted user) just now leading to the classic bouncing around of processes in activity monitor. In both cases I had been using Skype some time previously (though I had quit it some time beforehand), though I've no idea if this was linked.

- on the Mac Mini it didn't prevent the problem. However I have a new attempted fix on this machine, which is to have it go to sleep for 10 minutes or so every night (using energy saver in system preferences; it is otherwise awake all the time). This has worked for the last few days. This machine often has two screens connected to it (one of which is a TV), and sometimes when it is frozen at log in I can fix it by unplugging the screen connection for 10 seconds. I therefore thought that sleeping it might help 'reset' the monitor situation each night.

I've just looked at my bug report of this issue, which was closed by Apple as a duplicate, and it says 'Duplicate of 25758237 (Open)' at the top - which presumably means that the bug has not been fixed yet?

Because my MB was brandnew, the problem must have been imported during restoring the TM backup from my previous computer. So I decided to do a clean install and a new install of the applications.

So far so good. no runaway CPU in the last 3 days.

For me on 10.11.6 (clean install on old MacMini Late 2012) its tied in with programs showing notifications or badges. Today I was at 300+% CPU when I started Outlook with 14 messages to read but once I closed Outlook (not a quick task) the process dropped way way down to less then 1.2%

Given I am not fussed by the icon I've disabled it in notification centre and will see if it pops back up.

Same problem since, I believe, updating to 10.11, on a late 2012 Mac Mini. Every 1-3 days, not consistently, it locks up, shows the beach ball, and prevents entering the password on the lock screen; sometimes doesn't even show the lock screen. Mac Mini is really quite hot to the touch. I have always updated Mac OS X promptly, and it is now at 10.11.6, and even did a full reinstall about a month ago.

I followed Linc's usually excellent advice to delete the cache directory referred to above, but that did not change anything.

At one point I was able to catch it just as CPU usage was rising, and found distnoted as the culprit. Taking the nuclear option, killing it without consideration every 2 minutes, has completely solved my problem. It has been something over two weeks since I took that step, and my Mac Mini is running perfectly.

To take this step you have to become the root user, issue the command crontab -e, and enter a single line into the edit window:

*/2 * * * * /usr/sbin/killall distnoted

Copy and paste the above line; spaces are crucial and may or may not appear obvious depending on the font you're reading with.

Save the file and exit.

BTW, in the same household we have a 2009 Mac Mini, a 2011 MacBook Pro, and a 2015 MacBook Air all running 10.11.6, and none have, or have had, this problem.

FYI, I updated my 2 machines (Mac Mini & MacBook Pro) that had distnoted problems to MacOS Sierra GM a couple of weeks ago, and there has been no sign of any distnoted problems since. Fingers crossed that it has now been fixed by Apple.

Hey Michael,

I've been having this problem too on my 13" MBA running 10.11.6. I have tried all of the suggestions in this thread with no success. Is the upgrade to OS Sierra still helping? I may give that a go, since it sounds like things are going well for you after having done it.

I mentioned that this issue was resolved with macOS Sierra quite some time ago. But since that was during the public beta period Apple deleted my comments from this thread (and others outlining the same issue). But now that macOS Sierra has been officially released I can confirm that that DISTNOTED issue has been resolved.

Yes, it seems to have done the job on both.

On the Mac Mini there is something strange going on with a similar sounding process - AlertsDaemon - but this is part of MacOS Server, so shouldn't be an issue if you aren't using that.

I have a problem : every 2 or 3 or 4 days my computer (el capitan) is blocked with in the Activity Monitor distend 225,3%, sysmond 97,4% etc… If I see the console, i see a lot of :

screensharingd[41201] Authentication: FAILED :: User Name: N/A :: Viewer Address: 222.186.56.199 :: Type: VNC DES

etc...

I force to quit distend and it was OK to continue to work on my computer.

But I don't want the same thing will come again.

What I must do ?

I need always Screen Sharing, because I work sometimes from my home to my office.

Thanks.