Spotlight's CPU usage is out of control for no reason

Question

Level 1

4 points

Spotlight's CPU usage is out of control for no reason

I'm finding more and more Macs running 10.11.4 where Spotlight is just out of control for no reason that I can discern.

If no one is logged in, Spotlight is using no CPU.

As soon as someone logs in, Spotlight takes over as the number one CPU usage process. It's currently at 166.4% (of multiple cores).

It doesn't matter if I disable mdutil and kill Spotlight... Spotlight comes back and eats CPU.

Reboots don't matter.

10.11.4 Combo reinstall didn't help.

Clearing out Caches didn't help. /System, /Library, and /Users.

Create a brand new user and login, Spotlight jumps to the top spot.

Safe boot, Spotlight jumps to the top.

Network cable out, no difference.

First-Aid was clean when booted from the Recovery Partition.

What the heck is going on here?

OS X El Capitan (10.11.4)

Posted on May 5, 2016 7:51 AM

Reply

Answer 1

Best reply

Luis Sequeira1

Level 9

64,298 points

May 5, 2016 8:22 AM in response to UberJac

Two things come to mind:

1) Reboot in Safe Mode, then normally again

2) Force Spotlight to reindex

Reply

Answer 2

UberJac Author

Level 1

4 points

May 5, 2016 8:30 AM in response to Luis Sequeira1

Unfortunately didn't help.

I just checked a laptop I imaged yesterday and it also has an out of control Spotlight for no apparent reason. So it's back to the drawing board with Vanilla OS installs and working backwards until I can figure out just what is going on here.

Reply

Answer 3

May 5, 2016 8:35 AM in response to UberJac

If you are imaging all these macs from a common source it is natural that they share the same problem.

You could run Etrecheck on one of these macs and post its report. Often these suggest possible causes of conflict.

I expect that a plain vanilla installation will not have the issue. You could go incrementally from there, but by looking at the Etrecheck report often a suspect pops up.

Reply

Answer 4

Linc Davis

Level 10

209,535 points

May 5, 2016 8:56 AM in response to UberJac

This is a diagnostic procedure. It makes no changes and therefore will not, in itself, solve the problem.

Step 1

These instructions must be carried out as an administrator. If you have only one user account, you are the administrator.

Please triple-click anywhere in the line below on this page to select it:

Copy the selected text to the Clipboard by pressing the key combination command-C.

Launch the built-in Terminal application in any one of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad and start typing the name.

Paste into the Terminal window by pressing the key combination command-V. I've tested these instructions only with the Safari web browser. If you use another browser, you may have to press the return key after pasting.

The command may take a noticeable amount of time to run. Wait for a new line ending in a dollar sign ($) to appear.

The output of the command will be automatically copied to the Clipboard. If the command produced no output, the Clipboard will be empty. Paste into a reply to this message.

The Terminal window doesn't show the output. Please don't copy anything from there.

If any personal information appears in the output, anonymize before posting, but don’t remove the context.

Step 2

Enter the following command as in Step 1 and post the output:

mdutil -as 2>&- | pbcopy

You can then quit Terminal.

Step 3

Launch the Console application in the same way you launched Terminal. In the Console window, look under the heading DIAGNOSTIC AND USAGE INFORMATION on the left for crash reports related to Spotlight. If you don't see that heading, select

View ▹ Show Log List

from the menu bar. A Spotlight crash report has a name beginning in "mds," "mdworker," or "mdwrite," and ending in ".crash". Select the most recent such report, if any, from the System and User subcategories and post the entire contents—the text, please, not a screenshot. In the interest of privacy, I suggest that, before posting, you edit out the “Anonymous UUID,” a long string of letters, numbers, and dashes in the header of the report, if it’s present (it may not be.)

Please don’t post any other kind of diagnostic report, such as hang logs—they're very long and not helpful.

When you post the results, you might see an error message on the web page: "You have included content in your post that is not permitted," or "The message contains invalid characters." That's a bug in the forum software. Please post the text on Pastebin, then post a link here to the page you created.

If you have an account on Pastebin, please don't select Private from the Paste Exposure menu on the page, because then no one but you will be able to see it.

Reply

Answer 5

UberJac Author

Level 1

4 points

May 5, 2016 9:25 AM in response to Linc Davis

Thanks for the help. It's definitely something inherent in my image, but it's not clear what since there's nothing that I do that messes with or changes mds or Spotlight.

Step 1:

(ImportBailout.Error:1331) Asked to exit for Diskarb

(Server.Warning:445) No stores registered for metascope "kMDQueryScopeComputer"

CGSConnectionByID: 0 is not a valid connection ID.

IORegisterForSystemPower failed

In -[NSApplication(NSQuietSafeQuit) _updateCanQuitQuietlyAndSafely], _LSSetApplicationInformationItem(NSCanQuitQuietlyAndSafely) returned error -50

Invalid Connection ID 0

mdworker(823) deny mach-lookup com.apple.nsurlstorage-cache (import fstype:hfs fsflag:480D000 flags:40000005E diag:0 isXCode:0 uti:public.html plugin:/Library/Spotlight/RichText.mdimporter - find suspect file using: sudo mdutil -t 110589)

Step 2:

/:

Indexing enabled.

Step 3:

There are no crashlogs for Spotlight or md*... only cpu_resource & wakeups_resource .diag logs. From the system.log, for amusement:

kernel[0]: process Spotlight[1564] thread 8920 caught burning CPU! It used more than 50% CPU (Actual recent usage: 77%) over 180 seconds. thread lifetime cpu usage 95.885739 seconds, (17.483877 user, 78.401862 system) ledger info: balance: 90034014244 credit: 90034014244 debit: 0 limit: 90000000000 (50%) period: 180000000000 time since last refill (ns): 116259631597

Reply

Answer 6

Linc Davis

Level 10

209,535 points

May 5, 2016 9:38 AM in response to UberJac

The Spotlight index may be corrupt.

Please back up all data before proceeding.

Triple-click anywhere in the line below on this page to select it:

/.Spotlight-V100

Right-click or control-click the highlighted line and select

Services ▹ Open

from the contextual menu. A folder should open with a subfolder named ".Spotlight-V100" selected. Move the subfolder to the Trash. You may be prompted for your administrator login password.

Restart the computer. If you try to search now from the magnifying-glass icon in the top right corner of the display, there should be an indication that indexing is in progress.

You can't see the folder in the Trash because it's invisible. The next time you empty the Trash, it should be deleted.

Reply

Answer 7

UberJac Author

Level 1

4 points

May 5, 2016 9:55 AM in response to Linc Davis

It is indeed indexing, and the Spotlight CPU usage is exceptionally high, presumably based on indexing. Only 24GB on here so it won't take long. And it's done. And Spotlight is still #1 @ 170%

Reply

Answer 8

May 5, 2016 9:59 AM in response to UberJac

UberJac wrote:

It is indeed indexing, and the Spotlight CPU usage is exceptionally high, presumably based on indexing. Only 24GB on here so it won't take long. And it's done. And Spotlight is still #1 @ 170%

There must be some software that is conflicting with the normal operation of Spotlight.

That Etrecheck report will probably help!

Reply

Answer 9

UberJac Author

Level 1

4 points

May 5, 2016 10:02 AM in response to Luis Sequeira1

I did try it and unfortunately there were no indications.

Reply

Answer 10

May 5, 2016 10:06 AM in response to UberJac

Do you have any form of antivirus or "cleaner" in these images?

Reply

Answer 11

UberJac Author

Level 1

4 points

May 5, 2016 10:15 AM in response to Luis Sequeira1

Yes, SCEP. Installed after the actual imaging. However, I have devices that have SCEP that aren't exhibiting this behavior. Disabling the Real Time Scanning also hasn't change the behavior either. Uninstalling SCEP, rebooting, no difference. Spotlight CPU usage is still ridiculous.

Reply

Answer 12

Linc Davis

Level 10

209,535 points

May 5, 2016 10:24 AM in response to UberJac

Spotlight may be choking on a corrupt file. Please enter the following command as before and post the output:

sudo mdutil -t 110589 | pbcopy

You'll be prompted for your login password. Nothing will be displayed when you type it. Type carefully and then press return. If you don’t have a login password, you’ll need to set one before you can run the command.

You may get a one-time warning to be careful. Confirm. You don't need to post the warning.

If you see a message that your username "is not in the sudoers file," then you're not logged in as an administrator. Log in as one and start over.

Reply

Answer 13

UberJac Author

Level 1

4 points

May 5, 2016 11:15 AM in response to Linc Davis

It's something related to Casper enrollment. Not sure what yet. Vanilla device no issues. Enrolled, no problems. Reboot. Problems. Remove framework and reboot. No problems.

EDIT:

And the result was "Unable to resolve path", which presumably means everything is coolish since that file id isn't found.

Reply

Answer 14

Linc Davis

Level 10

209,535 points

May 5, 2016 11:18 AM in response to UberJac

Please post the output:

ls -@BOaen / | pbcopy

Reply

Answer 15

UberJac Author

Level 1

4 points

May 5, 2016 11:37 AM in response to Linc Davis

So, correction, the previous output request you asked for was tried on the test Mac with no Casper client. I reinstalled the Casper client on the test device and tried a logout & login instead and that caused the Spotlight process to jump to 167% CPU usage. So, now the first output request on the test device that exhibits the problem: Unable to resolve path

So same output. Now for the next command:

total 45

drwxr-xr-x 28 0 0 - 1020 May 5 10:54 .

drwxr-xr-x 28 0 0 - 1020 May 5 10:54 ..

-rw-rw-r-- 1 0 80 - 0 Feb 11 18:12 .DS_Store

drwx------ 5 0 80 - 170 May 5 10:05 .Spotlight-V100

d-wx-wx-wt 2 0 20 hidden 68 May 5 10:06 .Trashes

---------- 1 0 80 - 0 Feb 11 18:12 .file

drwx------ 8 0 80 - 272 May 5 11:05 .fseventsd

drwxr-xr-x@ 2 0 0 hidden 68 May 5 10:42 .vol

com.apple.FinderInfo 32

drwxrwxr-x+ 37 0 80 sunlnk 1258 May 5 11:20 Applications

0: ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000000C deny delete

drwxr-xr-x+ 61 0 0 sunlnk 2074 May 5 11:01 Library

0: ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000000C deny delete

drwxr-xr-x@ 2 0 0 hidden 68 May 5 10:42 Network

com.apple.FinderInfo 32

drwxr-xr-x@ 4 0 0 restricted 136 May 5 10:39 System

com.apple.rootless 0

0: ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000000C deny delete

drwxr-xr-x 5 0 80 - 170 May 5 10:42 Users

drwxrwxrwt@ 3 0 80 hidden 102 May 5 11:20 Volumes

com.apple.FinderInfo 32

0: ABCDEFAB-CDEF-ABCD-EFAB-CDEF0000000C deny add_file,add_subdirectory,directory_inherit,only_inherit

drwxr-xr-x@ 39 0 0 restricted,hidden 1326 Mar 12 00:08 bin

com.apple.FinderInfo 32

com.apple.rootless 0

drwxrwxr-t@ 2 0 80 hidden 68 May 5 10:42 cores

com.apple.FinderInfo 32

dr-xr-xr-x 3 0 0 hidden 4267 May 5 11:05 dev

lrwxr-xr-x@ 1 0 0 restricted,hidden 11 May 5 10:41 etc -> private/etc

com.apple.FinderInfo 32

com.apple.rootless 0

dr-xr-xr-x 2 0 0 hidden 1 May 5 11:05 home

-rw-r--r--@ 1 0 0 hidden 313 Aug 2 2015 installer.failurerequests

com.apple.FinderInfo 32

dr-xr-xr-x 2 0 0 hidden 1 May 5 11:05 net

drwxr-xr-x@ 6 0 0 sunlnk,hidden 204 May 5 10:42 private

com.apple.FinderInfo 32

drwxr-xr-x@ 59 0 0 restricted,hidden 2006 May 5 10:41 sbin

com.apple.FinderInfo 32

com.apple.rootless 0

lrwxr-xr-x@ 1 0 0 restricted,hidden 11 May 5 10:41 tmp -> private/tmp

com.apple.FinderInfo 32

com.apple.rootless 0

drwxr-xr-x@ 12 0 0 restricted,hidden 408 May 5 11:01 usr

com.apple.FinderInfo 32

com.apple.rootless 0

lrwxr-xr-x@ 1 0 0 restricted,hidden 11 May 5 10:41 var -> private/var

com.apple.FinderInfo 32

com.apple.rootless 0

Sadly I don't see anything out of the ordinary there.

So, clearly it's related to the Casper client. But since I have a ton of devices that have the same client but don't have the issue, is it related to a fresh install of the current client we're using on a new/imaged device versus a device that had an older client and was upgraded to the current client via Casper? Is it something in MDM? Seems unlikely since again, existing devices have the same MDM but not the problem... though... the Mac I've referencing as my "control", I've not restarted it or logged out/in for about a week. So must do that before I continue... And the control Mac is still cool. No Spotlight madness. Guess I'm going to have to dig in a bit deeper here.

Thanks to both of you for all your help and suggestions thus far!

Reply