dfbills.com blog

This command will help you find which app is preventing a disk from ejecting.

lsof | grep YourDriveName

Since I’m on a bit of a performance tuning hunt this week, I decided to find out why my hard drive was grinding away this morning.  (With a load average of 2.6)

Turns out, it was my old friend build_hd_index.  This horrible little app is part of Apple Remote Desktop.  It is designed to index the hard drive at a default time of midnight on all systems that are managed by Remote Desktop. Seems innocuous enough- that is until you hear it churning away late at night on several computers.

So now we have Spotlight, locate, Time Machine and build_hd_index indexes of the hard drive and they all grind away at all hours of the day and night.  The unfortunate thing is that only Spotlight is away of the “special” status of Time Machine’s Backups.backupdb database.  All the others just thrash away.

So without further ado- here’s how to disable build_hd_index:

sudo chmod a-x /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Support/build_hd_index

Keep your friends close and your enemies even closer.

update: A few people have written me to say that turning off the “generate reports” option in the Sharing/Remote Management panel will keep this from happening but this seems to have no effect on my system.

update 2: A better fix: manually reset the data collection policy by removing the file com.apple.ARDAgent.plist file in /Library/Preferences as Apple recommends.  (This does not seem to always do the trick)

sudo rm /Library/Preferences/com.apple.ARDAgent.plist

update 3: laptopleon pointed out that nulling the privileges can break macosx server system updates.  I’ve updated the chmod command to simply remove execute privs.

update 4: Apple has posted a Knowledge Base article: “Apple Remote Desktop: How to disable build_hd_index.”  Not sure that this is a definitive solution.

Ever wonder what is spotlight working on right now?  This command will query the filesystem for you.

lsof | grep mdworker

I was having problems with Spotlight on Leopard 10.5.1.  My computer was dog-slow and just plain unresponsive.  Spotlight search results were inconsistent and I was noticing that my drive was being re-indexed quite regularly (as evidenced by the spotlight menu item and the concealed progress bar).

My first troubleshooting step was to fire up Spotless to delete the indexes and allow them to rebuild.  Unfortunately, 24 hours later the indexing was still going.  My index kept stalling at around 127MB.

I used the following code to check it.

sudo du -h /.Spotlight-V100/

After watching it for about and hour, I decided to upgrade to a self-running version with Growl notifications.

while :
do
clear
sudo du -h /.Spotlight-V100/ | /usr/local/bin/growlnotify
echo “growled” & date “+%H:%M:%S%n”
sleep 90
done

Some searching revealed that quite a number of people had experienced this problem at the release of 10.5.1.  My standard tracing solution didn’t tell me too much.

lsof | grep mdworker

But, anther user explained how to use the dtrace system utility to examine the mdworker process.  On my system it was using 90-100% processor time.

sudo dtrace -n ‘syscall::open*:entry /execname == “mdworker” | execname == “mds”/ { printf("%Y %u %s %s",walltimestamp,pid,execname,copyinstr(arg0)); }’

This led me to examine the console and sure enough, the mdworker was crashing every 3 secs on a particular file and writing a crashlog.

Jan 30 23:55:07 Macintosh ReportCrash2692: Formulating crash report for process mds2686
Jan 30 23:55:07 Macintosh com.apple.launchd[1] (0x10c830.mdworker2687): Exited: Terminated
Jan 30 23:55:07 Macintosh com.apple.launchd[1] (0x10c9f0.mdworker2690): Exited: Terminated
Jan 30 23:55:07 Macintosh com.apple.launchd[1] (0x10cbb0.mdworker2691): Exited: Terminated
Jan 30 23:55:07 Macintosh com.apple.launchd[1] (com.apple.metadata.mds2686): Exited abnormally: Segmentation fault
Jan 30 23:55:07 Macintosh mds2695: (/.Spotlight-V100/Store-V1/Stores/9A285684-2061-4212-B186-56B95ACE8BD7)(Error) IndexCI in ContentIndexOpenBulk:No index
Jan 30 23:55:07 Macintosh ReportCrash2692: Saved crashreport to /Library/Logs/CrashReporter/mds_2007-11-12-235505_Macintosh.crash using uid: 0 gid: 0, euid: 0 egid: 0

After poking about for a while I settled on the same solution as many others- an OS reinstall.  Archive & Install worked fine and the entire process, including software updates, took about 90 minutes.

Fixed.

To activate QuickLook plugins without a logout or reboot, simply reset QuickLook at the command line.

qlmanage -r

To see realtime filesystem usage in MacOSX:

fs_usage

Also useful for checking what exactly an app is doing:

fs_usage -w -f filesys | grep AppName

To list all open network connections:

sudo lsof -i | grep LISTEN

To find non-apple kernel extensions:

kextstat | grep -v apple

To flush DNS cache

Tiger:

sudo lookupd -flushcache

Leopard:

dscacheutil -flushcache

I found this great technote and linked documentation on Apple’s site: “Mac OS X 10.5: Terminal command changes in Leopard.”  It all has to do with UNIX 03 conformance.

UNIX 03 Conformance Release Notes

General Command-Line Tool Differences

Now I know why this doesn’t work..

ps -auxww

The replacement would be:

ps -el

More notes as I have time to dive in.