Beachballs constantly, usually only minutes after restart/reboot

[jdouge]

Mid-2011 21" iMac running OSX 10.8.5. 1TB HD, using 160GB. 16GB memory. Intel i5 2.5 GHz CPU. I have read the stickies and followed their advice. Searched and found some past relevant threads and followed their advice (although without a solution). Hopefully I've followed due process.

Beachballs constantly, usually only minutes after restart/reboot.

Just before the beachball appears, the mouse pointer can still be moved and the clock in the menubar will still tick but I click on apps in the Dock and they do not open and click on open apps but cannot switch windows to them. Incipit beachball.

Observations I have made:

I have tried to watch the Activity Monitor closely. It sometimes shows that when opening an app or a new tab in Firefox or Chrome, CPU use sometimes exceeds 100%. These instances -- at least the ones I have observed -- do not precede crashes.

I cannot detect any pattern indicating that any particular app opening/usage has an effect on crashing. In fact, if I simply log on and open nothing (including with no login items loaded) the beachball will inevitably appear.

I have watched the Activity Monitor's memory usage and page ins/outs right up until crash time and nothing seems to hog memory or generate many ins/outs. (Oddly, "VM Size" generally bounces between 250-300GB -- how could I have that much virtual memory?)

No new apps installed in the last several weeks.

Troubleshooting steps I have pursued:

I have updated OSX and every app downloaded through the App Store. I have also updated every other app I can find an update for.

I have reset the PRAM and VRAM and SMC.

I have run the AHT full/extended test without errors. This would suggest that the issue is not hardware.

Full boot without peripherals connected still crashes. This would suggest that the issue is not peripherals.

Safe boot avoids crashes if it is a full safe boot, but if I safe boot only to exclude login items it still crashes. This would suggest a kernel extension or font issue.
I have therefore run the font book check for errors utility, but without any error result.
(Interestingly, safe boot at startup wires 14GB of memory in Activity Monitor. System acts sluggish. Is that how it's supposed to work?)

Logging on as a Guest User or with a dummy account still results in a crash. This suggests that the issue is not a login item or a non-Apple app or a corrupt preference pane.

I have used Console to try to identify any consistent, particular use/access/error message/activity around crash times and cannot detect any particular pattern that precedes the beachball. I'm not an expert at interpreting the logs/reports but there doesn't seem to be any pattern/correlation to any particular app or system action or anything.

I have verified the HD using Disk Utility (in Safe Mode) several times. I have also cmd-S booted the HD and run fsck -y tests of the HD that have not revealed errors. I also rebooted with cmd-R to run Disk Utility and it repeatedly finds no errors on the HD.

I have verified and repaired permissions several times. There are 21 permissions which will not repair (i.e., show up as errors when verifying even after having attempted to repair them). Most are iTunes issues, 6 are Safari (which I never use), one is a JAVA issue (which is disabled), and one is a ARDAgent reference (I don't know what this is).

Perhaps important information:

I did have the HD replaced about a month ago with no issues up to this point. I also have had weird, very brief screen white flashes in the evenings for months. I had the repair techs run a test on the video card and display when the HD was replaced and that returned no error message. But the "flashes" continued. They do not correlate in any detectable way with the beachball.

The Bootcamp partition of the HD functions flawlessly (including no screen flashes), suggesting that the issue is OS X based rather than hardware.

Strangely, the beachball seemed originally to prefer to appear later in the day. I could often work until late morning or early afternoon without issues. Late at night, the beachball appears within 5 minutes of reboot.
I have disabled the functions and apps that specifically come into play later in the day (f.lux and OSX's native adjust brightness option) to no effect. Still beachballs, and the time of day is increasingly irrelevant.

Any next steps? I have full backups in the cloud (Crashplan) and on my external HD (Time Machine). I am concerned that restoring from Time Machine or Crashplan will restore a system corrupted by whatever has my current system bogged down and on its way to the same issues.

Thanks a bunch for any help/suggestions.

 

[keysofanxiety]

Try restarting with the option 'Reopen windows when logging back in' disabled.

Also run a volume verification through Disk Utility. If there are any errors (red writing), that could be causing the issue.

Might as well check the HDD SMART data, even though it's been replaced recently. For the minimum effort it's worth the peace of mind. I use SMART Utility (http://cloudfront.volitans-software.com/smartutility314.zip)

The high VM size indicates that the RAM usage is extremely high, and the system is paging to the HDD as virtual memory. Due to the slow access speeds & read/write speeds of a conventional HDD, this will cripple the machine's performance. That's why restarting with 'reopen windows' disabled will ensure that any background processes/memory leaks won't reopen when next restarting your computer.

Please quote this once you've had an opportunity to try the above troubleshooting steps, and we'll go from there.

 

[satcomer]

Also run the free application EtreCheck and use it. It will print out a report of all the incompatible kexts and launchd files that will show you a path to those files do you can MANUALLY delete them, then reboot. After this you Mac should run faster.

 

[rhett7660]

Do you have any cloud options at start up such as Dropbox, Box, etc?

 

[jdouge]

Try restarting with the option 'Reopen windows when logging back in' disabled.

I do this every time I have to reboot after a crash . . . and still get a crash within a few minutes of restarting.

Interestingly, I tried restarting back to my login screen and waiting to log in. Within 10 minutes I got a beachball and a crash. That would suggest that login items are not the issue.

Also run a volume verification through Disk Utility. If there are any errors (red writing), that could be causing the issue.

I have verified the startup disk from normal, safe, and recovery mode. Could not figure out how to verify a volume rather than a disk? I tried to verify the whole HD (Mac and Bootcamp) but Disk Utility has that option greyed out.

Might as well check the HDD SMART data, even though it's been replaced recently. For the minimum effort it's worth the peace of mind. I use SMART Utility (http://cloudfront.volitans-software.com/smartutility314.zip)

I tried the SMART utility as a trial version. My HD passed. It also returns a "verified" SMART status in Disk Utility, if that has any significance.

The high VM size indicates that the RAM usage is extremely high, and the system is paging to the HDD as virtual memory. Due to the slow access speeds & read/write speeds of a conventional HDD, this will cripple the machine's performance. That's why restarting with 'reopen windows' disabled will ensure that any background processes/memory leaks won't reopen when next restarting your computer.

The VM usage is still huge, 200GB+ even in safe mode with no apps open. I do have 16GB memory and a 1TB HD that is 16% full. I don't think my VM should be that high based on that system information, but it is, consistently. Something is definitely wrong here.

Please quote this once you've had an opportunity to try the above troubleshooting steps, and we'll go from there.

Done! Thanks for your feedback. Ready for the next round!

----------

Also run the free application EtreCheck and use it. It will print out a report of all the incompatible kexts and launchd files that will show you a path to those files do you can MANUALLY delete them, then reboot. After this you Mac should run faster.

Thanks for the suggestion! I ran it once . . . and the machine crashed before the scan was over. Next time through I got a five page report that I can post if it's helpful.

What I can see from the scan:

Only one failure: [failed] org.gpgtools.gpgmail.enable-bundles.plist [Click for support]

Three with this designation:
[not loaded] com.maintain.PurgeInactiveMemory.plist [Click for support]
[not loaded] com.maintain.Restart.plist [Click for support]
[not loaded] com.maintain.ShutDown.plist [Click for support]

Every other entry was loaded/running and/or without an error code.

Should I go find these entries and delete them?

Thanks.

 

[jdouge]

Do you have any cloud options at start up such as Dropbox, Box, etc?

Yes: Crashplan and Dropbox. I unchecked them in User Accounts/Login Items (and confirmed their unchecked status on the next reboot), but they continue to start up in the menu bar and their processes still show up in the Activity Monitor.

Given that I may have to reinstall/recover my system I am reluctant to be more aggressive in killing off these processes. But it is suspicious that they persist despite my attempt to (at the very least) deny them login status!

I should note that when I login on a guest account, without these login items (I think), I still crash. But Crashplan does go a bit nuts with CPU usage in Activity Monitor.

How could I pursue this further?

Thanks for the response!

 

[keysofanxiety]

I do this every time I have to reboot after a crash . . . and still get a crash within a few minutes of restarting.

Interestingly, I tried restarting back to my login screen and waiting to log in. Within 10 minutes I got a beachball and a crash. That would suggest that login items are not the issue.

I have verified the startup disk from normal, safe, and recovery mode. Could not figure out how to verify a volume rather than a disk? I tried to verify the whole HD (Mac and Bootcamp) but Disk Utility has that option greyed out.

Good morning Jdouge,

In Activity Monitor, the 'Virtual Memory' is more to do with the space on your hard-drive. This just shows how much GB can be available if need be. When OS X runs out of RAM, it'll write to the hard-drive as virtual memory. This is shown as 'Swap used'.

So basically the two things you need to be concerned about in Activity Monitor will be Memory Pressure or Swap Used -- don't worry about 'Virtual Memory' as that does not indicate how much memory is being used.



You can't verify the hard-drive itself, just individual volumes. The volumes are normally indented, and the default name is normally 'Macintosh HD'. Once you've highlighed that, click 'Verify Disk'. If it either shows green writing or no writing at all, that means it's OK. If it shows any red writing then it needs to be repaired.

EDIT: It may also be best to try a Permissions Repair (not verify, just repair). The repair will verify the permissions befor repairing so it's just a waste of time to run the verification first.



The next thing to do would be to test your RAM. You can download Memtest for OS X here: http://static.command-tab.com/2008/memtest_422.zip

Once that's installed, turn off your Mac. As soon as you turn it back on, press and hold the Cmd+S button. This will boot into Single User Mode.

Then type memtest all 10 when you're in Single User mode. This will do 10 passes on the RAM. It may take some time so it's best to leave it running overnight. If there are any errors indicated in memtest, you know the RAM's faulty.

EDIT: Further to the above, you can also try reinstall the system components. Basically this will leave all of your data/applications untouched, but will reinstall the operating system components/kext files and all that stuff.

To do this:

1) Turn off your Mac
2) Hold Cmd+R on startup to boot into OS X Utilities
3) Select the option 'Reinstall OS X'
4) Select your partition
5) Install
6) Any better?

Again this will not delete any of your documents, data or applications -- it will just reinstall the core operating system components.

 

[keysofanxiety]

Further to the above I realised you're on Mountain Lion, so your Activity Monitor is likely to look different.

After you've tried verifying the volume and going through the other steps (Memtest probably isn't necessary at this point), it may be best to update to Yosemite. It utilises compressed memory and most people will agree that it runs much quicker than Mountain Lion.

I'm hoping that an OS update may well resolve the concerns you're having -- if the volume is OK and the HDD is OK, I'd definitely recommend it's worth trying.

 

[rhett7660]

Yes: Crashplan and Dropbox. I unchecked them in User Accounts/Login Items (and confirmed their unchecked status on the next reboot), but they continue to start up in the menu bar and their processes still show up in the Activity Monitor.

Given that I may have to reinstall/recover my system I am reluctant to be more aggressive in killing off these processes. But it is suspicious that they persist despite my attempt to (at the very least) deny them login status!

I should note that when I login on a guest account, without these login items (I think), I still crash. But Crashplan does go a bit nuts with CPU usage in Activity Monitor.

How could I pursue this further?

Thanks for the response!

I use Dropbox and had to quite it on start up. I was getting the same thing which is why I asked.

I have to manually start up Dropbox, which isn't a big deal, but I have found since I did do this, I have had zero beach balls at start up.

 

[jdouge]

Thanks for the responses! I have made it most of the way through the list of recommendations over the last two days.

One thing I should have made more clear: when I get the beachball, it is not temporary. It freezes the whole system. It usually happens between three and five minutes after boot, but can take longer. Programs stop running, then i can only move and click the pointer, and soon the beachball appears, locks in place, and I can't do anything but reboot.

So basically the two things you need to be concerned about in Activity Monitor will be Memory Pressure or Swap Used -- don't worry about 'Virtual Memory' as that does not indicate how much memory is being used.

I do have Mountain Lion, so I have "Free RAM" listed in my activity monitor to measure memory use. I have 16GB, and if I just boot my system and wait, the beachball will kick in while I'm sitting at a static 12-13GB of free RAM.

Instead of swaps, I have page ins and outs. I will get 2-300MBs of page ins and no page outs during that time. Do either of these observations suggest problems?

You can't verify the hard-drive itself, just individual volumes. The volumes are normally indented, and the default name is normally 'Macintosh HD'. Once you've highlighed that, click 'Verify Disk'. If it either shows green writing or no writing at all, that means it's OK. If it shows any red writing then it needs to be repaired.

I have verified the Macintosh HD volume several times now (and I think it also does a verify every time I safe boot) without errors. I can't verify my Bootcamp partition from OS X, though. I will try using Windows to do that tonight (although Bootcamp, my new and hopefully temporary home, runs fine).

EDIT: It may also be best to try a Permissions Repair (not verify, just repair). The repair will verify the permissions befor repairing so it's just a waste of time to run the verification first.

I have repaired permissions several times and there are several (20+) that claim to "repair" every time I run it (suggesting that they aren't being repaired). There are 4 related to Safari (which I almost never use), one related to soething called the ARDAgent, and 20 or so related to iTunes. Not sure what it means that they are always there -- each time I run the repair, Disk Utility claims that they were repaired, but if I run the utility again one minute later, the same permissions come up as needing repair. Is there anything else that I can do about that? And are they potential system crashers?

The next thing to do would be to test your RAM. You can download Memtest for OS X here: http://static.command-tab.com/2008/memtest_422.zip

Once that's installed, turn off your Mac. As soon as you turn it back on, press and hold the Cmd+S button. This will boot into Single User Mode.

Then type memtest all 10 when you're in Single User mode. This will do 10 passes on the RAM. It may take some time so it's best to leave it running overnight. If there are any errors indicated in memtest, you know the RAM's faulty.

I ran memtest without errors.

I use Dropbox and had to quite it on start up. I was getting the same thing which is why I asked.

I have to manually start up Dropbox, which isn't a big deal, but I have found since I did do this, I have had zero beach balls at start up.

I killed Dropbox and Crashplan as login items (I think those are my only cloud-based startups) and still eventually beachball and crash. It seems like maybe it takes a little longer to reach that point with them disabled, but I;m not really sure (haven't stopwatched the crash times or anything).

I am holding off on the next two steps (reinstalling system components and upgrading to Yosemite) to see if anything up there looks like a red flag. Anyone?

Thanks for all the clearly presented suggestions so far!

 

[keysofanxiety]

Thanks for the responses! I have made it most of the way through the list of recommendations over the last two days.

One thing I should have made more clear: when I get the beachball, it is not temporary. It freezes the whole system. It usually happens between three and five minutes after boot, but can take longer. Programs stop running, then i can only move and click the pointer, and soon the beachball appears, locks in place, and I can't do anything but reboot.

Hi there Jdouge, from what you've described and from what we've tried, I believe the issue is either software related (OS issue/memory leak), or at an absolute push, potentially hardware related (Logic Board or HDD cable). However as it works flawlessly on Bootcamp I doubt it's hardware.

All in all though I think this is an OS issue. Does Activity Monitor show any specifc application using up lots of RAM?

I really do hate to suggest wiping & reinstalling, though I think on this occasion it's all that's left to try. If you have an external HDD it'll be best to use that as a Time Machine backup. At least that way it backs up your entire hard-drive so you can restore directly from TM backup. Of course that's dependant on how much stuff you have, and whether the beachballing will even let you run a backup ...

I suppose the OS repair through the recovery partition (without wiping) would be more convenient to try, as you won't lose any documents or data. It shouldn't take more than an hour, depending on the speed of your Internet connection. Just to quickly outline how that's done:

- Shut down Mac
- As soon as you turn it back on, hold Cmd+R
- Select language (where applicable)
- When you're in OS X Utilites, select the option 'Reinstall OS X'
- Reinstall OS X to your Macintosh HD drive

Again this definitely won't wipe any of your applications or documents/data, rather it will just repair/reinstall the OS bits.

If there's still a problem after this, I'd recommend possibly try installing a fresh copy of Yosemite ...

I'm so sorry it'll have to come to this, I absolutely hate recommending wiping & reinstalling, though there's nothing else I can think of to try from here. Hopefully some other people will have some other suggestions.

I suppose if you have OS X installed on a Firewire/Thunderbolt drive, you can try boot into that (hold Alt on startup) to verify that the same issues don't happen on a different volume.

Please keep me updated, I really do hope the OS repair will fix the issue so it doesn't have to come to wiping/reinstalling.

 

[Fishrrman]

OP:

I'd like to offer a suggestion, which I believe almost everyone in the forum will VEHEMENTLY disagree with, but I'm going to offer it anyway:

I recommend that you DISABLE virtual memory for a little while, to see if that makes a difference.

To DISABLE VM, try this in Terminal:
sudo launchctl unload -wF /System/Library/LaunchDaemons/com.apple.dynamic_pager.plist

To REMOVE swap files:
rm /var/vm/swapfile*

To RE-ENABLE virtual memory:
sudo launchctl load -wF /System/Library/LaunchDaemons/com.apple.dynamic_pager.plist

With VM disabled, use Activity Monitor to check page outs and page ins.
Should calm this down quite a bit.

Of course, there is always the danger of crashing when running with VM disabled.
You will have to "monitor yourself" insofar as not opening too many apps at once.

Again, others will say not to do this, but it might be worth a try for a day or two of usage, to see if it changes anything.
You can always re-enable VM and go on from there...

 

[keysofanxiety]

OP:

I'd like to offer a suggestion, which I believe almost everyone in the forum will VEHEMENTLY disagree with, but I'm going to offer it anyway:

That's a darn good idea Fishrrman, it won't cause any permanent damage and at the very least it'll help troubleshoot the issue.

 

[jdouge]

All in all though I think this is an OS issue. Does Activity Monitor show any specifc application using up lots of RAM?

No app really blows up on memory usage. The system will beachball and crash even if I don't open any apps (in fact, it will do it if I just sit at the login page long enough).

OP:

I'd like to offer a suggestion, which I believe almost everyone in the forum will VEHEMENTLY disagree with, but I'm going to offer it anyway:

I recommend that you DISABLE virtual memory for a little while, to see if that makes a difference.

To DISABLE VM, try this in Terminal:
sudo launchctl unload -wF /System/Library/LaunchDaemons/com.apple.dynamic_pager.plist

To REMOVE swap files:
rm /var/vm/swapfile*

To RE-ENABLE virtual memory:
sudo launchctl load -wF /System/Library/LaunchDaemons/com.apple.dynamic_pager.plist

With VM disabled, use Activity Monitor to check page outs and page ins.
Should calm this down quite a bit.

.

I'm not sure if I was able to do this or not. I did enter the /off string to Terminal and it accepted it. But it still showed 300+GB of VM available in Activity Monitor. Tried toggling it on and off a couple of times and that value stayed roughly the same. I usually go into about 300MB of page ins just booting up. After toggling a bit, it was up to 500MB. Don't know if that is a significant number.

I wasn't able to delete the swap files. it asked for confirmation after I entered the command, and whatever I tried -- yes, y, even my password -- permission was denied to delete the file. Is there something I messed up there?

Let me know if so -- thanks!

I will try the OS X system files recovery after I hear back on the VM issue. Will that affect my Bootcamp partition? I would like to back it up, but don't know if I can hold my system stable long enough to Winclone it.

Thanks everybody!

 

[jdouge]

Things now seem to be functioning normally! Not sure why. The last thing I tried was disabling and then re-enabling VM. As far as i know (see previous post) I was not able to remove swap files.

Presently I have 700MB of swap in 39 hours of uptime. Not sure how significant that is. I have no page outs in that same uptime period so RAM usage seems fine.

I am re-enabling things gradually (Time Machine, Dropbox, and Crashplan) that i had disabled while troubleshooting, but right now things look good.

I will post if things get beachball-y again. Next steps in that case would be to reinstall system component, upgrade to Yosemite, and wipe and reinstall (I will probably be upgrading to Yosemite next month when I have more time off of work anyway).

So thanks, everyone, for your help. Hopefully I won't need to ask for more!

 

[jdouge]

Update

Unfortunately, a return to beachballs. I reinstalled OS X system components and that worked for a few days, and then . . . still nothing in Activity Monitor or Console to point to a consistent precursor of a complete frozen screen. Still a flawlessly working Bootcamp partition (plus all of the tests and steps to rule things out out above) that suggests it is not a hardware issue.

It seems I have three options:

1. I could install a Time Machine version of my system from before it started having problems. I wouldn't have to do much to get back to where I wanted to be. Yet whatever threw my system off kilter might be lurking there to manifest itself again.

2. I could upgrade to Yosemite. That might erase out whatever errors are lurking. Only drawback is that it would force me to upgrade Parallels, but that's not a big deal. And it was something I planned to do anyway.

3. Finally, I can wipe and reinstall. I have never done this before and would not look forward to it! I am not sure what would be the bet, safe step: I have Time Machine and Crashplan backups. But restoring my files with one of them might reintroduce the villain. Although, if I understand it correctly, Crashplan keeps only my files, and so wouldn't touch the system files?

I have listed them in the order that I am most confident in performing myself. I'd be interested to hear if anyone thinks a different order would make more sense, or if any would be a waste of time, or if I am misunderstanding anything.

Thanks.