Find what process is doing many disk reads

[Makosuke]

My desktop iMac (final-gen Intel 27”, i9, 64GB RAM, 1TB) has been suffering minutes-long periods of severe slowness, and I think I’ve narrowed the reason down to something doing tens of thousands of I/O reads per second on the internal drive.

Activity Monitor clearly shows huge IO numbers (15,000 - 45,000 reads/sec) and moderate actual throughput (~200MB/s) lasting a long time and directly correlated with the slowness. The problem is, none of the processes in the list show the Bytes Read increasing, so I can’t figure out what’s actually doing this. Console is logging way too much noise for me to narrow down that way.

Any suggestions for how to identify what process could be responsible for this? I don’t get why the Activity Monitor process list isn’t showing it when the box at the bottom does, but that’s the situation.


A list of things I’ve ruled out:

• High CPU (nothing is using much, fans are quiet)
• RAM shortage (64GB, few things open, Activity Monitor reports lots free and no pressure at all)
• Time Machine (I stopped it entirely to troubleshoot)
• other backup app (I shut down Sync Pro entirely)
• any of my SoftRAID formatted externals (SoftRAID shows I/O counts, they are not moving at all, which leaves only the internal SSD and an external spinning Time Machine volume)
• the Time Machine volume (it’s a 5TB spinning disk, so impossible for it to do 15,000 iOPS, therefore must be the boot drive)

 

[bogdanw]

Maybe Spotlight and its related processes https://forums.macrumors.com/thread...s-search-index-from-working-properly.2248163/

 

[Fishrrman]

If I had 64gb of installed RAM, the first thing I'd try is to TURN OFF VM DISK SWAPPING (using terminal), and see if that made a difference.

I've been doing this now for many years, both with my Intel-based Minis and my new MacBook Pro 14".

And that was with only 10gb and 16gb of installed RAM.

The Mac run fine WITHOUT VM SWAPPING, do not crash.
Works for me.

And -- I also disable Spotlight as well.
Spotlight has been disabled on every Mac I've owned, since Spotlight was introduced.
I don't need it or want it.

 

[Brian33]

Try iStat Menus -- it will allow you to see the top few processes doing I/O. It's $12 but there may well be a free trial.

See the list of processes at the bottom of the drop-down:

 

[bogdanw]

Try iStat Menus -- it will allow you to see the top few processes doing I/O. It's $12 but there may well be a free trial.
See the list of processes at the bottom of the drop-down:

Isn’t that the same information as in Activity Monitor?
https://support.apple.com/guide/activity-monitor/view-disk-activity-actmntr1005/mac

 

[Brian33]

Isn’t that the same information as in Activity Monitor?

If I remember correctly, the individual processes’ read/write numbers are not updated in real time in Activity Monitor, as the OP alluded to. In iStat Menus they are.

The problem is, none of the processes in the list show the Bytes Read increasing, so I can’t figure out what’s actually doing this

 

[Makosuke]

Many thanks all around for the suggestions.

Tentatively, it appears that an NTFS Bootcamp partition was the source of the issue. I tried manually unmounting it, and at least thus far haven't had a reoccurrence of the issue. I also haven't had time to play with it further to try and definitively prove that as the cause or figure out what the triggers are. I can say that, if that is indeed the cause, it's not a one-time thing, since it persisted intermittently through several reboots.

One thing that clued me into it is that at least sometimes it seemed to get triggered by doing a full-computer search in the Finder (which sort of makes sense, since it would be individually checking a vast number of files on the NTFS volume with no index to refer to).

It was definitely popping up without doing a search, though; perhaps it was indeed Spotlight indexing in the background as suggested, although I am not getting the symptoms described in that other thread (I don't have a bunch of log entries written to disk, and certainly nothing as repetitive as that that makes it quite clear what's thrashing in the background. Also odd since the NTFS volume was mounted read-only; I have it excluded from my backups, but maybe not indexing.

I do wonder what the root trigger is, though, since obviously this doesn't happen to everyone who uses Boot Camp or there would be more complaints about it. I did have to reinstall Windows (in place) because it decided to break itself for no apparent reason, so maybe that somehow broke something.

Try iStat Menus -- it will allow you to see the top few processes doing I/O. It's $12 but there may well be a free trial.

Thanks for the suggestion! There looks to be a trial, so I'm going to play around with it when I have time (and probably going to buy; it's a neat tool that I knew existed but had forgotten about).

I don't know whether, as others noted, I/O that isn't associated with a process in Activity Monitor will show up in iStat Menus, but even if it only accurately shows per-partition I/O that would still have been a big help in diagnosing this.

If I had 64gb of installed RAM, the first thing I'd try is to TURN OFF VM DISK SWAPPING (using terminal), and see if that made a difference.

I've been doing this now for many years, both with my Intel-based Minis and my new MacBook Pro 14".

And that was with only 10gb and 16gb of installed RAM.

The Mac run fine WITHOUT VM SWAPPING, do not crash.
Works for me.

And -- I also disable Spotlight as well.
Spotlight has been disabled on every Mac I've owned, since Spotlight was introduced.
I don't need it or want it.

VM swapping does not appear to be the issue, which I was pretty certain of since there was absolutely no memory pressure at all (nor unexplained disk space reduction--I know what it looks like when something has a berserk memory leak that starts filling up the disk with swap, and this isn't it).

That said, the modern macOS (at least on my M1 Max MBP) does a good job of telling you that RAM is running low rather than just quietly letting stuff fill the disk up with swap files, so I see little reason to bother disabling it even with large amounts of RAM.

Disabling Spotlight might theoretically have helped if the problem is indeed trying to search an NTFS volume. Then again, if that worked I'd still fix it rather than leaving Spotlight off--unlike you, I do want Spotlight. I regularly take advantage of its indexing to easily and quickly find stuff buried in 10TB of pack-rat digital files stretching all the way back to my first Mac, an LC, and a large stack of floppies. I may even have a few Apple II files pulled off 5.25" disks in there. Spotlight indexes are a godsend if you have enough crap and want to search the contents of it for a word.