locationd uses insane amount of bandwidth

[rworne]

I've been noticing Little Snitch always having a bar or two of activity (up and down) and decided to look into it.

What I found was locationd has sent nearly 8GB of data to a variety of IP addresses (100+) over 54 hours. Not in bursts, but as a slow, steady trickle - About 35KB/s on average. Disabling little snitch and quitting applications does not have any effect on the transfer rates.

See attached screenshots for examples and IP addresses.

Anyone else seeing this activity?

 

[matavr]

Interesting, just checked mine and I have this in locationhd

• 684 KB (written)
• 7.3MB(read)

This is after 4 days of a new clean install of Catalina (19A602) and so far the only issues I have detected are:

- Location Services are not working
- Night Shift not triggering using the sunset to sunrise schedule


And I am getting this Error messages in the console

Error writing manifest to disk: Error Domain=NSCocoaErrorDomain Code=513 "You don’t have permission to save the file “GeoServices” in the folder “Caches”." UserInfo={NSFilePath=/var/db/locationd/Library/Caches/GeoServices, NSUnderlyingError=0x7f916c522180 {Error Domain=NSPOSIXErrorDomain Code=1 "Operation not permitted"}}

 

[rworne]

Checked console on mine. It's apparently pushing my location to maps:

default    09:39:38.274100-0700    locationd    Sending location to client </System/Library/LocationBundles/Routine.bundle>
default    09:39:38.275098-0700    locationd    {"msg":"CLClientDefaultMessageHandler", "event":"activity", "client":"0x7f97a9e0c660"}
default    09:39:38.275342-0700    locationd    Sending location to client <com.apple.Maps>
default    09:39:38.275866-0700    mapspushd    {"msg":"CLClientDefaultMessageHandler", "event":"activity", "client":"0x7fd5e371f7d0"}
default    09:39:38.276248-0700    locationd    Sending location to client <com.apple.Maps>

Does this about 12 times, it's doing this ~10 times a second - so 120 pings per second? Going for a reboot to see if it clears up.

This has to be just me, Apple would notice something like this quickly if it were widespread.

EDIT: Just rebooted and it's pinging once a minute for now. I'll check it in a few hours.

 

[nollimac]

I had issues with an OS...cannot remember which one, Sierra, High Sierra, Mojave; however, the fix was to get rid of Little Snitch...MacOS doesn't need it, as well as turn off location unless you're worried someone will steal your Mac and you'll need to find it in that case. Never used Little Snitch again after that.

 

[rworne]

Final followup:

After 9+ hours, locationd is behaving normally. 2.2MB uploaded, 24MB downloaded, much better than the previous numbers.

No idea what set it off like it did before, all the same programs are running. Little Snitch is behaving well. I've never had a problem with it.

 

[rworne]

Rebooted this afternoon and it's going nuts again. 614MB of data in 2 hours.

EDIT:
Found out how to stop it: Turn off Wi-Fi. Drops to zero. Turn on Wi-Fi and it picks up again. Still no idea what is causing it.

EDIT 2:
Found the culprit... System Settings -> Security and Privacy -> Privacy -> Location Services -> System Services -> Homekit

Turning this single thing on/off starts and stops the traffic, which can be up to 50 kB/sec.

EDIT 3:
The cause is locationd itself most likely. Various apps are causing the bandwidth leakage - I found Little Snitch doing the same last night.Console tells me that homed (HomeKit) gets one ping, and a bunch of others goes to Apple Maps - like 8 of them. Nothing is using Maps at this time though.