Tell me more ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.
up vote 10 down vote favorite
1

I can't figure out why lsof on my Mac (10.8.2, MacBook Pro) is so slow.

On my Mac, lsof takes more than a minute:

$ touch /tmp/testfile
$ time lsof /tmp/testfile

real   1m16.483s
user   0m0.029s
sys    1m15.969s

On a typical Linux box, running Ubuntu 12.04, lsof takes 20 ms:

$ touch /tmp/testfile
$ time lsof /tmp/testfile

real   0m0.023s
user   0m0.008s
sys    0m0.012s

The problem persists if I run lsof -n (to avoid DNS lookups). Further, I tried checking which system calls are made by lsof using dtruss, and found that it's calling proc_info tens of thousands of times:

$ sudo dtruss lsof /tmp/testfile 2> /tmp/dump
$ cat /tmp/dump | sort | uniq -c | sort -nr | head
10000 proc_info(0x2, 0x1199, 0x8) = 1272 0
 6876 proc_info(0x2, 0x45, 0x8) = 1272 0
 2360 proc_info(0x2, 0x190D, 0x8) = 1272 0
 1294 proc_info(0x2, 0xFF, 0x8) = 1272 0
 1152 proc_info(0x2, 0x474, 0x8) = 1272 0
 1079 proc_info(0x2, 0x2F, 0x8) = 1272 0
  709 proc_info(0x2, 0xFE, 0x8) = 1272 0
  693 proc_info(0x2, 0x1F, 0x8) = 1272 0
  623 proc_info(0x2, 0x11A, 0x8) = 1272 0
  528 proc_info(0x2, 0xF7, 0x8) = 1272 0

Any ideas? I've run these tests and obtained the same results using both the version of lsof included with OS X (4.85) as well as the latest version from ftp://sunsite.ualberta.ca/pub/Mirror/lsof/ (4.87).

(For the curious, the reason I'm frustrated by this performance is that when I drag images to Evernote, it runs lsof in the process of copying the file, causing my system to hang for a full minute every time I try to insert an image in Evernote.)

share|improve this question
1  
If you have it output to the console instead of a file, does it hang at a particular point? I'm also on 10.8.2. It was taking 6 seconds for me, and I noticed it was hanging every time halfway through listing AirServer's open files. I killed AirServer, and the time dropped to 1.76s. Perhaps there's something on your system that's taking a long time to evaluate? – Warren Pena Feb 5 at 18:59
Interesting data point, @WarrenPena. If I run lsof with no arguments (to list all files), it hangs for a minute and then prints all the files. But, as I mentioned, it still hangs if I try to list who has a single file open in the /tmp directory, so it's not a particular open file that's the problem. Also, I'm not running any AirServer process. – Jason Feb 5 at 21:34
2  
It (only?) takes about a second for me. You could also try sudo opensnoop -n lsof. – Lauri Ranta Feb 6 at 12:59
1  
It takes 19 s for me. No idea why... – daviewales Feb 6 at 14:40
Good idea, @LauriRanta. I tried running sudo opensnoop -n lsof and lsof /tmp/testfile in two tabs, and opensnoop only reported that three files had been opened. So the problem must not be an excessive number of file opens, but something related to excessive proc_info calls. – Jason Feb 6 at 18:48
show 1 more comment

1 Answer

up vote 1 down vote

I don't have a great answer why your system appears to take a minute longer than my slowest Mac to call proc_info 30 thousand times, but your timing shows that both linux and OS X are in the 10 ms range for user time to run lsof. Can you reproduce that slow time booting in Safe Mode to rule out other loads on your CPU?

I've tried three Macs and the ones running 10.7.5 are about a second faster than my 10.8.2 Mac. The older OS are slower Core 2 Duo processors and I'd think an i7 Mac running the newer OS would be as fast or faster than older OS and CPU, but I'd be wrong.

All the machines make about the same number of proc_info calls, and all the machines have lean user time for the command - but you might be on to a slower overall timing (and I have no clue why yours is so dramatically slower than my Mountain Lion Mac).

11 inch Air (i7) 2011 running Mountain Lion - SSD:

$ system_profiler SPSoftwareDataType
      System Version: OS X 10.8.2 (or something)
      Kernel Version: Darwin 12.3.0
      Secure Virtual Memory: Enabled
$ time lsof /tmp/testfile 

real    0m1.179s
user    0m0.012s
sys     0m1.158s
$ sudo dtruss lsof /tmp/testfile 2> /tmp/dump
$ cat /tmp/dump | sort | uniq -c | sort -nr | head
9310 proc_info(0x2, 0x68, 0x8)           = 1272 0
1220 proc_info(0x2, 0xCEB6, 0x8)                 = 1272 0
$ cat /tmp/dump | cut -c -9 | sort | uniq -c | sort -nr | head
30884 proc_info
 116 write(0x4
  87 read(0x5,
  60 sigaction
  60 setitimer
  35 stat64("/
  30 sigprocma
  30 sigaltsta
  21 close(0x3
  18 close(0x6

15 inch MacBook Pro running Lion Server - HDD:

$ system_profiler SPSoftwareDataType
      System Version: Mac OS X Server 10.7.5 (11G63)
      Kernel Version: Darwin 11.4.2
$ time lsof /tmp/testfile

real    0m0.329s
user    0m0.005s
sys     0m0.324s

27 inch iMac running Lion - HDD:

$ system_profiler SPSoftwareDataType
      System Version: Mac OS X 10.7.5 (11G63b)
      Kernel Version: Darwin 11.4.2
$ time lsof /tmp/testfile

real    0m0.066s
user    0m0.002s
sys     0m0.065s
$ sudo dtruss lsof /tmp/testfile 2> /tmp/dump
$ cat /tmp/dump | cut -c -9 | sort | uniq -c | sort -nr | head
23034 proc_info
 188 write(0x4
 141 read(0x5,
  96 sigaction
  96 setitimer
  48 sigprocma
  48 sigaltsta
  31 stat64("/
  21 close(0x3
  18 close(0x6
share|improve this answer
1  
+1. I'm running 10.8.2 on a late-2010 MBP (i7 + 8GB), and whilst running a bunch of apps I'm getting ~1.8s. – Harv Feb 13 at 18:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.