launchd is producing a lot of I/O activity. In the last day and a half it managed to write 12 GB of data while reading 500MB.

I the logs I do not see anything suspicious. Any suggestion at where could I look?

  • You can use "live" tracking of R/W events of launchd with: sudo iosnoop | grep launchd. Some will be listed as Unknown, but maybe You'll find some big writes (5th column is size). – Mateusz Szlosek Aug 28 '14 at 7:48
  • 2
    Could you edit this to include some details? What version of OS X? How are you measuring the IO of the launchd process? – bmike Aug 28 '14 at 19:28
  • Instances of launchd are the parent process of all processes on OS X; launchd itself does very little but launch and manage other processes. Is it possible the measurement tool is mis-attributing disk activity of a child process with the parent launchd process? – Graham Miln Aug 29 '14 at 6:14

Try to use lsof utility

sudo lsof -p 1
# or 
sudo lsof -p $(ps -U root | grep -w "/sbin/launchd" | head -1 | awk '{print $1}')

EDIT There are can be other user launchd processes with different pids, run

ps aux | grep sbin/launchd

To check pids of other instances of launchd.

It should list opened files by launchd. Try to find there something suspicious. Also try app called fseventer it shows read/write events on filesystem, or use app like Grand Perspective or Disk Inventory X to find this newly created huge file and investigate further what it is.

  • GrandPerspective is the new Disk Inventory X - grandperspectiv.sourceforge.net – CousinCocaine Aug 28 '14 at 8:20
  • Is launchd always running with PID 1? – CousinCocaine Aug 28 '14 at 8:21
  • System-wide launchd (as far as I know) always have pid 1. BTW, see edit, there are can be other instances of launchd with other pids – user1855732 Aug 28 '14 at 8:34
  • @user1855732 though launchd (1) will still be the parent process of the other instances. – njboot Aug 28 '14 at 21:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .