launchd is producing a lot of I/O activity. In the last day and a half it managed to write 12 GB of data while reading 500MB.

I the logs I do not see anything suspicious. Any suggestion at where could I look?

  • You can use "live" tracking of R/W events of launchd with: sudo iosnoop | grep launchd. Some will be listed as Unknown, but maybe You'll find some big writes (5th column is size). Aug 28 '14 at 7:48
  • 2
    Could you edit this to include some details? What version of OS X? How are you measuring the IO of the launchd process?
    – bmike
    Aug 28 '14 at 19:28
  • Instances of launchd are the parent process of all processes on OS X; launchd itself does very little but launch and manage other processes. Is it possible the measurement tool is mis-attributing disk activity of a child process with the parent launchd process? Aug 29 '14 at 6:14

Try to use the lsof utility

sudo lsof -p 1
# or 
sudo lsof -p $(ps -U root | grep -w "/sbin/launchd" | head -1 | awk '{print $1}')

EDIT There are can be other user launchd processes running with different process IDs, run

ps aux | grep sbin/launchd

To check PIDs of other instances of launchd.

It should list opened files by launchd. Try that to find there something suspicious. You can also try an app called fseventer, it shows read/write events to the filesystem, or use app like Grand Perspective or Disk Inventory X to find this newly created huge file and investigate further what it is.

  • GrandPerspective is the new Disk Inventory X - grandperspectiv.sourceforge.net Aug 28 '14 at 8:20
  • Is launchd always running with PID 1? Aug 28 '14 at 8:21
  • System-wide launchd (as far as I know) always have pid 1. BTW, see edit, there are can be other instances of launchd with other pids Aug 28 '14 at 8:34
  • @user1855732 though launchd (1) will still be the parent process of the other instances.
    – njboot
    Aug 28 '14 at 21:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .