27

Situation:

When I launch Xcode, socketfilterfw, OS X's application based firewall, starts using a lot of CPU.

After some research I narrowed it down to this: socketfilterfw reads all the files in Xcode.app's bundle and does this every time Xcode launches. Gigabytes of data, every time.

It doesn't matter what settings the firewall has, I tried them all. The only thing that stops this is to deactivate the firewall (before launching Xcode).

Has anyone else this effect or an idea what this is about?

Update
I just tried Xcode on a clean install (OS X and Xcode from ADC) and it did not solve it. But it started the scan not when Xcode launches but when a project gets executed (CMD-R). So it starts scanning either when Xcode launches or when executing a project.

Improve this question
6
  • What are you doing to measure this file activity? Is it a performance issue or an energy usage issue or just something that bugs you enough to ask?
    – bmike ♦
    May 22, 2015 at 23:04
  • The final clue was given by using "fs_usage" in Terminal which showed me what socketfilterfw does, reading all those files in Xcode.app's bundle. I also noticed (but removed that from my question) that 'amfid' activates (high CPU Usage for a short moment, long enough to see it in Activity Monitor) when I launch Xcode and after that, Xcode finishes launching and soon, socketfilterfw starts it's scan-orgy. And yes, it is a performance and energy issue, I noticed it because of that, but it also bugs me :) and I want to know why this is happening.
    – user128544
    May 22, 2015 at 23:25
  • 2
    Command to see the file system usage: sudo fs_usage -w -f filesys socketfilterfw
    – user128544
    May 22, 2015 at 23:35
  • 1
    Cool. I'll try to check on things this weekend - both Developer download version as well as app store version. I've not noticed anything like this, but also don't poke at fs_usage generally that often.
    – bmike ♦
    May 22, 2015 at 23:57
  • 1
    Thank You! Ah yes, one can download it from the ADC site, I totally forgot about that, thanks for reminding me. I already downloaded it from there to check for differences and will try out the beta.
    – user128544
    May 23, 2015 at 0:38

2 Answers 2

Reset to default
22
+100

Xcode is likely trying to use the network. This is triggering a rule in your firewall that results in Xcode's code signature being checked – requiring a read of the complete application bundle.

Experiment with the following option in OS X's firewall settings:

  • System Preferences.app >
  • Security & Privacy >
  • Firewall >
  • Firewall Options… >
  • Automatically allow signed software to receive incoming connections

I have this option disabled. As a result, I am frequently prompted to allow Xcode incoming network access. I always deny access as doing so still allows local connections between Xcode and underlying development tools.

As a side note, I am unable to reproduce the behaviour you are seeing on OS X 10.10.3 and Xcode 6.3.2.

Alternative Firewalls

If you do decide to disable your Mac's built-in firewall, investigate using a third party alternative such as Little Snitch: Reasons to prefer Little Snitch over the built-in firewall

Improve this answer
8
  • 2
    Consider reporting this behaviour to Apple directly via feedback or a formal bug report. Every report helps justify engineering time.
    – Graham Miln
    May 22, 2015 at 8:10
  • 1
    Thanks again for your feedback and effort. Ok, I assume I can't solve this because of the security things involved. As a "temporary solution" I installed LittleSnitch (thanks for the hint) but I'm not sure if I can set it up so it behaves like the OS X firewall (Stealth mode)) but I will see. Another option could be Airport Express which has a built-in firewall.
    – user128544
    May 22, 2015 at 19:18
  • 2
    BTW: I removed LS, I don't think that it can be used for this ( see forums.obdev.at/viewtopic.php?f=1&t=6936#p22452 , last sentence ). Thanks for your help and happy bounty day to you, Sir ;)
    – user128544
    May 23, 2015 at 17:55
  • 4
    I had the Automatically allow signed software to receive incoming connections "enabled", in quotes because it doesn't really seem to be "enabled". I disabled it then re-enabled it back and everything went back to normal.
    – XCool
    Nov 20, 2015 at 12:24
  • 3
    @bauerMusic Great tip! I was struggling with this for weeks. Socketfilterfw was totally sucking the life out of my poor 2011 Macbook Air. The accepted answer didn't solve it for me, but removing Xcode from the firewall list did the trick. Thank you.
    – Tuslareb
    Dec 15, 2015 at 19:55
1

I did both options (remove from list, uncheck Automatically allow signed software to receive incoming connections), and then had to restart Xcode for the fix to take effect.

Improve this answer

You must log in to answer this question.