When trying to unmount my Samsung T3, which I store various applications like Mathematica on, I am told it is being used by some software socketfilterfw

$ diskutil unmount /dev/disk2s1
Volume External on disk2s1 failed to unmount: dissented by PID=304 

This also shows when unmounting using the GUI and checking in Console.app

I think socketfilterfw is involved in the firewall, however I'm not sure how to fix it or why it is happening, and whether or not it is safe for the SSD to force unmounting.

What options do I have?


The easiest and safest thing is to log out of the account on the Mac. (Apple Menu - log out)

This does two things:

  1. All applications are told to quit and you can identify any apps that are stuck / hung.
  2. All drives are safely unmounted as part of the normal log out process (unless you have an odd setup where you installed software that mounts the drive before the user logs in).

Once you have done that, you can either power off the Mac (to ensure all possibility that the drive is safely shut down and open files are not corrupted) or disconnect the drive.

Pulling a drive that's journaled and HFS+ (or the new APFS) is safe in that you won't corrupt the filesystem. What is at risk is each data file that's still open - so you would lose your word file, your iTunes library that lists playlists / ratings, etc.. (but not the songs themselves).

As to the socket filter - you might need to dig a bit in activity monitor or terminal to know why that was identified as using the device. It's probably relating to the apps you run off that device - Google Chrome will run updaters, perhaps Mathematica runs some licensing software that connects to the network (a school license server or back to the vendor). If you can make this error happen on a newly rebooted Mac several times - then it should be easy to look over each running app and trace why the filesystem is blocked and active.

  • I have determined that the issue is indeed with Mathematica, I assume in its license server or how it logs into Wolfram. It doesn't occur when Ableton Live is run from the SSD. It happens every time with Mathematica however – Joe Bentley Jul 3 '17 at 15:54
  • I have taken a look at the disc activity using iostat and socketfilterfw does not seem to be writing to or reading from the disc at any point when the disc is idle or when I try to eject it. I think I will just force eject after using Mathematica but I'll see if I can work out what's happening – Joe Bentley Jul 3 '17 at 15:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .