[Jay]

Originally Posted by stevegong do you think you could help me out on this? Basically I just want my computer on at night because I use my computer as an alarm clock using mp3 alarm clock..

I do the same with my 12" Powerbook. I don't notice the writings to the HD that you seem to have problems with but you can have you computer turn itself on in the morning in the Energy Saver pref pane. I think it will also wake it up from sleep if you prefer to go that route. Just make sure your account will automatically log in otherwise your software probably won't run. Also give the PBook about 5 to 10 min head start so it has time to boot before the alarm goes off. Sorry I can't help with the original problem though.

Hallo folks -- jumped to this forum after a search on this problem. I was able to stop my hard drive "ticking" without any commands to the system.
In my case, I shut down another PC connected to my local network. That machine did have a drive mapping to the mac, which, although it wasn't being used, was running. Perhaps other affected users have similar networked machines that might be getting accessed/pinged/etc?

[stevegong]

Hey Danno,

thank you for your post and welcome to this forum. What system do you have?

I think the problem we're having is that independent of the network or even any third party apps, etc, whatever, we still have the inability to spin down hdd for extended periods (not the same as sleep).

Are you really able to spin down hdd for as long as it is not accessed? I felt like this was a problem true to all macs running panther.

I'm running a dual 1.8 G5, 1 GB RAM, OS 10.3.6. Although I don't remember when it started, I did have the disk being accessed ("ticking") every 30 seconds. I was worried I was infected with something, but didn't see anything unusual in the ps list. Then, just to be sure, I went and turned off any other machines on my home network, and voila -- no ticking. In my office I can definately hear the sound of the hdd, and I'm sure it's not running.

I'd imagine that that "update" process could be started by a number of system events -- perhaps there's even some variable somewhere that reguates the frequency. At any rate, I can see how a networked environment might cause the machine to be extra cautious. Perhaps a bluetooth device is being sensed? (blued runs in the background too. . .)

[stevegong]

Well, just to clarify, the problem is still there even if:

I wipe the hdd and do a whole new installation of panther. All io disconnected, no installed apps other than those that came with it.

I don't think it's an external influence. It has to be a bug or something in Panther.

[thegeek]

I tossed a kill -STOP at the update process and the sound stopped. As soon as I hit the process with a kill -CONT it... uhh continued.

Sounds like it might be a bit overzealous with parking the head actually.

[stevegong]

Originally Posted by thegeek I tossed a kill -STOP at the update process and the sound stopped. As soon as I hit the process with a kill -CONT it... uhh continued. Sounds like it might be a bit overzealous with parking the head actually.

so...what's the verdict?

[Gargoyle]

earmufs ?

[art]

Any progress on this?

I have the same problem with my lombard pb. Worse even, since
the aging disk makes a buttload of noise when it spins up.

One extra process that noone's mentioned yet: ntpd. This is responsible for
at least one spinup per hour. Kill it and your clock will slowly drift. But if
that doesn't matter, it shouldn't be a problem.

Also, there's a process called "SecurityServer" which is writing every 10 minutes.
With update turned off, this doesn't get flushed to disk very often.

I assume SecurityServer is logging something, somewhere. It does log to /var/log/secure.log
whenever certain events happen (sudo, for example). But what could it be doing
every 10 minutes?

[stevegong]

Thanks art for your post.

Man, this sucks, we're talking about quite a few processes, and we just don't know how important they are unless we kill them and see.

kill security server yet there's still ntpd which will make the clock drift? that really blows....

wtf though, I'm quite certain (the birdie told me) the problem won't be fixed with Tiger, which pisses me off.

Any other ideas?

[stevegong]

well, it looks like ntpd is the network time thing that you can disable in system preferences anyway. so there's still hope. when i get home tonight I'm going to try killing all those processes....fingers crossed....

or... have you tried killing them already?

[art]

I've been running without ntpd for a while. I haven't dealt with
SecurityServer. I asked around about it, and no one knew anything.

Does os x have anything equivalent to the old os9 trick of running your
system from a ram disk? It seems like there should be some way of putting
/var/log into ram so writes don't actually hit the disk. Yeah, that would screw
up any possibilities of getting useful log info after a crash. But I don't really
want that. I'm just using the machine as a music server. It if crashes, so what
I just reboot.

[stevegong]

There's a programme for making ram disks on os x. I guess we could redirect it to the ram disk....good idea...do you have any idea how to do this?

http://www.donelleschi.com/ramdiskcreator/

[art]

Looks like one of the things that SecurityServer is writing is
/private/var/db/SystemEntropyCache


It does not appear that SecurityServer is something that can
be killed with impunity. Still, I do not need security on the
machine in question.

Is there a tripwire equivalent for os x that will list files that are
modified over time? I'm using fs_usage to get some of this info,
but there still seems to be something I'm not catching.

[art]

OK, so here's what I'm currently trying.
RamDiskCreator looks a little too overengineered for use here.
I'm using hdid, newfs_hfs, and mount to make a disk image, and then
creating a symbolic link from /private/var/db/SystemEntropyCache
to this image. Somewhat as described in the `ramfs' section here:
http://www.kernelthread.com/mac/osx/arch_fs.html

So far, the system has not crashed.

[thegeek]

[paul@swag paul]$ mkdir /tmp/ramdisk
[paul@swag paul]$ hdid -nomount ram://`echo "32 * 2048" | bc`
/dev/disk1
[paul@swag paul]$ newfs_hfs /dev/disk1
Initialized /dev/rdisk1 as a 32 MB HFS Plus volume
[paul@swag paul]$ mount -t hfs /dev/disk1 /tmp/ramdisk
[paul@swag paul]$ cd /tmp/ramdisk/
[paul@swag ramdisk]$ df -k .
Filesystem 1K-blocks Used Avail Capacity Mounted on
/dev/disk1 32768 524 32244 2% /private/tmp/ramdisk
[paul@swag ramdisk]$ cd -
[paul@swag paul]$ hdiutil eject /dev/disk1
"disk1" unmounted.
"disk1" ejected.
[paul@swag paul]$


If I were to script this, I would probably stuff the output of the hdid command into a variable and then carry that forward. You want lots of error checking here. These aren't exactly safe commands.

[art]

Yes, that's exectly what I did. The trick is going to be
getting this entropy file onto a ramdisk before the
SecurityServer opens it at boot time. I wonder if anything
else opens it and holds it open?

I also discovered that cupsd was periodically reading
from /dev/random and writing to the disk. Since I'm not
printing from this machine, and never will, I killed it.

The disk has been silent for almost 48 hours now. Now that
we've found all (?) of the houskeeping processes that are
writing to disk, maybe it's time to turn `update' back on.
If nothing's scribbling in the buffer, the sync shouldn't cause
any activity.

[stevegong]

Ok, I did the System entropy thing, killed update, distnoted, ntpd, cupsd.

Did I miss something? because this morning when I woke up, the hdd palmrest on my pb was warm.

[stevegong]

yeah, aight guys, I confirmed there is still something accessing the hdd.

[thegeek]

Probably syslog.

[Brad]

FYI, the issue with the update process was not fixed with 10.4.

Fortunately, I can still kill it with no troubles.

[ast3r3x]

So are you guys killing all those processes without any troubles? How about an AppleScript or something for us less technical types.

I think something like this would be embraced by the Apple laptop community :smokey:

[Brad]

sudo killall update in the terminal. You can't get much easier than that.

[ast3r3x]

But from reviewing this thread again, it seems there are other processes right?

[Brad]

Right. So, simply replace "update" with the name of the offending process.

[ast3r3x]

So kill all of these?!

update
distnoted
ntpd
cupsd
syslog

[Wickers]

I don't think you want to kill syslog or cupsd... hehe... well you can, but it depends if you 'need' them running or not.

Cups (cupsd) is used for printing, now if you use the cups deamon or not is up to your setup.

Syslog, is your BSD based logging deamon which is setup to log infromation that is later used by 'some' other apps. I don't know how much OSX uses BSD based log files, or if they have tied in their own logging system into syslog, but it would be a good idea to keep it running.

(I know that on my linux boxen, I sure as hell make sure syslog is running... the only time I can think of a use for not running a syslog deamon is when you are running a live CD or booting off a floppy.)

[ast3r3x]

Ok...now if I can't kill one of these, doesn't that defeat the purpose of killing any of them?

[Wickers]

True...

But I see it like this:
Feel free to finger fuck the processes you don't use, and by 'you' I mean just that -- the user. Now, if your system uses the processes (which it does) and 'you' use that aspect of the system which requires them... killing them off is not an option. However, if you don't have a printer for example, '#sudo killall -9 cupsd' without question.

[ast3r3x]

I don't have a printer connected to my computer, I just use the printers shared by my brothers computers.

So now I just need to wait for somebody to tell me if I can kill syslog or else if it will end up killing OS X