2021-07-22

Fixing out of control Apple OS X process "fseventsd"

This year I obtained a wonderful, shiny, new Apple iMac. This computer is a true joy to use, since it has more processors and is far more powerful than my previous computer (a Windows laptop). Normally, the iMac completes in a breeze tasks for which my previous computer acted as if the world was coming to an end and it was computing the one solution to save all mankind. (That is, blazing heat, blaring fans, and GUI blips.) Every once in a while though, the fans on my iMac kick on-- even when no major tasks/processes/software/programs are running. This is strange, to say the least; frustrating, to say more. 

It will be helpful to know the specs of the system on which I encountered and resolved this problem:

(macOS Catalina, Version 10.15.7, on a Retina 5K, 27-inch, 2020 iMac)

The problem: fseventsd using too much CPU

A quick look in the ol' Activity Monitor revealed that there was one process owned by root called fseventsd, which would frequently be running at 100-200% CPU at times I noticed my fans kicking on. A quick Google search for "os x fseventsd" reveals that lots of other people have the same problem I do: this process seems to spawn itself out in the background, and randomly decides to eat up a few CPUs' worth of your computer, often causing excessing heating/fanning. However, there seems to be no resolution as to what all this process does and whether or not it's safe to force quit it. Only vague information that is only sufficient to make me vary wary of the force quit sledge hammer. 

After a few hours on the phone with the (helpful) AppleCare+ support team, it looks like we've wrangled fseventsd, and I'm recording how this was done. After (what appears to be) the correct solution, I've also added some troubleshooting steps which did not solve the fseventsd problem, but could be useful for a number of other things down the road.

The Apple engineer did confirm for me that it is safe to force quit fseventsd-- this won't cause a crash or other instability. However, the process will simply restart itself when it wants to. Nonetheless, you don't simply want to destroy/remove/block/disable this process because it is involved with indexing the files in your computer, which is utilized by Spotlight Search, Time Machine, Mail, and possibly some other apps/features.

The solution: stop Mail.app from communicating with email

The actual solution turned out to be very simple: the Apple Mail app was constantly communicating back and forth with my email (Gmail, for me), and apparently consuming a ton of computing resources to do so. As a lifestyle choice, I don't want my computer to know anything about my emails or internet usage unless I intentionally sit down to check my email. (Read Deep Work and The 4-Hour Workweek, and you'll probably adopt the same lifestyle. See my reviews of these books here.) That being the case, I currently have no use or desire for the Mail app anyway. But if you followed the setup wizard for your new Apple computer (like I did), your Mail app communicating with your email was probably setup by default. 

Here's how to stop Mail from communicating with your email provider. First of all, you'll actually go through System Preferences and not the Mail app itself. Navigate to System Preferences > Internet Accounts, as in this screenshot:

Then select the tab(s) on the left associated with your email account(s), and uncheck the box next to the Mail icon:

If you want to verify that these changes took effect, open your Mail app (quit the app first, if you have it open now) and you should see a blank slate of no emails. Congratulations-- now your computer doesn't know you use email!

For me, it took a few more minutes for fseventsd to calm down; but after it did, here is the new normal CPU and RAM usage of that process:

Now, it seems that fseventsd's usage remains pretty consistently around 0.0 % CPU, and 15-20 MB of memory. In the few days between implementing this solution and writing this post, my iMac's fans haven't kicked on even once.

Update (2022-02-21)

I recently noticed my computer fans kicking into high(er) gear and apps starting to slow down again. The culprit? Yep, fseventsd again; even though all the aforementioned settings were still in place. This time around, I believe it was due to the fact that I had some over-due system updates awaiting permission to run. Running the system updates (which included a computer reset in this case) did seem to fix the fseventsd overdrive... at least for now. 

One new lesson learned: 

Keep your system/OS up to date 

Some other troubleshooting measures you could try

To be clear, the following measures did not resolve the excessive-CPU-usage-fseventsd problem. Nonetheless, these were the initial tests, and are probably good things to try for a wide variety of issues.

Reset the System Management Controller (SMC)

Everyone knows the ol' off-and-back-on trick, which should always be the first go-to. Resetting the SMC is one notch above that. To do this, you need to turn off your iMac and then unplug its power supply (keyboards, trackpads, etc. don't matter) for at least 15 seconds before turning it back on. Then plug it back up and power back up. Don't worry-- resetting the SMC won't alter any of your settings.

Reset the Non-Volatile RAM (NV-RAM)

We also tested the possibility that there could be some parcel of information hanging around in the NV-RAM possibly causing fseventsd to [malfunction]. To clear/reset the NV-RAM, first turn off your computer. Then, as soon as you press the power button to turn it on, immediately press and hold OPTION, COMMAND, P, and R. Keep holding those keys down. If it works, you'll see the Apple logo appear on a black screen, then disappear, then (after about 20-30 seconds) reappear, then disappear again. At this point, you can let go of the keys. Then your computer should resume the familiar boot process.

Check if problem is system-wide, or user-specific

If there is legitimately something wrong with the OS, reinstalling the OS might be required. If the problem is in the OS, then any/all users in your computer would experience the same issue. Therefore, if another user profile does not experience the same issue, then the issue is not system-wide, and is likely related to a specific app/feature/software being used specifically by the user that encounters the problem. Thus, I simply tested this by signing in under a guest profile, and checking the fseventsd usage in that user's Activity Monitor.

Check if it is related to a Time Machine backup

One widely discussed use of fseventsd is in creating Time Machine backups. Here is a command you can use in Terminal to get some information about the last few backups created:

tmutil thinlocalsnapshots / 999999999999999 4

Test for possible fault of 3rd party program (boot in "safe mode")

If you determined above that the problem is user-specific, then a natural next question is whether the problem is related to some 3rd party app installed by that user alone. One way to potentially (not exhaustively) figure this out is to boot in "safe mode." Safe mode will disable most 3rd party apps (though I don't think all... could be wrong), so if the problem disappears in safe mode, the solution could be as simple as uninstalling or reinstalling the problematic app (good luck identifying it though). To boot in safe mode, shut down your computer and wait 10 seconds. Immediately after turning your computer back on, press and hold SHIFT. Release the Shift key when you see the login window.

Safe mode will feel like your computer has a serious virus-- everything will be incredibly slow-- on purpose. Just check the fseventsd usage in your Activity Monitor and get the heck out of there. Simply turning your computer off and on again will un-set safe mode.

Become "root" to take a closer look (at anything)

Even if you are the only person that has ever owned or used your Apple computer, by default you're not the "owner" of all files/directories/processes. That person is called the "root" user, and that person is not you by default. This is a safety measure that Apple implemented to protect their average user from himself. (Basically, Apple has ensured that even cd /; rm -f * won't totally destroy your computer when you're signed regularly.)

Thankfully, you can become the root user, but Apple makes you really want to. Apple has its own instructions for enabling the root user privileges here.

Once you enable the root user and sign in as root, you'll be able to actually navigate to and look inside any/all data on your computer. For example, you could try this, which you are unable to do unless you are root: 

cd /.fseventsd/

ls