[Eldberg]

Hi all.

I have two identical 20" iMacs, one at work and one at home. They both have 1TB hard disks and run Yosemite. Disks are about half full on each.

Now the one at work starts up in about 2 minutes, then goes silent and works well. The one at home also puts up the desktop in about 2 minutes, but then I hear the disk rattling for about another 2.5 minutes, during which time the machine is slow to respond to any action on my part.

Friends suggested that the home Mac may have a faulty drive. If it's on the fritz, it produces many reading errors. They suggested I replace the hard disk. I have checked it with Disk untility and performed various Onyx scripts. No problems have been indicated.

Today I used the activity control app and noticed that with only Safari and Mail active, the machine had used 3.95 out of 4 GB RAM. Now I am asking two questions:

1. Is it more likely that the disk rattle/slow startup is a reault of too little RAM (causing it to use virtual memory) or a bad disk?
2. Is it normal for the iMac to use this much RAM with so few applications running, or could there be some sort of malware or other processes running that I'm not aware of?

Any ideas or hints are welcome!
Yours, Ake

[jmiddel]

It is normal to use as much RAM as is available, and since you don't have this problem at work, with the same amount of RAM, it is most likely the HD. What year is the iMac? Certain Seagates were a problem in iMacs around 2011, I had to replace my terabyte drive in my iMac.

[reader50]

During the extra 2.5 minutes, does Activity Monitor show anything interesting running? Look at the running processes (sort by CPU) and at the Disk Activity tab. Low/erratic disk activity might indicate failures, steady high activity indicates something's loading.

The drive could be failing, but I'd expect the time-to-desktop to be slowed. Activity after desktop suggests it's preloading a bunch of data, or doing some kind of indexing.

[Eldberg]

Thanks for your answers. Activity monitor doesn't indicate anything weird that I can see, but then I really don't know what to look for. Compared with the job computer today and with only Safari and Mail active, it uses around 3.2 GB memory. This makes some sense because it doesn't have VPN, AppleTV home sharing and TV Shows (probably illegal) which are in the home Mac. Perhaps those things are the answer; TV Shows for one will automatically check for new episodes on startup.
Ake

[P]

In the memory view of Activity monitor, sum the amount reported as Wired+Active on each machine and compare. If it is close to your total memory, the disk trashing is due to you running out of memory

[AlenShapiro]

Here is a link to an old but very valuable utility that I keep in my dock and autorun on login. Although it displays its result by default in the dock itself, I set my copy up to present a window on my desktop. The utility shows the various amounts of ram currently being used by the Mac and it also shows page-ins and page-outs as white resp. black lines. If you see many black lines, you're paging out active memory to disk (which could certainly cause rattling and means you need to add RAM to your Mac (or find out what is using all that active memory)).

Memory Monitor for Mac | MacUpdate

It displays wired-in ram, active ram, reusable ram and free ram. There's a CPU and network monitor as separate programs that function with a similar dock-based interface - they are all very useful and do not seem to use up much of the Mac's resources themselves.

You might like to check your console logs (start the console.app in your utilities folder). Select "All Messages" from the "log list" screen area. Don't get a fright. If you see messages that look like disk errors (you can filter the log entries by typing "disk" into the search area of the Console.app window). If you see things that mention read or write errors on /dev/disk<x>s<y> (where <x> and <y> are numbers) then you should replace the corresponding drive (in my experience "S.M.A.R.T. Verified" messages are useless in Disk Utility and, by the time they show anything else your disk is usually hosed/unrecoverable.

You can use a terminal while the disk noise is going on and type:

ps axwwwl | grep fsck | grep -v grep

to see if the system is performing an fsck (file system check) on startup. If such a process is running (it'll usually contain the text "hfs_fsck" if it is present), this means the system was not shut down cleanly last time and the disk needs to be repaired. If the disk needs repair, I would use "Disk Warrior" over "Disk Utility" as the I've found the former to be much more reliable and useful. Disk Warrior repairs disks under many conditions where Disk Utility gives up the ghost. Make sure you use version 5 with Yosemite (and, yes, it is worth the purchase price).

It is possible that an mds process is slowing you down on boot.

ps axwwwl | grep mds | grep -v grep

in a terminal window to see if one or more of these processes are present. If it is then this means "Spotlight" is trying to index your disk which brings up another possible issue... "free disk space". With any MacOS X you should aim to have at least 10% of the free disk space available at all times. It is just a good rule of thumb but if you, for instance, get into a range where free disk space is less than 3 or 4 times your RAM size, then paging becomes inefficient and things like Spotlight indexes fail to be properly written. If Spotlight keeps trying to index your drive on startup, this suggests, either a corrupted spotlight index or not enough space to properly write a new index. I won't go into the fixes for those issues here but you can google on how to trash your existing spotlight index and have the system rebuild a new one.

Sorry for such a long post. I'm sure I've left some simple tests out but these should be a good place to start.

[macnscott]

It could even be an issue with Spotlight indexing. To reset indexing and eliminate it as a possibility, open Spotlight preferences (inside System Preferences), select the Privacy tab and drag your boot drive into the list window (or click the + and select your boot drive this way). Next, remove it from the this privacy list. This will cause the indexing cache/file to flush/delete and will start the indexing fresh. It will take it a bit to do this initial indexing.

[Eldberg]

Again thanks for replies. (I don't mind a long reply at all.)

Alen: I downloaded the memory monitor and put it to autoload. Made a screen dump of what it looked like while the disk was working just after the machine started. Unfortinately this forum doesn't seem to allow images in postings, otherwise I'd have put it here. No black lines, only white ones. Haven't tried any of your other advice yet, but will.

Macnscott: I've used Onyx to reset the Spotligt index. No change.

Yours
Ake

[AlenShapiro]

The lack of black lines indicates it is not a RAM-shortage problem. The white lines indicate that disk data is being cached in RAM (paged-in) and this is normal when chugging through disk-based operations. We just have to determine what disk-based operation is being performed and whether it is a necessary or erroneous one.

The two terminal commands:

ps axwwwl | grep fsck | grep -v grep
and
ps axwwwl | grep mds | grep -v grep

will help rule out the most common culprits. Any output from either of those two commands should indicate which particular issue we might examine in more detail (the first being disk structures and the second being spotlight indexing).

There are a couple of more detail oriented she'll commands we can try that would be quite definitive eg "iostat" to tell us how much disk access is being performed and "lsof" to tell us which processes are using the disk. These can wait until we can rule out the simple stuff using the "ps" commands above.

Another easily performed diagnostic operation is to quickly check if some simple malware is causing problems. The software called "adwaremedic" does this really well:

AdwareMedic

Download and run this software (certainly worth a donation if you find it useful). It will scan for a bunch of load-on-startup malware and can remove most of what it finds at the push of a button.

I guess I should ask why you shut down your computer so that you are starting it up and noticing this issue. There's nothing particularly wrong with shutting down your Mac except that the OS is designed to stay up, pretty much, forever and certainly (in most cases) functions best when just left running. That's not to say shutdown/startup is bad, merely that, under normal circumstances, it is done infrequently.

Let me know how you get on with the above and we'll see what next steps might be required. I'm confident we'll find the cause.

[pottymouth]

I don't think anybody's mentioned the simplest possibility: Login Items.

Check the list for your user in System Prefs>Users & Groups. Anything you don't recognize? Anything different between your two computers?

[Eldberg]

Pottymouth: The listed start objects in the place you mention are only iTunes helper and Dropbox. But in my menu bar I also have Plex, 1Password, AppleTV, VPN and TV shows which are apparently loaded on system bootup. On the other (non-rattling) computer, there is only 1 Password and Dropbox.

Alen: This is what I got:
Last login: Fri Apr 24 10:38:04 on console
Akes-iMac:~ eldberg$ ps axwwwl | grep fsck | grep -v grep
Akes-iMac:~ eldberg$
Akes-iMac:~ eldberg$ ps axwwwl | grep mds | grep -v grep
0 32 1 0 50 0 2600244 59932 - Ss ?? 0:14.41 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Support/mds
0 170 1 0 37 0 3510120 76540 - Ss ?? 0:08.27 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Versions/A/Support/mds_stores
Akes-iMac:~ eldberg$