Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!

Diagnose and recover from a coreservicesd hang System
I recently had a series of lockups on my Mac OS X 10.2.8 dual 1.25 G4 system. It started with Finder hanging whenever I clicked on a certain folder on my system. This folder contained two apps and several folders containing JPEG photos -- nothing all that out of the ordinary. When the Finder would hang, other apps would start to hang as well, like the Dock and LaunchBar, two apps with which I could launch Terminal. Eventually, all apps would hang and the spinning beachball of death would remain.

ssh-ing into the machine, I discovered that the process coreservicesd was consuming 100% of one of the CPUs. I could kill this process and it would unhang the system, but then no icons would be displayed on any apps, and drag-and-drop would no longer work. The only way to fix this new mode was to reboot. Then clicking on the original folder would cause the hang again. I tried rebooting using the installer disk and ran Disk Utilities, only to find no errors on the disk. I tried rearranging the folder via Terminal to find that the app inside was the culprit. So, I moved it to the trash and deleted it. Upon reboot, the system would hang when logging in. coreservicesd was the culprit again, only now it would do it at login!

Some further poking around, using Find to find files that had changed in the last day, I found files in /Library/Caches had changed. Since coreservicesd seems to be responsible for providing icons and such to apps, this seemed a likely source. Renaming the folder and rebooting fixed the problem! So, it appears that files in /Library/Caches can get corrupted and cause coreservicesd to get wedged which freaks the whole system out, since it seems as though all apps use this service.

If this happens to you, check here. Also, for other issues that may arise one day, try finding files that have been modified in the last day to see what has changed.
    •    
  • Currently 3.56 / 5
  You rated: 1 / 5 (9 votes cast)
 
[32,913 views]  

Diagnose and recover from a coreservicesd hang | 26 comments | Create New Account
Click here to return to the 'Diagnose and recover from a coreservicesd hang' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
The find command
Authored by: Brock Lee on Oct 17, '03 11:45:26AM
I don't know how many people are familiar with *nix's find command, but I thought I'd offer some tips here.

The following command would find all files modified within 24 hours:

sudo find / -mtime -1

The third item on the command-line (/ in the example) is the directory to search within and below. The slash represents the root directory and will cause everything to be searched.

The -mtime item on the command-line means the search is being done based on modification time.

The final item on the command line (-1 in the example) means less than one day. Days are defined as 24-hour blocks and make no reference to midnight. Of course +2 would mean more than two days ago, and so forth.

[ Reply to This | # ]
Pipe results into more
Authored by: matx666 on Oct 17, '03 01:14:03PM

tack on an extra

| more

to see results by the screenful

or redirect into a txt file

> changes.txt



[ Reply to This | # ]
Diagnose and recover from a coreservicesd hang
Authored by: popguru on Oct 17, '03 12:26:04PM

Interesting...I've never had quite this problem, but I've occasionally had coreserviced crash (screwing up icon display and preventing drag-and-drop, as described above). I've tried to restart coreserviced from the command line with sudo, but it doesn't seem to fix the problem, and I'm forced to reboot to get things working normally again. Anyone know a way to restart coreserviced without having to reboot?



[ Reply to This | # ]
Diagnose and recover from a coreservicesd hang
Authored by: lpaquet on Oct 17, '03 12:48:14PM

I have similar problem at home.

My screen turn black, but some software still run in background, iTunes as an example.

I'll try your hints tonight.



[ Reply to This | # ]
Diagnose and recover from a coreservicesd hang
Authored by: cooperman on Oct 17, '03 01:36:11PM

I havent tried this to fix a coreservicesd problem but the 'normal' way to restart a process is to use the kill command. Heres how:

Firstly find out the process ID of the offending program by using the following command and looking for the pid that corresponds with the dodgy process:

ps -ef

Once you have the pid, issue the following command as root (using sudo if you can):

kill -HUP pid

where pid = the numerical process ID.

This should restart the single process. Hope it helps.



[ Reply to This | # ]
Diagnose and recover from a coreservicesd hang
Authored by: cooperman on Oct 17, '03 01:46:26PM

Sorry, that should have been :

ps -aux

to see the process listing.



[ Reply to This | # ]
Diagnose and recover from a coreservicesd hang
Authored by: stetner on Oct 17, '03 08:20:26PM

Kill does not 'restart' processes, it sends a signal to them, and if they catch the signal they can restart themselves. If they don't catch it (or ignore it), they die. If they have been started by a watchdog type process like init, they may be restarted if they have been configured to restart.

Therefore you need to know what the specific process in question will do when 'killed'.

I have not looked into whether coreservices will restart or not, but I am just pointing out that kill will not, in general, 'restart' processes.



[ Reply to This | # ]
Diagnose and recover from a coreservicesd hang
Authored by: popguru on Oct 19, '03 03:59:11AM
In case anyone's interested, I may have figured out the answer to my own question. OS X starts coreservicesd with the arguments -preload AEServer. You can confirm this by doing ps -axww | grep "coreservicesd" | grep -v grep in the Terminal while coresericesd is running. The AppServices StartupItem actually starts the coreserviced process (see: /System/Library/StartupItems/AppServices/AppServices). So, if coreservicesd crashes on you, you may be able to start it again without rebooting by doing:

sudo -b /System/Library/CoreServices/coreservicesd -preload AEServer

...though I haven't tested this yet.

[ Reply to This | # ]

Another Way
Authored by: UCMacGuru on Oct 19, '03 06:26:08PM

Another (maybe cleaner) way to start coreservicesd back up is:

sudo systemstarter start "Core Services"

You'd think you could issue the command with "restart" but looking at the AppServices script shows that "restart" does nothing - I guess because Core Services is never *suppose* to stop.



[ Reply to This | # ]
Diagnose and recover from a coreservicesd hang
Authored by: CyborgSam on Oct 17, '03 01:20:27PM

Thanks for the caches tip. I had deleted them using some canned app, but that didn't help.

As far as I can tell, some combination of Unsanity's haxies I have installed plus Default Folder X cause my icons to blow up. I get screens where all the icons are blank, all the same icon, and all the wrong icon. Today, if I move an icon on my desktop it disappears, I have to quit the Finder and restart it to see things...

It would be really nice to be able to clear the cache and restart coreservicesd without rebooting! Or, it would be perfect if Apple would find and fix this bug.



[ Reply to This | # ]
Diagnose and recover from a coreservicesd hang
Authored by: zygote on Oct 17, '03 03:10:26PM

Cocktail might be useful for deleting this cache.



[ Reply to This | # ]
Diagnose and recover from a coreservicesd hang
Authored by: JimMueller on Oct 18, '03 01:12:24PM
There are several lines of discussion I started or contributed to in Apple's Forums about funky icon activity, and finally Francine Schwieder - who sounded knowledgable - said it was a known bug in the Finder if custom icons are used (ie: preview icons generated by Photoshop, GraphicConverter, etc)

> Message #7.1.1.1: RE: disappearing icons ...? Posted by Francine Schwieder on 03:28am Sep 20, 2003 CDT

No, it's a Finder bug. Here's something I wrote about it for a Jag Problems articele:

Any application that creates individual custom icons, such as Photoshop or PS Elements, can cause the Finder to fail to correctly update an open window containing said custom icons. What happens is that some other custom icon is plastered onto your freshly saved file, rather than the one that should be there. The Finder seems initially to give the icon for the file being saved to the file next to it also, but it has assigned some other icon, seemingly picked at random, as well. You can end up with a folder full of identical and incorrect icons. If you force quit and relaunch the Finder it then gets them right, until the next time you save anything, including another file, whereupon the problem recurs, with everything regaining the incorrect icons, plus yet another file receives a wrong icon. Even moving a file into or out of the open window can provoke Icon Madness. You can use this AppleScript to force the window to actually update the icons correctly, but they revert to an incorrect state each time you do almost anything, such as copy another file, open a file, whatever:

tell application "Finder"
update every file in folder of the front window
end tell

If you're doing stuff requiring you to keep the Finder window open you'll have to repeatedly run the above script. I put a copy of it in my dock so I could just click it there and update the window every time I saved a file. You can save the script in your Utilities folder, name it something like "Update" and give it a custom icon so you can spot it easily when it is in the dock.

Francine

>

[ Reply to This | # ]

Diagnose and recover from a coreservicesd hang
Authored by: zo219 on Nov 29, '10 07:36:22PM

Have you tried adding coreservicesd or any other suspect process to Application Enhancer's Master Exclude List?



[ Reply to This | # ]
Finder hang on netowrk
Authored by: rockman2023 on Oct 18, '03 01:46:04PM
(WOOT! my first post :D )
My Finder usually hangs when I try to eject a shared disk from the PC on the home network AFTER it's been shut off. All of the other apps then become unresponsive and I'm forced to reboot.

[ Reply to This | # ]
Finder hang on network
Authored by: PasteEater on Oct 20, '03 03:21:32AM

This is a common problem, and happens whenever the mounted volume is "disconnected" somehow without being "ejected" by the Mac. Your Mac keeps searching for the volume at the last known address only to find nothing. I learned this by accidentally having some drives mounted over Airport, and then leaving the network.

You don't actually have to reboot. The process will timeout, but I think that it takes about 3 and a half minutes to do so. Also, don't try killing and restarting the Finder while it's searching; then you WILL have to reboot.



[ Reply to This | # ]
Diagnose and recover from a coreservicesd hang
Authored by: orbifold on Oct 19, '03 10:26:49AM

I'd been having wiggy problems with my iPod not showing up properly in iTunes, and with the Disk Utility not seeing any drives to repair and check (something that had fixed the problem in the past). Wierdly enough, the steps outlined in this hint fixed those problems as well. Go figure.



[ Reply to This | # ]
Tiger is effected as well!
Authored by: ktohg on Aug 09, '05 04:39:30PM

I just had a nasty bit of a pickle today concerning this hint. Thank the Gods and Goddesses that this hint was here or I'd have have had to take a long trip to the Apple store.

Anyway I'm using Tiger 10.4.2 and just installed the latest updates for 8/9/05 and the finder just started freezing with the indefinite pin-wheel. At first it started with me inserting a Neverwinter Nights CD and soon every time I'd reboot. Had to force power off by holding the power button for 10 sec since the system would render itself unusable (I didn't try SSH).

So I rebooted and entered single user mode (hold Apple-S keys while you turn on machine). I then read the system.log file to try and diagnose what happened.


root# cd /var/log
root# less system.log

I found at the end that a program called coreservicesd crashed and an attempt to dump the core and crash report was done. So I went to my handy dandy macosxhints search tool and found this thread and attempted to try the suggested fix.


root# cd /
root# mv /Library/Caches /_Library_Caches
root# reboot

This fixed it! So this infamous "Cache" problem still happens in Tiger. To all ye best of luck.



[ Reply to This | # ]
Tiger is effected as well!
Authored by: slashj on Aug 10, '05 11:52:44AM

I have 10.4.2 and was unable to log on, even in safe mode.
None of the usual stuff worked. This hint, however, did.
Life saver.



[ Reply to This | # ]
More symptoms to this "cache" bug
Authored by: rdstokes on Oct 13, '05 10:21:58PM

This solution helped me today so I thought I'd provide more symptoms to the bug. We're running a PPC Duel G5 on MacOS 10.3.9 in a graphics environment.

The problem occurred after a nice clean restart of the computer. The computer had just gone through monthly maintenance so drive corruption, permissions, launch services, etc. were all in working order. When the computer booted, the Finder would launch, the Dock worked correctly, and the computer ran for about 45 seconds. Then, the fans would race for 10 seconds followed by a spinning ball. If you clicked on a menu, the menu title would darken, but would not pull down. You could switch between open applications but could not execute any commands.

I had two other operating systems on different volumes. If I booted from either of them, the same symptoms occurred. However, if I boot from another volume and immediately trash the volume with the cache, the problem would not occur. In theory, booting from another volume should not result in the same symptoms. Can anyone tell me why it does?

The way I found this post was because I immediately opened a Terminal window after boot and ran the top command. Once the fans raced, I noticed that the unix process "coreservic" was hitting 98%, 99%, 100%, or 101%. A simple search on coreservic or coreserviced got me to this post and helped me resolve my customer's issue.

Thanks,
Rob



[ Reply to This | # ]
More symptoms to this "cache" bug
Authored by: rdstokes on Oct 13, '05 10:29:49PM

This solution helped me today so I thought I'd provide more symptoms to the bug. We're running a PPC Duel G5 on MacOS 10.3.9 in a graphics environment.

The problem occurred after a nice clean restart of the computer. The computer had just gone through monthly maintenance so drive corruption, permissions, launch services, etc. were all in working order. When the computer booted, the Finder would launch, the Dock worked correctly, and the computer ran for about 45 seconds. Then, the fans would race for 10 seconds followed by a spinning ball. If you clicked on a menu, the menu title would darken, but would not pull down. You could switch between open applications but could not execute any commands.

I had two other operating systems on different volumes. If I booted from either of them, the same symptoms occurred. However, if I boot from another volume and immediately trash the volume with the cache, the problem would not occur. In theory, booting from another volume should not result in the same symptoms. Can anyone tell me why it does?

The way I found this post was because I immediately opened a Terminal window after boot and ran the top command. Once the fans raced, I noticed that the unix process "coreservic" was hitting 98%, 99%, 100%, or 101%. A simple search on coreservic or coreservicesd got me to this thread and helped me resolve my customer's issue.

Just to recap, here's the solution:
Boot into single user mode (hold Apple-S keys while you turn on machine) and type:

root# cd /
root# mv /Library/Caches /_Library_Caches
root# reboot



[ Reply to This | # ]
More symptoms to this "cache" bug
Authored by: ioshy on Nov 29, '10 09:34:39AM

Worked like a charm for me.
I did that because both "mdworker" and "coreservicesd" were crashing repeatdly on my Mac Pro Dual Core Intel Xeon running Mac OSX 10.5.8

Thanks for the hint !



[ Reply to This | # ]
Tiger is effected as well!
Authored by: luhmann on Oct 26, '05 07:34:01AM

Confirmed that 10.4.2 still has this problem. I think it started after a network drive was improperly removed.

No need to start up as root to fix the problem though. Just use "sudo" for the "mv" command and it will work fine.



[ Reply to This | # ]
Tiger (10.4.9) is effected as well!
Authored by: philliptiongson on May 07, '07 08:07:57AM

10.4.9 still seems to be affected by this. My computer has been hanging almost every day, and it happens especially when our backup porcess occurs. I have changed the name of Caches using sudo, and hopefully it will do the trick.

Thanks!



[ Reply to This | # ]
Leopard is affected as well!
Authored by: pdxguy on Apr 28, '08 07:54:33AM

Ran into the same problem under 10.5.1. Was able to boot in single-user mode and browsed the log files. Found that coreservicesd crashed right after booting, even before I got the login window. Followed the tip here about moving it, rebooted, and was good to go.

---
Nothing will ever be attempted, if all possible objections must first be overcome.
-- Samuel Johnson



[ Reply to This | # ]
OS X Server 10.5.7 is affected as well!
Authored by: zebrum on Jun 20, '09 06:14:07PM

Ran into this same problem on OS X Server 10.5.7. mdworker and coreservicesd were crashing repeatedly about 1 minute after boot and the UI became frozen. Luckily I could SSH in and move the Cache folder as said.

Also I could temporarily fix by disabling mdworker with:
sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.metadata.mds.plist

However that meant I couldn't use Spotlight. So yeh moving the Cache folder fixed it for me.



[ Reply to This | # ]
Diagnose and recover from a coreservicesd hang
Authored by: majestic07 on Jun 09, '08 08:31:17AM

This still seems to happen in Leopard (10.5.3). My system hasn't hung in awhile, but lots of memory being used and memory paging was causing hiccups in use.

I used OnyX (free) to clear the caches (everything but kernel - it takes a long time to reload) and it seemed to work. BEWARE: this could affect some preferences. (I cleared user caches as well and needed to reselect my colorsync profile!)



[ Reply to This | # ]