"spindump" Processes - Dump Memory Contents

Mac Tutorials - Herong's Tutorial Examples

∟"spindump" Processes - Dump Memory Contents

This section describes 'spindump' processes, which are created by the operating system to catch hang (not responding) application processes and save their memory contents as dump files.

What are "spindump" Processes? - "spindump" processes are created by the operating system to catch hang (spinning, not responding) application processes and save their memory contents as dump files.

You can view dump files to troubleshoot root causes of application issues.

Dump files are also sent to Apple server for their developers to review.

Here is what I did about "spindump" processes.

1. View "spindump" processes with "ps" command.

herong$ ps -A | grep spindump

  366 ??         0:25.26 /usr/sbin/spindump
  622 ??         0:00.36 /usr/libexec/spindump_agent
10405 ??         0:00.29 /usr/libexec/spindump_agent

2. Check CPU and memory usages of "spindump" processes using "top" command. They are taking a large amount of memory.

herong$ top -pid 366 ...

PID  COMMAND      %CPU TIME     #TH  #WQ  #POR MEM  PURG CMPR  PGRP PPID STATE
366  spindump     0.0  00:26.68 3    2    114  30M  0B   51M   366  1    sleeping
622  spindump_age 0.0  00:00.35 2    2    51   660K 0B   1036K 622  1    sleeping

3. If you are concerned about dump file being sent to Apple developers, you can try to disable "spindump" processes. But you may get a system error:

herong$ sudo launchctl unload -w \
  /System/Library/LaunchDaemons/com.apple.spindump.plist

/System/Library/LaunchDaemons/com.apple.spindump.plist:
  Operation not permitted while System Integrity Protection is engaged

So you have to disable "System Integrity Protection" first, which can be done by running Mac in "Recovery Mode" with this command:

herong$ sudo csrutil disable

4. You can also run "spindump" manually to create a dump file for a given process using "Activity Monitor" by selecting the process and clicking "View > Run Spindump" menu.

Here is an example of "spindump" file generated from "Activity Monitor".

OS Version:      Mac OS X 10.12.6 (Build 16G2136)
Architecture:    x86_64h
Report Version:  25

Data Source:     Stackshots

Command:         bash
Path:            /bin/bash
Version:         ??? (???)
Parent:          login [10260]
Responsible:     Terminal [10151]
PID:             10261

Duration:        10.01s
Steps:           1001 (10ms sampling interval)

Hardware model:  MacBookPro13,3
Active cpus:     8

Fan speed:       2149 rpm

------------------------------------------------------------
Heavy format: stacks are sorted by count
Use -i and -timeline to re-report with chronological sorting
------------------------------------------------------------

Process:         bash [10261]
Path:            /bin/bash
Architecture:    x86_64
Parent:          login [10260]
Responsible:     Terminal [10151]
UID:             501
Task size:       28 KB
...