Comments

13 responses to ““sudo iosnoop” for slowdowns – the most useful command on OSX?”

1. 2009/12/20

   Brian

   Good post, I have seen the same behavior but didn’t know about iosnoop. One more tip for the bag-o-tricks!

   Reply
2. 2009/12/21

   Craig

   Along similar lines, when you see the vm utilisation climbing, its very often in cross-platform apps, typically they tend to leak memory where they seem to bridge to OSX libraries/APIs.

   Try `leaks ` out of interest on a few apps of choice and you’ll see where much of the memory disappears to. Significant offenders recently seem to include Adium, Tweetie and a few others.

   Reply
3. 2009/12/21

   Craig

   Oops, looks like your comments filtered my syntax, I should have escaped my terms. That should read:

   # leaks PID

   😉

   Reply
   1. 2009/12/21

      alecm

      Craig: very cool. Any idea what this might be?

      22:32:41 luther:~ # leaks 6305
      leaks cannot examine process 6305 for unknown reasons, even though it appears to exist. Try running with sudo.
      22:32:43 luther:~ # ps auxww | grep 6305
      alecm 6305 0.0 0.0 0 0 ?? Z 2:31pm 0:00.00 (Chromium Helper)

      …Chromium switches off DTrace, perhaps?

      Reply
4. 2009/12/21

   Craig

   Oh, thats interesting … hadn’t tried Chromium for leaks … maybe its process model?

   BTW, think leaks predates DTrace in OSX by a few releases, so assume its instrumenting malloc routines by traditional methods.

   Odd, latest Chromium nightly seems OK on 10.6.2 with leaks, don’t observe that behaviour, reacts like other apps.

   Reply
5. 2009/12/21

   Craig

   BTW, whilst iosnoop is great for visualising raw IO, OSX has lifted fsevents framework from BSD et al and there is a sweet graphical (freeware) utility called fseventer (http://fernlightning.com/doku.php?id=software:fseventer:start) which tracks traditional FS events.

   Very nice, clean way of tracking IO at a high-level and then revert to DTrace for lower level, ie. block size, operation, etc

   There are some great utilities available or hidden in OSX, its a pity more aren’t better documented … Instruments for instance is an inspired DTrace front-end, which Sun would never have come up with, whilst in standalone tools, Shark is particularly good.

   Have to blog some of these over Xmas …

   Reply
6. 2009/12/23

   Stephen Usher

   You may find this useful:

   http://www.macosxhints.com/article.php?story=20001215021440138

   It’s not a swap partition as such, but what you could do is create an HFS+ partition with a swap file upon it and tell the system swap on it at boot time.

   Of course, by making the file the same size as the disk space available using mkfile(8) it shouldn’t get fragmented.

   Reply
7. 2009/12/23

   Stephen Usher

   Also:

   http://www.math.columbia.edu/~bayer/OSX/swapfile/

   Reply
8. 2009/12/23

   Stephen Usher

   I’ve done some more investigation.

   That’s you’re looking for to control swap is:

   dynamic_pager(8)

   Basically, that organises the the kernel’s swap system. By default it creates 68MB files in /private/var/vm/ named swapfileN (where N is an integer) creating a new one when the previous one runs out of space.

   The 4GB you are seeing when you do a du(1) is actually the sleepimage file, e.g. on my MBP:

   bash-3.2# ls -lh
   total 8650752
   -rw——T 1 root wheel 4.0G Dec 23 16:37 sleepimage
   -rw——- 1 root wheel 64M Dec 23 08:39 swapfile0
   -rw——- 1 root wheel 64M Dec 23 17:10 swapfile1

   I imagine that if you know that you will be using a lot of swap you could tell dynamic_pager to use rather larger swapfiles, such as 4GB, which would then mean that it wouldn’t keep having to do filesystem look-ups when applications are fragmented between swapfiles.

   Reply
   1. 2009/12/24

      alecm

      >The 4GB you are seeing when you do a du(1) is actually the sleepimage file, e.g. on my MBP:

      Actually, Steve, no; my MacMini never sleeps. What I am seeing when I ‘du’ is perhaps 8 or 9 swapfiles numbered 1 thru N, and which start multiplying in size after the first two. Eventually they get up to 1G per file.

      The files are deleted on reboot, they are fragmented, and they are journalled, which makes little sense.

      Reply
      1. 2009/12/24

         alecm

         ps: keep yr mac awake for maybe a month and run virtualbox, firefox and a bunch of other apps. That’s when you see it.

         Reply
9. 2009/12/24

   Stephen Usher

   Hmm.. I may be useful to create a separate partition for the swapfiles then. Format it as a non-journalled HFS+ volume my help as well. There may be a way to persuade dynamic_pager(8) to be started with a large swapfile size to begin with, rather than starting small.

   I’ve not seen any hacks to get Snow Leopard to use swapfiles on a separate volume yet. It seems that there’s no /private/etc/rc script any more which could make things more difficult.

   Reply
   1. 2009/12/24

      alecm

      i found one. it also suggests using UFS as fast-but-correct, and hacking the invocation of dynamic_pager

      Reply