High fan RPM before login.

[naryfa]

Sorry to open another one, but would you know how to diagnose what causes the fan to run at high rpm on the login screen? Right after startup, when the login screen appears, the fan ramps up and it'll stay there until I login. It won't happen again until the next reboot / turn-on.

[zearp]

Few questions:

1: You say the fan stays at max speed until you login, so It would spin for an hour if you don't login for an hour?

2: Did you install any new apps that might be using a lot of cpu right before login at the end of there OS boot process?

3: Do any apps have a high cpu time or cpu usage in the Activity Monitor? Check right after you login.

I guess something is causing a big spike in cpu usage. Most likely some new app or something. I've not experienced this myself and I do clean installs quite often and am pretty sensitive to fan noise. I think I changed the fan profiles on all of them. Depending on what kind of stuff is installed t doesn't have to be abnormal for any OS to spike in cpu usage right before login.

Either way this is not something caused by there EFI or that could be solved with the changed in the EFI. It's just how it is. You could go by what's stuff is starting up and see what could cause such a spike in cpu usage.

The only thing strange is that you say the fan stays on Mac speed until you login, so if you don't login for an hour it stays at max fan speed for an hour? Cuz that would be weird and not intended but even if that's the case I really have no clue what to do about that. The only fan controls we got are in the BIOS and in macOS we can only read out the fan speed since recently, nothing more.

Please leave some more information. The only way I can be of any help is if I can reproduce the issue myself. Otherwise it's just guessing. So if you can come up with a method that always results in the same behaviour that would be very helpful. If you got a spare disk and some spare time do a clean install and see if it happens again.

It might also be useful to setup some kind of cpu logging but I wouldn't know how to do that during boot up. You may need to dive all the way into kernel debugging to be able to see processes and their cpu usage before the OS is fully loaded up. That would be the only way to see whats actually using the cpu as far as I can think of.

You can also try to open the Activity Monitor app as fast as possible after you logged in and sort by cpu usage and also sort by cpu time. Any processes that have used a lot of cpu time right after logging in could be part of the issue.

Good luck!

[naryfa]

Hey, thanks for the response. I couldn't check back earlier.

Yes, unless I log in, it stays on high RPM (not max but high) for as long as it's on the login screen. Right after I log in, I get an even faster spin and then it settles down. I wish there was a way to fire up a terminal on the login screen, I could then check htop, because launching the Activity Monitor takes too long.

EDIT: I just found a secret console mode on login screen. Will check that out.

[zearp]

It's really peculiar it stays at a high rpm just being idle on the login screen until you login. It suggests something is running and eating up all your cpu cycles and isn't stopping. My first instinct would be some software is running. It could be a user installed daemon or app or a system one.

Without seeing the processes causing the cpu loads its gonna be pretty tricky. You can try booting in safe mode by adding -x to the boot flags, it might do nothing but would be interesting to know if it happens there too. Safe mode disables quite some stuff maybe the cause is among it.

I just did a clean install of Monterey the other day to test my EFI changes and dual screen stuff and while the install took a long time and made lot of noise during the install once it was done and also done with the initial optimisation things were fine.

I don't know what macOS you're using or if you installed any software or not. If it happens on a clean install without anything extra installed it would mean I should be able to reproduce it since all these NUCs are exactly the same.

Try safe mode and for good measure reset NVRAM too, sometimes it can cause really weird issues if there's stuff in there that doesn't belong. You can also use an app like Knock Knock to see all the login items and other things running in the background. It will reveal all the things that are started at boot/login so maybe something can be found there.

A secret console mode sounds good, never heard of that before!

I got into some kernel logging a while ago but it requires another Mac to receive the log messages and there wasn't really a way to monitor things other than breaking into debug modes. Which is a bit above my pay grade lol.

[naryfa]

I ran htop with sudo and see some items gobbling up the resources. (By the way, this is a good way of troubleshooting, enable SSH on the Mac, log in from another machine via putty or Linux, and run sudo htop - provided you installed htop)

Here are the misbehaving items:

[naryfa]

How do I enter safe mode?

[zearp]

Check the logs for SecurityAgent messages. Both of those daemons are used by many system parts. I don't know your setup but it could be something like disk encryption that wasn't finished fully for example. It does those jobs at higher priority when the system is idle.

At some point whatever its doing should be done. What's the max time you've let it run and do its thing? I don't know what macOS you're running but Big Sur and Monterey even more, do a lot of stuff after installing/upgrading. It took quite some time on my test machine to idle with nearly no cpu usage after a clean install. I have no clue what it all does, on one or two occasions I got a popup saying performance is reduced until it's done with whatever it was doing. But it does take some time before its done with all the stuff it does. I usually keep Activity Monitor open.

Logs will help more than safe mode (-x boot flag). There should be messages about both those daemons which will help you in knowing what they're doing. Open Console app or use grep in /var/log since you seem to know your way around there and search for the names of those processes and see what you get. Pretty sure it logs what its doing and should at least give an indication of what's tis doing.

Could also be triggered by 3rd party apps that request something that they can't do or get stuck in or something. Logs are the way to go now you know which deamons are eating up the cpu. You didn't say what kind of apps are installed our if just a clean install. I did some clean installs of Monterey and didn't experience this.

If it would happen to me I'd first let it do its thing and see if it goes away after an hour or so. Also, it may still be running the same jobs or whatever it is after you login but it changes the priority to be very low, then it will be using nearly no cpu unless the user is idle.

Good luck.

[naryfa]

Well, I do have a ton of apps. Listing them would be... tedious. The OS is Monterey.

I disabled SIP and unloaded this daemon sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.systemstatusd.plist

It is nearly impossible to find anything about it on Google, other than that's some kind of iOS SDK mentioned here: https://github.com/xybp888/iOS-SDKs/blob/master/iPhoneOS13.0.sdk/System/Library/PrivateFrameworks/SystemStatusServer.framework/SystemStatusServer.tbd

Problem is, I don't know whether it is necessary for the OS to function. Once I unloaded it, the macOS Security Agent stopped and logd stopped as well.

So I know it's this daemon (Matt Daemon lol), but who knows what it does and whether something from my iPhone has gotten stuck somewhere during one of the previous syncs. I don't know, it's getting convoluted.

Sorry to bother and thank you again for the kind help.

[zearp]

Was there anything useful in the logs? I checked my logs and I think it also does the verifying of apps, which can be taxing on the cpu but not always have to. It should not do that before you login though but who knows. Xcode could be a candidate for causing it, I've had some issues where Xcode keeps verifying itself on Monterey. Despite it not being updated at all. It doesn't cause much load but it does take forever to finish.

log show --predicate 'process == "SecurityAgent"' --style compact --source --last boot

Should show you all that it has done since last boot, which shouldn't be too much if you do it right after login. Seems it checks for Apple watches nearby when its booting up:

SecurityAgent[721:1a73] [com.apple.LocalAuthentication:Client] <LocalAuthentication`-[LAContext canEvaluatePolicy:error:]> canEvaluatePolicy:3 on LAContext[721:1] cid:3 returned Error Domain=com.apple.LocalAuthentication Code=-11 "No AppleWatch was discovered." UserInfo={NSDebugDescription=No AppleWatch was discovered., NSLocalizedDescription=No  Watch was discovered.}

They use an Apple logo instead of writing Apple in that entry lol.

I hope you can sort it out but it might be just part of the beta or some incompatibility somewhere. Good one on enabling ssh btw, its probably started early on in the boot process too so if you can login quick you can monitor the last bits live haha. I'll remember that one!

Meanwhile on my Monterey NUC:

[naryfa]

Wow, that command shows a ton of things. I searched for "err" and I'm not sure I understand what it says (Mostly something about CFPasteBoard) Would you have a quick look? Perhaps you see things I don't? I'll understand if it's too much to ask, the file seems large.

lastlog.txt

[zearp]

I also have those PasteBoard errors too so I guess we can rule those out. My log after booting was under 100 lines, yours is over 300. Many explained cuz I have FileVault enabled on this computer so there's a lot less going on, no login prompts to be drawn and such. That's all done right after it loads the kernel.

Other than those login related entries I can't really spot anything that's not in my log too error wise. You could check the logs for the other process that was using the cpu. Or start excluding (removing) apps, I would start with Xcode. Was it all good in safe mode?

Making a (Time Machine) backup and doing a clean install and then add apps back either by dragging them in or using the migration tool to also include the app settings is also an option. It's tedious but if you must know whats causing it might be the only way to find out when nothing usable is in the logs.

You don't have to add or remove the apps one by one but do it in groups instead. Remove 10 apps and reboot, if the problem is gone you know its part of those 10. Can save quite some time troubleshooting.

[naryfa]

Well, I think I've searched enough. Since you don't have that problem, it must be some app on my end requesting something before I login. The only thing I can do is to disable SystemStatusD. It appears to spawn an xpcproxy which may be used by SpringBoard to display notifications (On the lock screen, I guess?). I don't know, I rest my case for now, at least until the next time I have to do an update.

PS. I don't have xcode installed

[zearp]

I would try a clean install after making a backup or on another disk if you got any. It would be the quickest way to see if its something thats been added or caused by something else. I've done a few clean installs so far and waiting on the login screen and while after initial install the fans and cpu is higher, once its done with Spotlight indexing and whatever else it does things calm down. Also when I don't login and leave it idle on the login screen. It will eventually go to sleep when left alone.

[naryfa]

I do have a lot of setting up after a clean install and that just takes so much time that I'll hold off for now. After all your own testing I have to assume it is some software I installed. I really appreciate your effort, thank you so much. I'll continue with your tutorial on post-install and try some undervolting in spare time. You made me one happy person, my old Clover setup would even take the original BT/WiFi card lol, but that's a whole different story.

[zearp]

With macOS if you have a backup of your data either with Time Machine or a clone you can restore all your apps and settings from it with the builtin migration tool that can do all the work. I just mentioned reinstalling as sanity check. But I know not everybody has the time for that our has spare ssd's laying around. I do wonder if you would get the same behaviour if you enable auto-login or FileVault.

I did a clean Big Sur install only a few hours ago to check up on bluetooth. Leaving that one at the login screen sitting idle doesn't result in fans ramping up. So I can only agree that it must be something 3rd party, some apps like to start background tasks and linger around all the time. Even ones you wouldn't suspect like Chrome and their updater always running in the background. Shouldn't cause the cpu to be under load until you login but a memory leak or a bug can easily cause such odd behaviour.

[zearp]

Today I did a clean install of Monterey beta 3 and it did the same thing, same processes too. As soon as I login things are normal. I don't think this is something either caused by the EFI or in our control. Seems the systems system status deamon is just running out of control until you login on the machine itself.

I let it sit idle while watching it over ssh in top like you did and it keeps using lots of cpu while seemingly doing nothing at all. No other software is installed, I'll peek in the logs later and see if there's anything that would indicate what its actually doing. Will see what I can find but can't promise a fix other than to enable either auto-login or FileVault encryption.

[zearp]

root               314  83.8  0.0 33697500   2816   ??  Rs    7:43PM   3:11.54 /System/Library/PrivateFrameworks/SystemStatusServer.framework/Support/systemstatusd
_securityagent     324  50.8  0.5 34052524  42976   ??  Ss    7:43PM   1:57.29 /System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent

Log entries for systemstatusd shows a gazillion of rejected connection attempts.

localhost systemstatusd[314]: (libxpc.dylib) <libxpc.dylib`_xpc_connection_mach_event> Peer connection was rejected by the listener (xpc_connection_cancel())

If I didn't mess this command up, it's over 2 million entries?

sh-3.2# log show --predicate 'process == "systemstatusd"' --style syslog --source --last boot | wc -l
 2158571

The other process SecurityAgent doesn't have much in the logs and it seems to stop producing logs after a few minutes while the other process is spamming so hard the system can hardly keep up. There is almost 500MB of logs in /var/db/diagnostics on a clean install, no iCloud or anything.

I'm not a developer and have no clue about Apple's XPC API and how to figure out what it's trying to do that is causing this. I wouldn't call it a race condition as it doesn't crash but it sure is odd and shouldn't happen. Searching on the error message itself leads to nowhere. The last part of the error message is also not very helpful to me.

xpc_connectioncancel(:) Cancels the connection and ensures that its event handler doesn't fire again.

https://developer.apple.com/documentation/xpc/1448777-xpc_connection_cancel/

My best guess would be that something wants to connect to a service that is rejecting it, but what service is rejecting which request and from whom is a mystery to me.