December 14, 2005

Curious George Recently my mac has been reporting a lot of CPU useage (40%+ as reported by SysStat widget) by a process called "Isof". Spotlight can't find anything related to it, and I don't remember seeing it before this week (I've had the computer since the summer). Any ideas what's going on?

Subquestion: free spyware/antivirus software for OSX?

  • The only things I've installed recently are Firefox 1.5 and the Deer Park G4 version (I'm using a Mac mini).
  • Subquestion: free spyware/antivirus software for OSX? Viruses don't exist for mac os x and neither do spyware. Macro viruses like word docs can run under mac os x but they will only damage your word files. Root kits exist but you have to install them and give out your password to install them. Also there are not allot of root kits around. Download Clam X Antivirus if you are worried about rootkits or macro viruses or if you are passing on Micro$oft Windows Viruses from you Mac to PC users. From the Clam X page "Back in the days before OS X, the number of viruses which attacked Macintosh users totalled somewhere between about 60 and 80. Today, the number of viruses actively attacking OS X users is...NONE! However, this doesn't mean we should get complacent about checking incoming email attachments or web downloads, for two reasons. Firstly, there's no guarantee that we Mac users will continue to enjoy the status quo, but more importantly, the majority of the computing world use machines running MS Windows, for which an enormous quantity of viruses exist, so we must be vigilant in checking the files we pass on to our friends and colleagues etc."
  • I found this: isof This UNIX utility displays the status of a process and determines if it is friendly or malicious software. And Isof.tar Monitors prcoesses on *nix operating systems. [ Download File ]
  • As per your process I can't find anyting online about Isof. Are you sure it isn't a typo? I have been searching in Goole under both "Mac Os X process Isof" and "Darwin(Mac OS X's BSD subsystem)process Isof" getting zilch... I am emailing my Apple employed developer friends now...
  • I've got a screenshot of sysstat's display with Isof taking up 20% of my processor. Like I said before though, it spikes over 40% at times. The only place I could think to post the pic is in my myspace though., click on 'view more pics' to see it.
  • Sir, get Flickr 'tis free
  • are you sure it's eye-sof and not ell-sof? lsof is a command that lists files opened by processes on your computer. can't imagine that it'd be taking up much CPU time though, as it works like ls - when it's done, it quits. unless a scheduled task is using it or I missed something when I scanned the man page.
  • From what petebest reports, could be used by the sysstat widget itself. For example, if you run top -u in a terminal window (gives you a list of active processes, sorted by processor use) I often find that top itself is taking 20% of system cycles! This isn't the case if the system is under any load, so it's probably an artifact of top's sampling. You could test this by shutting off the widgets and then using top to see if it's still there.
  • I'd test it myself, but I'm running 10.3.9 so no widgets. Sniff.
  • I believe it is Safari; close safari, you may be running some hefty script.
  • flickr of the screencap: I don't think it's sysstat, as that has its own process name (sysstat) and I've been using that for months and I've seen Isof (or lsof) only this past week. It's not safari, as I'm using firefox. I'll comment after I try that top test.
  • lsof is a Unix utility for checking processes. You have it on your Mac, because your Mac is built on Unix. You can find information on lsof by opening a terminal window and typing "man lsof". (Note: I do not know how to open a terminal window on Mac - maybe someone else can fill us in on this?) I found a copy of the man page online here "lsof" is short for "list open files." By the sounds of it, I think what you're seeing is probably the SysStat Widget itself.
  • If you want to test that theory, open a command shell and type 'ps'. This will give you a process list. If lsof is still there, you know it's not the sysstat widget. You may also be able to use top in a command shell to see the list of running processes. Type in P (note: upper-case P) to sort by CPU usage.
  • I don't think it's the sysstat widget... awaiting developer response...
  • Good one with the screencap, tylermoody! I notice that the process has only been running for 17 seconds. That means that either it's something you had just opened when you took that screencap, or it's a process that's being constantly called by something else (cough sysstat cough). From a terminal window, you can look for just the lsof process with the command: ps aux | grep lsof (Note the pipe character | this is shift+backslash, directly above your right-hand Enter key. Also, I'm pretty sure it's Lsof, not Isof, although looking at the screenshot, I can see how it would be easy to mistake the two.) This will save you running top, which can be a little hard to watch, because of the animation. You can also list a static snapshot of everything running on your system with the command: ps
  • update: 2 new flickr caps, both taken at the same time sysstat top these are from the same screenshot (you'll notice top is greyed from being under my widgets). Top didn't see lsof at all. I'm guessing that sysstat .99 is lying to me now.
  • the whole screenshot:
  • mechagrue: sysstat has never told me that lsof has been running for more than 20 seconds. I tried ps aux | grep lsof and got this: tylermoo 2009 0.0 0.0 27820 4 p1 R+ 3:44PM 0:00.00 grep lsof I don't know what any of that means.
  • I've caught lsof through top now, I guess that top and sysstat refresh at different rates.
  • tyler: Don't fret it. Nothing unusual is clogging your Mac's arteries. The grep command merely reported to you that it saw itself (spooky, huh) in the system process list. The lsof command is a barebones system command called by sysstat. In short, your system is in fine working order, from the looks of it, doing nothing unusual. @Fellow monkies: Never have I seen a grouping of (competent) linux act so helpfully and in a non-insulting manner. I'm suffering system shock from not seeing anything along the lines of 'RTFM.'
  • I would use the ps command to find the parent process of your lsof process. Perhaps 'ps -fax'.
  • Actually, there's a much easier way to see what's running than firing up the terminal, and it will incidentally allow you to test and see if the Systat widget is the source of the lsof process. Inside your utilities folder is an application called 'Activity Monitor' which will list running processes. You can launch it, find the lsof process, close the Systat widget, and see if the process stops. You can also double-click the lsof process in the Activity Monitor window, which will open a more detailed view of the process, and incidentally tell youat the top of it what its parent process is. Depending on what's calling it into action, this may or may not shed light as to what's causing it to run. [As a side benefit, you can right/control click the Activity Monitor icon in the Dock, and choose to show CPU usage while it's running. I usually leave mine running doing just that -- it provides a useful visual cue when something spikes the processor, though I've noticed my own Mini will usually let me know on its own through the fan ramping up to speed when that occurs.]
  • 'top -u' in terminal is useful to look at such as well. Don't be surprised to see the 'top' command sucking up a bit of CPU itself.