shownotes_20120426

Troubleshooting Tale
  Opening
    Today's show will be a bit of a story, but in the telling I hope you get some insight into the process and procedures that I go through when my Mac starts acting up
    I'm not saying these are necessarily the best or correct procedures, but they are simply an example of a typical path I might take.
  Realizing there is a problem
    I have several USB and FW drives connected to my Mac.
    I started seeing an intermittent error when I would wake from sleep in the morning about a drive not being ejected or disconnected properly
    I thought it was odd and when I would look at my drives all were connected and seemed to be functioning normally
    I shrugged it off a bit figuring maybe it was related to disconnecting my iPhone or iPad, or possibly a wake from sleep issue related to the hard drives spinning down for energy savings
    The messages persisted, but didn't seem to be causing trouble so in this case I opted for the "ignore it" maybe it will go away on it's own fix. This sometimes, but hardly ever, works.
    Slowly but surely I started noticing "beach balls". They were infrequent at first, but gradually became more frequent and would last longer.
    It was when they began to be so frequent that they were actually impacting my workflow that I decided to look into it.
  Diagnosing the issue
    Or at least poking around at what you think the issue may be.
    When I started to actually pay attention to what was causing the beach balls there are some things I look at
      What am I doing at the time it starts (or what is my Mac doing) and is there an action or pattern that can be repeated?
      In this case it seemed to be random at first. My gut was to check the processor and memory usage
        I use two tools for this. First iStat Menus, www.islayer.com
        Also, Activity Monitor
        I looked at what was using processors and how much.
          In Activity Monitor it's common to see the kernel_task and window_server in the list, but they shouldn't be running wild in resources
          CPU will bounce around for different apps, but what your looking for is any one app using a large percentage of CPU for a long amount of time and even then it depends on what it''s doing
          iMovie will use a lot of CPU in Memory when encoding a video for example. that's normal.
        For memory it's kinda the same deal. You're looking for stuff that seems unexpected
        On my Mac I run Crash Plan which uses JAVA and that typically hogs up 500-600 MB of RAM
        It's sometimes helpful to filter out the system processes via the drop down at the top of Activity Monitor. Select just "My Processes"
        In memory i tend to look at Real Memory as an indicator
          Also take a look at the "Page Ins" and "Page Outs" numbers at the bottom. Generally Page ins should be a large number and page outs relatively small
          This is an aggregate running total since your Mac's last reboot so don't worry about the exact size of the numbers, just know Page Ins big and page outs small is good.
          If Page outs is large that typically means your maxing out your RAM and the Mac is having to go Virtual memory which will slow your performance
          In general the fix for this is to not run some many apps concurrently or to get more RAM.
          If the numbers bother you restart your Mac.
    In my case CPU an Memory were normal, but I was still seeing beach balls so again I paid attention to what was happening when they would start.
    That's when I saw that I would get them when Time Machine was running and/or Mail Steward would kick in.
      I have Mail Steward set to run every 6 hours.
    But those items again were not hogging a lot of CPU or memory, so what was the deal?
  Digging deeper
    At this point I was baffled. I had plenty of resources. So where to look.
    This is the point that I turn to the Console to have a look under the hood
    Applications > Utilities > Console
    Looking at "All Messages" I start to look for patterns
      You can also use the "Sender" list in the panel in the lower right. "Click" icon to expand if not visible.
      And the Search box at the top.
    Immediately I saw "imagent: [Warning] Received memory warning, dispatching to listeners" flooding the panel.
    Now I have no idea what that means, but can guess from "imagent" that it might be related to instant messaging?
    Now it's time to Google
      Select the item ion the console and do a copy/paste into Safari.
      Clean up the text to just the pertinent details. Also sometime wrap it in double quotes
      When the results come up I often use the "Show search tools" option in Google to further filter the time of the results to just the past year.
    I discover that this message is in deed simply a "warning" message from Messages Beta and likely there for testing and probably not my issue, but hey I learned something.
    Now it's a matter of repeating these steps.
    Next message is "com.apple.usbmuxd: _SendAttachNotification (thread 0x7fff7e526960): sending attach for device f0:cb:a1:1b:74:14@fe80::f2cb:a1ff:fe1b:7414._apple-mobdev._tcp.local.: _GetAddrInfoReplyReceivedCallback matched."
      This turns out to be related to iTunes and wi-fi syncing of my iDevices
    Then I try: "kernel: IOSurface: buffer allocation size is zero "
      This one turns out to be related to Flash Player
    Finally since Time Machine seems to be a factor in this issue I decide to filter in 'backupd' which is the sender for Time Machine Backups. This was in part prompted by the Fact that my Time Machine was always saying it was backing up 3.89 GB of 3.89 GB, yet otherwise seemed to actually do the normal incremental backup
      This lead to me seeing messages that said "Event store UUIDs don't match naming" and "Deep event scan"
      Googling for these show the first message is normal, but only on the first backup or a failed backup. The second one is somewhat related to this, but indicative of the Time Machine backup drive not being disconnected properly (bingo).
  The moment of discovery
    So now I knew that for some reason Time Machine was seeing issues with the drive being disconnected improperly
    I also new I was seeing those errors related to improperly disconnect drives on wake from sleep, yet the drives were connected fine.
    I also at this point made the connection that my beach balls seemed to crop up when I was doing a lot of disk IO.
    I suspected at this point that I might have a bad drive or cable so I start troubleshooting from there.
    First running Disk Utility. Of course everything there checked out fine
    Then I tried swapping out cables and even moved the Time Machine drive to another Mac.
    I have an external drive that I run my iTunes library from and that is also backed up from Time Machine.
      When I attached this drive to another mac and tried to backup some of the larger files, boom it stalled and locked up the other Mac.
      If I would power off the drive then Mac would snap back into life.
      I was connected on USB and this was a quad interface drive to I tried FW 800 and had the same result.
      I now began to suspect this drives controller chips or main interface board possibly having gone bad.
    I pulled the drive and direct connected it using a Newer Tech USB 2.0 Universal Drive Adapter, www.newertech.com—usb2_adaptv2.php
    The transfers at that point worked fine, so I was fairly sure I found my culprit.
  Resolution
    Luckily that drive was still under warranty so I contacted the manufacture and got an RMA and am sending it in.
    My Time Machine backup I think was maybe OK, but since it was still reporting wanting to do a large backup each time and doing the deep scan thing I decided to re-format and re-start the Time Machine backups from scratch
    Of course I lost the previous history, but that wasn't a big deal for me since I have CrashPlan and other archives and backups.