MacOS – AddressBookManager using 100% CPU

"I wish there was a way to "get inside the Finder's head" and see what it's doing. I've tried running a sample of the Finder process in Activity Monitor, but honestly I don't know what it's doing, much less how to interpret the output."

Taking a sample in Activity Monitor is exactly that: getting inside the Finder's head to see what it's doing. While it may seem like greek, I or others here can interpret it for you. Just post it, or make it available for download or viewing (as they tend to be pretty big).

What version of OS X are you using? In OS X 10.5.x and prior, I believe multimedia content ran within the Finder itself, rather than delegating it off to an agent/helper type process, so then the CPU usage may appear higher. For example, previewing a QuickTime movie might make the 10.5.x-and-earlier Finder spike to 60% CPU, while in 10.6 it might be split to something like 10% CPU for the Finder, 30% CPU to the QTKitHelper background process.

Otherwise, I've sometimes seen the code the Finder uses to calculate the size of the contents of a folder cause temporary CPU spikes. (You'll notice something like TSomething::HFSSizerSomething in the stack trace of a sample). Usually it seems insistent on finishing its calculation even if the view you had open that warranted the calculation has since been closed.

In any case, seeing the sample should help pinpoint the issue along with knowing what context led up to the spike. It'll be easier to explain what taking a sample is doing once we have it in front of us to look at.

I don't know either, but here's how to find out more

In cases of entirely unknown binaries, strings(1) is often helpful in getting a hint about what the file might be

strings /tmp/ics29586 | less

Have a look through the output and see if it's anything familiar.

Failing that, find out which launchd job it is being launched from:

launchctl list|awk '{id=$3; print "### " id; system("launchctl list " id)}'|awk '/^###/ {id=$2} /.*ics29586.*/ {print id}'

This should output one or more job tags in the form of (for example) com.apple.scrod (and a few errors, which you can ignore).

Once you have the job tag(s), get the launchd config for a job by running:

launchctl list com.apple.scrod    # insert your tag instead

This (and the tag itself, which often contains an internet domain name in reverse notation) should give you some more information about what this process is. Feel free to post it here if you need further help.

Update: Forgot to mention this, but since it's a jar file, you can copy it somewhere and unzip it (jar files are really just zip files) and have a look at what sort of Java classes are in there.