MacOS – Why is lsof on OS X so ridiculously slow

command lineevernotemacmacos

I can't figure out why lsof on my Mac (10.8.2, MacBook Pro) is so slow.

On my Mac, lsof takes more than a minute:

$ touch /tmp/testfile
$ time lsof /tmp/testfile

real   1m16.483s
user   0m0.029s
sys    1m15.969s

On a typical Linux box, running Ubuntu 12.04, lsof takes 20 ms:

$ touch /tmp/testfile
$ time lsof /tmp/testfile

real   0m0.023s
user   0m0.008s
sys    0m0.012s

The problem persists if I run lsof -n (to avoid DNS lookups). Further, I tried checking which system calls are made by lsof using dtruss, and found that it's calling proc_info tens of thousands of times:

$ sudo dtruss lsof /tmp/testfile 2> /tmp/dump
$ cat /tmp/dump | sort | uniq -c | sort -nr | head
10000 proc_info(0x2, 0x1199, 0x8) = 1272 0
 6876 proc_info(0x2, 0x45, 0x8) = 1272 0
 2360 proc_info(0x2, 0x190D, 0x8) = 1272 0
 1294 proc_info(0x2, 0xFF, 0x8) = 1272 0
 1152 proc_info(0x2, 0x474, 0x8) = 1272 0
 1079 proc_info(0x2, 0x2F, 0x8) = 1272 0
  709 proc_info(0x2, 0xFE, 0x8) = 1272 0
  693 proc_info(0x2, 0x1F, 0x8) = 1272 0
  623 proc_info(0x2, 0x11A, 0x8) = 1272 0
  528 proc_info(0x2, 0xF7, 0x8) = 1272 0

Any ideas? I've run these tests and obtained the same results using both the version of lsof included with OS X (4.85) as well as the latest version from ftp://sunsite.ualberta.ca/pub/Mirror/lsof/ (4.87).

(For the curious, the reason I'm frustrated by this performance is that when I drag images to Evernote, it runs lsof in the process of copying the file, causing my system to hang for a full minute every time I try to insert an image in Evernote.)

Best Answer

As my experience, from Mac OS X 10.7(Lion) to 10.11.5（EI Capitan), the lsof always hang.

To solve to problem, append -n option.

lsof -n

According to manual of lsof, the -n option:

inhibits the conversion of network numbers to host names for network files.  
Inhibiting conversion may make  lsof  run faster.  It is also useful when host 
name lookup is not working properly

EDIT 2018-04-25: If it is still slow, you can try 

-O to bypass  the  strategy it uses to avoid being blocked by some kernel operations
-P to inhibits the conversion of port numbers to port names for network files
-l to inhibits  the  conversion of user ID numbers to login names

The ultimate way to find out why so slow is to run "Instruments" tool (from upper right corner Spotlight Search icon) to do a "System Trace" on /usr/sbin/lsof then see graph and sys calls.

enter image description here enter image description here enter image description here enter image description here enter image description here

Related Question