Suspect an issue affecting the WindowServer process (long edition)
The symptoms you describe are familiar but not commonplace and in my case, not frequent.
Prepare for diagnosis
In Terminal, run the following command. Be prepared to enter your admin password for the operating system:
sudo launchctl load -w /System/Library/LaunchDaemons/com.apple.stackshot.plist
Take a written note of the following key chord, you'll need it later:
Control-Option-Command-Shift-.
Diagnosis by the system
When the problem occurs:
- use the key chord
- for at least ten seconds, touch nothing
- allow maybe five or ten minutes for all parts of the so-called
sysdiagnose routine to complete – simply wait as long as you can (with this approach there'll be no on-screen indication of progress)
- force a restart of the computer (Command-Control-Power).
After the computer starts:
- in Finder, go to
/private/var/tmp
- seek a file or folder with a name beginning sysdiagnose_
- if that file or folder exists, move it to a convenient place – your desktop, maybe.
Hint
Whilst I don't encourage carelessness, you can be a little careless with Control-Option-Command-Shift-. … if you struggle to avoid the fn key on your laptop, don't worry; including it by accident should not prevent the run of sysdiagnose.
Human analysis of diagnosis by the system
Hint: someone might like to ask a separate question about analysing the results of sysdiagnose – a more generalised answer could be useful.
If sysdiagnose_… from the /tmp area is a folder
Presence of a sysdiagnose_… folder (not a .tar.gz file) indicates that either:
- the routine was interrupted before completion; or
- some part of the routine could not complete.
If sysdiagnose_… from the /tmp area is a file
Presence of a sysdiagnose_….tar.gz file indicates that all parts of the sysdiagnose routine completed, and that the results were archived. If you wish, open the archive – its contents will appear as a folder.
Folder contents at a glance
In the first screenshot below – an example of a completed run of sysdiagnose - I have selected two of the items that may be of interest in a case such as this.
Note that it may be normal to find at least one empty file.
Amongst the .crash, .hang and .spin files – or in the top.txt file – might be a good sign of what was wrong shortly before, or during, the period when you lost control of the computer.
Related:
For an incomplete run of sysdiagnose it may be useful to focus some attention on files that are abnormally empty …
Technical
stackshot(1) OS X Manual Page
sysdiagnose(1) OS X Manual Page
Please post the make/model/specs of your machine, and especially the brand, model and firmware revision of your SSD. I have an SSD that started throwing errors after 4,900 hours of operation. Updating the firmware resolved the issue.
You can find the SSD firmware by running the Hardware Profile (or more info in About this Mac) and selecting Serial-ATA and the your SSD in the Device Tree.
Is the problem hardware or software?
I will attempt to list here a couple of possible issues, and what we need to help resolve.
If you have a second hard drive you can boot from (HDD, USB drive, etc.), please do.
- Does the problem still occur?
- If it does, does it happen on the boot device or still on the non-booted SSD?
- While booted from something other than the SSD, run any disk checking software you have, even if its just a Disk Utility/First Aid/Verify Disk
When did this problem start, and can you peg it to any action you did?
Wild process
Open Activity Monitor. First, click the drop list and change from My Processes to All Processes. Then click on the %CPU column header once (or twice) so the list shows the top CPU users at the top
Is there a run-away process at the top? If so, please let us know.
Consistency after reboot
How soon after a reboot does the disk usage start? Do you reboot with the following option checked?
If you do, reboot, but first uncheck the option.
Now that you're opening with a "fresh" login,
- how soon after reboot does the problem start?
- Is there a consistency with any programs running when this happens?
Your problem can be a lot of things, but from your initial output, I'm less inclined to think malware.
Best Answer
Personally, I'd assume you're looking at the machine either having bad RAM, causing the OS to corrupt and thus forcing the reinstall, or the machine having a bad hard drive, or at least one that's starting to fail.
For testing, I'd download a copy of Memtest86 (the free version) at http://www.memtest86.com/ , follow the directions to install it to a USB drive, and let it run through a few loops to check that the memory is okay.
If that comes back clean, the next culprit would be hard drive. I'd suggest downloading the free trial version of Drive Genius from http://www.prosofteng.com/downloads/ and running your drive through its tests. If it is a bad hard drive, replacement is easy enough, there are multiple guides on youtube as well as at iFixit that detail how to take your machine apart and replace the hard drive. Good luck!