MacOS – Process Named After Website Executing?

macosspotlight

While looking at Activity Monitor processes, I noticed a process whose name started with "http://".

Shortly after observing and screenshoting the process disappeared. This morning, it briefly re-appeared and then died.

lsof and dtracte indicate the process is looking at standard system libraries, one of which is /private/var/db/mds/messages/se_SecurityMessages.

Any ideas on:

Whether this is a normal process?
How to find where and how it's launched? (Mac doesnt have /proc…?)
How to investigate what its doing?

Best Answer

This is Normal in the way Safari now operates.

Each process is part of Safari sandboxing.

If you go to the View menu in Activity Monitor and down to the 'All Processes Hierarchically'

enter image description here

You will see that they all gathered and are owned by Safari.

enter image description here

Also this is a known feature: apple.com/safari

Sandboxing for websites.

Sandboxing provides built-in protection against malicious code and malware by restricting what websites can do. And because Safari runs web pages in separate processes, any harmful code you come across in one page is confined to a single browser tab, so it can’t crash the whole browser or access your data.

Related Solutions

MacOS – File named zero

You might try running the command

sudo dtrace -qn 'syscall::open:entry /arg1&O_CREAT/ {printf("%5d %s file:%s\n",pid,execname,copyinstr(arg0));}' | grep '[:/]0$'

in a terminal window. The dtrace output will list the process ID, process name, and filename argument for any open() call with the O_CREAT flag set, meaning it will create the file if it does not already exist. Drop the final grep bit if you want to see all potentially file creating open() calls, but then the output might possibly overwhelm you. Hit ctrl-C when you're done with it.

If something keeps creating files named 0, the culprit ought to show up in the output.

(Edit: Fixed the grep invocation.)

MacOS – How to start the mds process

My guess is that it's launching, then crashing or erroring out in some form. Try sudo launchctl list com.apple.metadata.mds, and look at the PID (id of currently running process, probably 0 since it's not running) and LastExitStatus (which would be 0 if it exited successfully, but may be something else in this case). Also, look at /var/log/system.log (with either Console.app or 'tail') and see if it holds any clues. Also, look in /Library/Logs/CrashReporter for any relevant reports.

As for possible causes: if the logs don't tell you where the problem is, my first guess would be a broken mdimporter plug-in; I'd remove everything (temporarily) from /Library/Spotlight and ~/Library/Spotlight. Also, check /System/Library/Spotlight, and make sure these are the only mdimporters there:

Application Archives Audio Automator Bookmarks Chat CoreMedia Font Image MIDI Mail Notes PDF PS QuartzComposer RichText SystemPrefs iCal iPhoto iPhoto8 vCard

Another possible cause is a badly corrupted spotlight database. If removing suspect mdimporters doesn't get it started, try dismounting everything but the startup volume (& if that solves it, remount them one at a time and see which kills it). If that doesn't do it, try removing the existing spotlight database with sudo mv /.Spotlight-V100 /.Spotlight-V100-disabled (I'm not certain how thoroughly sudo mdutil -E / wipes out the old DB, but renaming it should force a full rebuild).

Best Answer

Related Solutions

MacOS – File named zero

MacOS – How to start the mds process

Related Question