Mac drive in use, understanding lsof

lsofmacintoshmountosx

I am trying to repair permissions on my external HD. I cannot empty my trash when it is plugged in, because I get a bunch of "such file is in use". I read online that this might be resolved by repairing permissions on the drive. I am currently unable to unmount the drive because it is in use the second I restart or unplug and replug it in. I used lsof to see what is using it but I am unable to understand this and can't seem to find a clear guide to learn what this means. The output is below: 

COMMAND PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
mds      59 root   23r   DIR    1,9     1701    5 /Volumes/SEAGATE
mds      59 root   31r   DIR    1,9     1701    5 /Volumes/SEAGATE

Command

ps ax | egrep '[ /](PID|mds)'

Output

PID   TT  STAT      TIME COMMAND
660   ??  Ss     0:12.49 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Support/mds
673   ??  Ss     0:08.68 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Versions/A/Support/mds_stores

Command

/usr/bin/sudo kill 660

Output

//new line$

Command 

sudo lsof /dev/disk2s2

Output 

COMMAND  PID USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
mds     1599 root   11r   DIR    1,8     1764    5 /Volumes/SEAGATE

In that order

If I run the bash file several times in a row I can get 

PID   TT  STAT      TIME COMMAND
1737   ??  Ss     0:00.69 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Support/mds

But the drive is still locked by mds

Just to show that the exception was added, here are screenshots:

enter image description here

enter image description here

Best Answer

Too fast diagnosis

I read online that this might be resolved by repairing permission on the drive.

Unfortunatly, from the description of your problem, this is wrong. What need to be repaired is the filesystem on your external disk SEAGATE.

Analysis of lsof

The output of your lsof command tells that the command mds (1st column) is actually reading your filesystem /volumes/SEAGATE (last colume). To learn more about this fantastic command, just read the manual which is coming with MacOS X:

man lsof

mds is a MacOS X server in charge of providing an access to the metadata of all your filesystems. Its most important clients are Finder and Spotlight.

If you can't eject your external disk, this is legitimate and due to mds still reading it. If you nonetheless extract it, you will surely corrupt its filesystem.

Free and repair the filesystem

Now that it is corrupted, here is how to fix this.

  1. Open System Preferences > Spotlight select Privacy window and add (+) your SEAGATE external disk to stop Spotlight to try to index it.

  2. If mds is still running:

    ps ax | egrep '[ /](PID|mds)'

    You will have to kill it:

    _pid_to_kill=`ps ax | egrep '[ /]mds' | awk '{print $1}'`
if [ "${_pid_to_kill}" ] ; then
    echo "${_pid_to_kill}" | while read _pid ; do
        /usr/bin/sudo kill ${_pid}
    done
fi

    Check with lsof that your SEAGATE disk is now free:

    lsof /Volumes/SEAGATE

    If this is OK, GOTO 4.

  3. If killing mds doesn't free /Volumes/SEAGATE then there is another process accessing this filesystem through mds. (This might be an anti-virus or a crapware. And this is quite another size of investigation). In this case, the fast path will be to stop launchd from starting mds.

    Proceed as follows:

    cd /System/Library/LaunchDaemons
/usr/bin/sudo launchctl unload com.apple.metadata.mds.plist

    Check that you don't have anymore mds process:

    ps ax | egrep '[ /](PID|mds)'

    Check with lsof that your SEAGATE disk is now free:

    lsof /Volumes/SEAGATE

    This should be OK, GOTO 4.

  4. Start Disk Utility and check your disk SEAGATE. I suspect that some repairs will be needed. In this case repair it.

    Eject it, and check that you don't have any more any "file in use" error message.

  5. Open System Preferences > Spotlight select Privacy window and remove (-) your SEAGATE external disk to permit Spotlight to index it.

  6. If you passed strep 3. where you had to stop launchd from starting mds you will have to enable this function back (otherwise a lot of thing managing your filesystem will fail).

    Proceed as follows:

    cd /System/Library/LaunchDaemons
/usr/bin/sudo launchctl load com.apple.metadata.mds.plist
Related Question