For quite a while, I’ve noticed an odd pattern whenever I open Activity Monitor on my Mac – something was writing to my disk every 2 or 3 seconds, at a peak rate of 4.5MB/second. Over time, the total data written would climb into the terabytes (far exceeding the total data read from the disk) – but my free disk space wouldn’t diminish. Looking at the system logs didn’t enlighten me, and nothing was obvious in Activity Monitor. I’d shake my head and ignore it.

This morning, I noticed the pattern again, right after rebooting the system, and I decided to try to find out what was causing the I/O.

First step: ask Google. In particular, I asked it what process is doing i/o mac and found many potentially-useful pages. The one I chose to pursue was an Ask Different question: Which process is periodically writing to the disk? because the screenshot in the question matched mine almost exactly.

The accepted answer to the question led me to try iotop(1), but I kept getting errors from DTrace (even though I ran it as root). So I tried what looked like the next best answer, using fs_usage(1):

sudo fs_usage -w -f filesys -e grep  \
   | grep -i ' write ' > /tmp/iouse.txt

and then looking at iouse.txt showed me that a process named lssave was doing a ton of I/O. A quick Google for lssave led me to this Stack Overflow page, which led me to this macosxhints discussion, which made it clear that I needed to rebuild my Launch Services database. I used Onyx to do the job, and voilà – no drumbeat of writes!