How to know what nsurlsessiond is downloading

I turned off all iCloud drive stuff and it seems something else is using it. I don't have photo sharing and photo syncing on between my Mac and iPhone. And I've turned off whatever I can. But still nsurlsessiond downloads over 400 MBs every time it runs; which sometimes is triggered with a restart of the system.

I did a sample process on it; but I have no idea what it means.

That daemon (or system process) is invoked and handles network download requests from many apps and many other services on macOS. (And iOS and tvOS and watchOS)

I haven't found an easy way to get summary details or statistics from the session manager, but since it works on a queue to upload or download things, my guess is you have one or more job(s) timing out.

Here are some ways to pick apart the activity on your system:

sudo lsof | grep nsurl
ps -ef|grep nsurl
sudo fs_usage -w | grep nsurl

The first lists open files and sorts for matches of “nsurl”. The second lists all processes and sorts again. The third lists file system activity.

That will let you monitor things and see which of the several nsurl daemons is running when you measure 400 mb of transfer. You can also get a dump of the system activity with sysdiagnose nsurlsessiond

If you determine that it's really iCloud Documents, you'll likely need brctl log -w to watch that subsystem instead of monitoring the worker threads that do the lifting.

In my case I have found that:

When backing up WhatsApp (on iOS - iPhone) chats to iCloud, it copies the backup into every machine that uses iCloud. The backup is placed into a hidden folder, on my machine (OS X 10.11.4) it is in the

/Users/UUUUUUU/Library/Mobile Documents/57T923XXXX~net~whatsapp~WhatsApp/Accounts/NNNNNNNNN/backup

folder, where UUUUUUU is my username and NNNNNNNNN is my phone number.

Unfortunately the backup file for the media is in one huge archive (mine is > 560MB) so every time WhatsApp backs up, the WHOLE file is re-downloaded, from what I can see. This is what nsurlsessiond is doing.

If you run the brctl log -w command mentioned above, you will see something along these lines:

received a push for container 57T923XXXX~net~whatsapp~WhatsApp
[note]    2.335 [2016-05-04 12:44:54.114] cloudkit.operation.callback    sync-down.container-metadata BRCContainerMetadataSyncDownOperation.m:229
fetched 0 containers metadata from the cloud
[note]    2.375 [2016-05-04 12:44:54.154] sqlite.serverTruth             zone.server               BRCServerZone.m:771
received 25 edited items from the cloud for 57T923XXXX.net.whatsapp.WhatsApp
[note]    2.427 [2016-05-04 12:44:54.207] bird.scheduler.Apply Changes   accountsession       BRCAccountSession.m:1473
we will now download new documents automatically because the account contains less than 5 GB
[note]    2.536 [2016-05-04 12:44:54.316] sqlite.clientTruth             fs.downloader          BRCFSDownloader.m:1469
downloading 11 documents in 57T923XXXX.net.whatsapp.WhatsApp

Deleting the WhatsApp 'documents' (i.e. backups) via the iCloud storage management console in iOS or Mac OS X deletes the files from the Mobile Documents folder and thereafter there is no more activity from nsurlsessiond.

Hope this helps.

For Googlers that just want to stop the bandwidth usage, do what the OP did and turn off services that may be causing problems:

iCloud

1. System Preferences -> iCloud
2. Uncheck:
   • iCloud Drive
   • Photos

Spotlight Suggestions

1. System Preferences -> Spotlight
2. Uncheck "Spotlight Suggestions"

If you find something else hogging bandwidth on your machine then leave it in the comments and I'll add it here.