opendirectoryd taking up 1/4 of the cpu and driving fans crazy on MacBook Air

Since a couple of days my 2011 13" MBA (i5, 1,7Ghz) has a very strange issue which I don't know how to get rid of.

Every now and then (sometimes more times a day) a process called opendirectoryd takes up 99-101% of my CPUs. This causes the temperature to go up and after a short while the fans kick in. My MBA is logged in as part of an Active Directory Domain.

First I tried waiting a couple of minutes, but the process didn't stop. Rebooting the machine seems to always fix the problem, but that's not exactly my preferred solution for this problem.

For now I stick to force kill the process. I need to repeat this 1-2 times per iteration and then there's a undefined period of time in which I'm safe.

I'm not sure if it is related to the 10.7.2 update or to something else.

I found others having a similar problem. In that case it seems to be related to a Livescribe pen. While I have a Livescribe pen (updated to the latest version of the client software) I don't have any suspicious entries in Console.app.

Any help would be appreciated.

Solution 1:

Here are the results of my investigation: https://superuser.com/a/426719/135263

--

As mentioned by @juanpablo, this may be caused by symlinks.

Apparently, if a symlink points to /home, autofs or automountd fire and take a lot of CPU to figure out that the place indeed doesn't exist.

Take a look at /etc/auto_home and /etc/autofs.conf.

To see if you're being hit by this particular problem, set

AUTOMOUNTD_VERBOSE=TRUE

option in autofs.conf, restart automountd

sudo launchctl stop com.apple.automountd

and review the syslog.log (you may use application: Console). You're affected by this problem if you see something like that:

May 20 17:53:43 xxx automountd[31709]: od_search failed

To workaround, edit the file /etc/auto_master and remove (or hash out #) the line starting with /home. Then run:

sudo automount -vc

Solution 2:

First thing first, kill -9 <pid> of opendirectoryd probably won't prevent your problem from recurring at next boot up. My guess is your Mac is a managed client (MCX) that need to sync. opendirectoryd in OS X 10.7 requires a local directory node to have a "users" and a "groups" subdirectory. Try flushing your cache settings as described in http://support.apple.com/kb/HT3540

Solution 3:

My issue to high CPU utilization of opendirectoryd was that some robot on the Internet was trying different passwords to break into my computer via ssh. At least, that's what I think this meant:

8/25/15 12:20:51.173 PM sshd[66230]: error: PAM: authentication error for root from 222.186.21.218 via 192.168.0.3
8/25/15 12:20:51.189 PM sshd[66191]: error: PAM: authentication error for root from 222.186.56.168 via 192.168.0.3
8/25/15 12:20:51.214 PM sshd[66205]: error: PAM: authentication error for root from 222.186.21.251 via 192.168.0.3

The moment I turned off SSH (by unchecking System Preferences->Sharing->Remote Login,) opendirectoryd utilization disappeared. I figure high utilization was from my computer trying to respond to those bad password requests.

We just got a new router. It obviously isn't configured to stop multiple attacks like this. Off to look at the router.