What is causing this sound on my Mac?

For several weeks now, my friend’s MacBook has been plagued by this sound, randomly occurring while running: http://c.abr.vg/321r2Q3Y2W0J

We’ve never been able to reproduce it, and it has persisted on her machine across Archive & Installs, and a clean reinstall (10.8.2) and migration via Migration Assistant (System Library and ‘Other Files’ deselected). We only even have a recording of it because I had her run QuickTime and record everything she was doing (audio only) until she caught it.

Now, the sound has manifested itself onto my Mac mini. I was previously blaming the hardware on her machine, but now I’m certain that there is an egregious software issue.

Both of our machines share little to no software. I’m a developer; she’s a human. ;)

What could be causing this?

Solution 1:

It's indeed the sound Facebook makes when there is a new notification. Or at least, that's what it sound like (very much).

Recently, Facebook did some testing and as you can hear on the movie in the post, sounds are very similar.
Not very user-friendly, but luckily you can disable this sound if it's bothering you.

1. Go to your Notifications account settings
2. Uncheck the sound option

Solution 2:

I don't recognise it immediately, but can perhaps suggest tools to help you find it.

As for identifying the file, the closest I could find in a short time on my computer was /Applications/Mail.app/Contents/Resources/No Mail.aiff but I think yours has a longer tone on the front. But perhaps you can find it yourself...

I'm assuming it's a file on your hard drive, somewhere... most applications store sound effects in .m4a or .aiff files. So my theory is you can find it by brute force... here's a command that'll find audio files, print their name and play them.

# find / -name "*.m4a" -or -name "*.aiff" -exec echo "Playing {}" \; -exec afplay "{}" \;

Note that this particular command plays all *.m4a and *.aiff files, so you might need to extend it with -or -name "*.mp3" or similar for other file types (e.g. .wav, not sure really what else to try!)

The two -exec arguments first print the file name, and then play the file. So you should see the name of each file appear, and then hear it played. Ctrl+C stops it if you find your match (and you can use afplay if necessary to re-play the last few if you're not sure which it was).

If you have lots of music on the computer as well, you may need to exclude your iTunes library or similar:

# find / -not -path "*/iTunes/*" \( -name "*.m4a" -or -name "*.aiff" \) -exec echo "Playing {}" \; -exec afplay "{}" \;

This excludes any files if their path includes a directory called iTunes (you can modify this to match your iTunes library folder).

That of course only tells you what the file was, not necessarily what was running it... if it's in the Resources directory within an Application package, or another helpful path, it might be clear that it's from some specific Application.

If not you could then try

# sudo opensnoop -f <filename>

and leave that running until you hear the sound effect. That should then show you what process played it...

Good luck!

(Incidentally, if you or your friend have housemates like mine, you'll probably find out its someone messing with you, SSHing into the computer and running afplay <sound> on a regular basis... or maybe they put it in the crontab...)