Lots of kmutil executions

I am seeing kmutil being executed a *lot* on my iMac with Big Sur.

Apple's documentation says kmutil is used for loading and unloading kexts (and some other things).

Should I be concerned with this much kmutil activity?

Answered by THeberlein in 647468022
I found the issue (sort of). kmutil is launching com.apple.fsplaceholder, so I feel better that it is an Apple thing.

I still don't know what is going on, but an example capture of one of the processes is shown below if anyone is interested. launchd forks, then executes xpcproxy with the arguments (xpcproxy com.apple.applefsplaceholder), and then executes kmutil with the arguments (load -b com.apple.fsplaceholder).


Code Block
pid: 26919
first observed: 2020-11-17 13:54:20
last observed: 2020-11-17 13:54:20
program: kmutil
program path: /usr/bin/kmutil
signing ID: com.apple.kmutil
team ID:
program modification date: 2020-01-01 00:00:00
program status date: 2020-01-01 00:00:00
ppid: 1
parent program: launchd
parent program path: /sbin/launchd
parent signing ID: com.apple.xpc.launchd
parent team ID:
parent program modification date: 2020-01-01 00:00:00
parent program status date: 2020-01-01 00:00:00
FORK /sbin/launchd
EXEC /usr/libexec/xpcproxy
arguments:
xpcproxy
com.apple.applefsplaceholder
EXEC /usr/bin/kmutil
arguments:
/usr/bin/kmutil
load
-b
com.apple.fsplaceholder
exit


Do you have a 3rd party kext installed that might be loading itself in a loop? Its hard to dive in without additional information.
No 3rd party kexts installed.
Accepted Answer
I found the issue (sort of). kmutil is launching com.apple.fsplaceholder, so I feel better that it is an Apple thing.

I still don't know what is going on, but an example capture of one of the processes is shown below if anyone is interested. launchd forks, then executes xpcproxy with the arguments (xpcproxy com.apple.applefsplaceholder), and then executes kmutil with the arguments (load -b com.apple.fsplaceholder).


Code Block
pid: 26919
first observed: 2020-11-17 13:54:20
last observed: 2020-11-17 13:54:20
program: kmutil
program path: /usr/bin/kmutil
signing ID: com.apple.kmutil
team ID:
program modification date: 2020-01-01 00:00:00
program status date: 2020-01-01 00:00:00
ppid: 1
parent program: launchd
parent program path: /sbin/launchd
parent signing ID: com.apple.xpc.launchd
parent team ID:
parent program modification date: 2020-01-01 00:00:00
parent program status date: 2020-01-01 00:00:00
FORK /sbin/launchd
EXEC /usr/libexec/xpcproxy
arguments:
xpcproxy
com.apple.applefsplaceholder
EXEC /usr/bin/kmutil
arguments:
/usr/bin/kmutil
load
-b
com.apple.fsplaceholder
exit


Hi, I've had this same issue ever since upgrading to Big Sur a month ago. Launchd fires kmutil load -b com.apple.fsplaceholder every 10 seconds, causing kernelmanagerd to be my top 2 CPU user.

The following tricks have not helped:

  • Booting without 3rd party kexts with Cmd+S¹
  • Resetting NVRAM, as suggested on MacRumors forums
  • Quitting Dropbox, Google Drive, pCloud Drive and Keybase
  • Delete deprecated /Library/Extensions/Dropbox.kext
  • sudo kmutil install --check-rebuild and sudo kmutil install --update-all, which fails with: failed to build release collection: Error Domain=NSPOSIXErrorDomain Code=1 "Operation not permitted"
  • sudo launchctl unload /System/Library/LaunchDaemons/com.apple.applefsplaceholder.plist, which fails: Operation not permitted while System Integrity Protection is engaged

¹ I thought this would be safe mode, but is actually single-user mode, which should be disabled but in fact booted with no 3rd party kexts loaded. Safe mode (hold shift) does not work as I've forgotten my EFI password 😅

However, just once I got kernelmanagerd to quiet down by starting Dropbox.

I crudely checked that Dropbox (and VMware) have linkings against com.apple.fsplaceholder:

/Library $ sudo grep -i fsplaceholder -R .
Binary file ./Apple/System/Library/Receipts/com.apple.files.data-template.bom matches
Binary file ./DropboxHelperTools//Dropbox_u501/dbkextd matches

/Applications $ sudo grep -i fsplaceholder -R .
Binary file ./Dropbox.app/Contents/XPCServices/InfiniteProxyHelper.xpc/Contents/MacOS/InfiniteProxyHelper matches
Binary file ./Dropbox.app/Contents/XPCServices/InfiniteProxyHelper.xpc/Contents/embedded.provisionprofile matches
Binary file ./Dropbox.app/Contents/Frameworks/python-extensions/macinfinite_native.cpython-38-darwin.so matches
Binary file ./VMware Fusion.app/Contents/Library/vkd/spherelet-initrd matches

Here's my 3rd party kexts, after removing two from unidentified developers.

Attached is one round of kernelmanagerd insistently checking extensions.

Hello I Fixed this by deleting them nasty smelling file:

$ ls -l /Library/Preferences/com.apple.fsplaceholder/
-rw-r--r--  1 root wheel   0 May 21 18:43 com.dropbox.user.98ecb765c7491ca8a181eaacc2aeac1ce7fd0c4a

Restarted Dropbox, and it hasn't come back as of yet. Thanks, Dropbox..

--

I realised that /System/Library/LaunchDaemons/com.apple.applefsplaceholder.plist has:

	<key>QueueDirectories</key>
	<array>
		<string>/Library/Preferences/com.apple.fsplaceholder</string>
	</array>

…and from man launchd.plist:

QueueDirectories <array of strings> This optional key keeps the job alive as long as the directory or directories specified are not empty.

Huh 🤪

Hi, I have the same problem with kernelmanagerd.

May I ask what kind of logs you were looking at to figure out where the problem was coming from?

Sorry to bring this thread from the dead... I'm having the same problem, and I can confirm what PerterJ has said. However, I contacted dropbox about the issue and hopefully they will do something about it. I have just a question, how did you create the empty file com.apple.fsplaceholder to avoid the recreation of the directory. I've created a file (with textedit) with no extension, but the folder keeps being created. How did you manage this?

Thanks,

G.

Lots of kmutil executions
 
 
Q