Managed Macbooks Beachballing since october 2024

Question

Level 1

4 points

Managed Macbooks Beachballing since october 2024

Hi folks!

I am writing this here because my attempts at figuring our the cause have so far been unproductive. Hoping that someone here can help.

I am a tech support worker for an organization. Many of our employees use Macbooks that are managed by the organization, and we have several hundred such devices.

Ever since around october this year, around the time we started pushing out Mac OS Sequoia to our macs, we've had increasing reports from employees about their Macs "beachballing" several times a day. This also affects my work computer, a Macbook Air M2 2022 (8Gb RAM).

So far over 10 employees have reported the problem, but I expect the problem to be present on most if not all of our Macbooks for employees, since they have the same setups.

I will refer to the beachball hang events as "Spin" from now on.

Each Spin event lasts from 15-30 seconds. During the Spin, keyboard and mouse inputs are being registered, but are placed back in the process queue and will not be performed before the Spin stops. There are some exceptions to this though: System-wide keyboard shortcuts such as "CMD+tab" and "CMD+Space" will change windows and open the spotlight search, respectively, but spotlight will not process anything before the Spin has passed.

I've found no way to reproduce the Spin directly, and it happens in many different situations. Examples are: Moving a file in Finder, creating a new document in Excel, opening a new tab in Firefox etc.

Computer models

Macbook Air M2 2022 (8Gb RAM)

Most reports come from users that use this model. I am currently stress-testing by clogging up 7 out of the 8Gb RAM in order to see if the problem happens more often this way.

Macbook Air M1 2020 (16Gb RAM)

The user of this model reported no problems until he opened up large files in Photoshop and Illustrator on purpose for testing so that 14 out of 16 Gb physical RAM was being used. After doing this, he reported experiencing the issue.

Software

FileWave is our device management software.

We use GlobalProtect VPN and Cortex XDR as security software. Both by Palo Alto Software.

Our Macs use S.U.P.E.R.M.A.N to allow the standard user to authorize OS updates.

Other software that is installed by default by FileWave during setup that all users are guaranteed to have:

Microsoft Office 2019
Microsoft Teams
Microsoft OneNote
Microsoft OneDrive
UniFLOW SmartClient (Print cloud solution)
TeamViewer QuickSupport

We also use a bunch of configuration profiles for various settings. These are also pushed to the machines by FileWave after initial setup.

Troubleshooting

Here follows what has been tested so far:

Uninstallation of FileWave Client. This was done to check if communication between server and client somehow caused the Spin. No difference noticed.
Turning off OneDrive sync. This was done to see if file syncing through OneDrive could be a factor. No difference noticed.
Using NONE of the desktop-versions of any of the Microsoft suite of programs. No difference noticed.
Streaming system logs and trying to read them around the time of the Spin. The full system logs are impossibly verbose, and seeing any differences between them during Spin and outside of Spin is hard.

So far I am leaning on this being a memory issue, but I am not sure if it is connected to a certain process that struggles extra hard when little memory is available, or if this is related to Sequoia directly.

If any of you would like to share some insights or propose an hypothesis I haven't thought of myself, I'd appreciate it a ton!

Oh, and apologies for the wall of text.

Posted on Dec 11, 2024 1:43 AM

Reply

Answer 1

Top-ranking reply

WheelieNick

Level 8

45,881 points

Dec 11, 2024 7:16 AM in response to Epleskront

Have you tried the safe mode to see if the issues persist? If the issues don't persist in the safe mode you might want to evaluate the external software installed to your Macs

Start up your Mac with Apple silicon in safe mode

On your Mac, choose Apple menu > Shut Down.
Wait for your Mac to shut down completely. A Mac is completely shut down when the screen is black and any lights (including in the Touch Bar) are off.
Press and hold the power button on your Mac until “Loading startup options” appears.
Select a volume.
Press and hold the Shift key, then click Continue in Safe Mode.
The computer restarts automatically. When the login window appears, you should see “Safe Boot” in the menu bar.

Reply

Answer 2

HWTech

Level 9

68,606 points

Dec 12, 2024 11:13 PM in response to Epleskront

Sometime earlier in the year (May to August) my organization started noticing issues with Ventura...we suspected either a macOS update (seemed to be close to a Ventura patch) or possibly third party software update since we saw a number of systems with issues. We use an MDM to manage our Macs. I investigated a bit and could never discover any consistent cause. I did notice the Python tended to be one of the more common items that was doing a lot of work (lots of CPU & log entries), but I also saw "log" and even "softwareupdate" seemed to be common as well.

I forget exactly how I started to narrow down my searches. I know I used the "log" command to gather the system logs, but I forget exactly what filters I may have used. The only way I discovered some of the culprits (or were they just symptoms?) was by having a couple laptops actually start running their fans at high speed so I could note the exact time of the incident and also the end time of the incident. That still leaves a lot of log entries since there are literally thousands of log entries every second (probably in the tens of thousands). Funny thing was if I booted into Safe Mode, performance got even worse which was the first time I've ever seen that happen in 25 years.

I think in the end we just ended up re-staging them and things were fine as far as I know (another tech did the re-staging). I had already run First Aid on the hidden Container to eliminate file system corruption.

I suspect the problem was probably a combination of things. And I think our management scripts were part of the problem, but I'm not involved in any of the management side of things. I am sure our MDM & management scripts run way too often.....since I see log entries even when the system is asleep (lots of DarkWakes to run the checks).

Reply

Answer 3

Epleskront Author

Level 1

4 points

Dec 13, 2024 12:19 AM in response to HWTech

@WheelieNick

We will be testing a mac with the issue in safe mode today. Thanks for the tip!

@HWTech

This is interesting. I do know that one of the machines with the problem had the issue just after setup, before being upgraded from the system image default Ventura til Sequoia. Also received a report of the crash on a machine with Sonoma today, so by now we know it is not a Sequoia-specific problem.

I haven't heard the term re-staging before, but I assume it means reinstalling and setting up the devices again? If so, I can confirm that the issue persists through reinstallation, even on macs straight out of the box.

I am testing a machine taken our of DEP today, and am installing software on it one by one until the problem appears. Not being able to force the Spin makes it a very inefficient way to test things though.

As for reading the system log, it is as you said tricky to do due to the sheer amount of information. One minute of the system log was over 15000 entries, so I have to pay attention to the system time down to the second as soon as I notice the Spin.

I did filter our Microsoft applications the last time I ran it, since that's what I was testing at the time. Perhaps I will have another go, targetting another process.

Thank you both so far for your insights!

Reply

Managed Macbooks Beachballing since october 2024

Similar questions