What is Spindump? How to read, analysis and disable Spindump

You use the iMac and the Mac OS X operating system. But you do not know what Spindum is in Mac OS X; this article will help you understand what Spindum is and how to read and use Spindump.

What is Spindump?

Spindump is a hang reporting tool used by various system components to create hang reports. Most users should not run Spindump manually; it can be invoked by root with arguments similar to those for the sample for debugging.

Spindump shows for each program that is running, at what point in the program it got to then and what programming libraries it’s using. This helps developers of an application that crashed or has bugs. They use it to understand the particular environment under which a program was running then, at what stage in the program it got to when it hangs or crashed, for example.

When a program crashes it triggers a spin dump to be sent to Apple who, then, forward it to the developers of the offending program, whether in-the-house or third party developers. It helps in improving the quality of software.

As it reveals what programs your computer was running, it is helpful to identify programs that run when they shouldn’t, viruses or unwanted programs such as “spigot application manager” that I just discovered running now. I It may also give weak hints of what you were doing then. I wonder if third party developers receive the full thing or just the part concerning their application.

How to read and analysis Spindum

With Spindump, you get multiple stack traces over a period together.

There are two cases in which you might want to examine a Spindump:

1. an infinite loop, probably calling the same function over and over
2. deadlock.

The first case can be seen from the Spindump by many calls to the same function over and over. A good thing to use in such situations is Activity Monitor – take the sample of a hung process there, and you can view it in several useful ways, hiding unimportant frames, etc.

The second case can be viewed by different threads waiting on locks at the same time.

Here is a little example:

+ 2663 start  (in MyApp) + 52  [0x100001bb4]
+   2663 main  (in MyApp) + 39  [0x100001be7]  main.m:65
+     2663 NSApplicationMain  (in AppKit) + 869  [0x7fff8ea27cb6]
+       2663 -[NSApplication run]  (in AppKit) + 517  [0x7fff8ea83283]
+         2663 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:]  (in AppKit) + 128  [0x7fff8ea8bed2]
+           2663 _DPSNextEvent  (in AppKit) + 685  [0x7fff8ea8c613]
+             2663 BlockUntilNextEventMatchingListInMode  (in HIToolbox) + 62  [0x7fff8dd53cd3]
+               2663 ReceiveNextEventCommon  (in HIToolbox) + 356  [0x7fff8dd53e42]
+                 2663 RunCurrentEventLoopInMode  (in HIToolbox) + 209  [0x7fff8dd540a4]
+                   2663 CFRunLoopRunSpecific  (in CoreFoundation) + 290  [0x7fff95dec6b2]
+                     2557 __CFRunLoopRun  (in CoreFoundation) + 1078  [0x7fff95decee6]
+                     ! 2556 __CFRunLoopServiceMachPort  (in CoreFoundation) + 195  [0x7fff95de7803]
+                     ! : 2556 mach_msg  (in libsystem_kernel.dylib) + 70  [0x7fff93630c42]
+                     ! :   2556 mach_msg_trap  (in libsystem_kernel.dylib) + 10  [0x7fff93631686]
+                     ! 1 __CFRunLoopServiceMachPort  (in CoreFoundation) + 199  [0x7fff95de7807]
+                     97 __CFRunLoopRun  (in CoreFoundation) + 728  [0x7fff95decd88]
+                     ! 97 __CFRunLoopDoObservers  (in CoreFoundation) + 369  [0x7fff95e11921]
+                     !   97 __CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__  (in CoreFoundation) + 23  [0x7fff95e119b7]
+                     !     97 __83-[NSWindow _postWindowNeedsDisplayOrLayoutOrUpdateConstraintsUnlessPostingDisabled]_block_invoke_01208  (in AppKit) + 46  [0x7fff8f05a971]
+                     !       90 _handleWindowNeedsDisplayOrLayoutOrUpdateConstraints  (in AppKit) + 738  [0x7fff8ea8f2ac]
+                     !       : 89 -[NSView displayIfNeeded]  (in AppKit) + 1830  [0x7fff8ea8fd73]

What this tells me, is that MyApp has gone through main, etc. and finally got into a function CFRunLoopRunSpecific, then __CFRunLoopRun – from there (2557) it called __CFRunLoopServiceMachPort, which called mach_msg and got into a trap at mach_msg_trap (calling a syscall) – when it got back, the stack trace returned to CFRunLoopRunSpecific, where __CFRunLoopRun was called, which then calls __CFRunLoopDoObservers, and so on.

Note that this isn’t a Spindump of any hanging process – you can sample this way any running process and view what functions were called during that sample. An infinite loop, however, will have a repeating calls to some task over and over again – there will be the same call tree over and over again. Of course, this can mean a simple for the cycle, but that’s where you can examine if the for period isn’t for some reason infinite. Unfortunately, these spin dumps are usually quite long, depending on what function you are calling, so it may take some time to examine

The + sign at the beginning of the row indicates a start of a line – lines without the + sign indicate a beginning of a new thread. The ! and: signs make a range, so it’s easier for you to see subsequent calls – i.e., which calls are at the same level. Further, the | character can also be used.

The numbers mean how long the app spent in that particular call – they are in the name of samples. The sampling works that the sampled app gets suspended every few milliseconds and the stack frame is examined of each thread. If the app is still in the same function, the function gets +1.

Disable Spindump to Speed Up your Mac

macOS High Sierra includes System Integrity Protection, which means that individual files are untouchable and uneditable. This has the benefit of helping keep your system files pure and malware-free, with the cost of flexibility.

To disable tailspin and Spindump we need that flexibility, and that means temporarily disabling System Integrity Protection (SIP). To disable SIP:

1. Boot your Mac into Recovery Mode by restarting with Command-R held down until the Apple logo appears.
2. Once your Mac is in Recovery Mode, go to Utilities > Terminal.
3. In the Recovery Mode Terminal, an issue crucial disables and press return.
4. Reboot your Mac.

Once SIP is disabled, the steps to disable Spindump are pretty straightforward. Launch Terminal and type/paste the following four commands. The first two turn off and render Spindump useless.

1. sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.spindump.plist
2. sudo mv /System/Library/LaunchDaemons/com.apple.spindump.plist /System/Library/LaunchDaemons/com.apple.spindump.plist.bak
3. sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.tailspind.plist
4. sudo mv /System/Library/LaunchDaemons/com.apple.tailspind.plist /System/Library/LaunchDaemons/com.apple.tailspind.plist.bak

Make sure to re-enable SIP when you’re finished by performing the steps to disable SIP (in Recovery Mode again), and issuing crucial enable as step #3.

That’s it. From this point forward, Spindump will be disabled and will not run on your Mac. It’s advisable to check these after macOS upgrades as it’s entirely possible that an update could re-enable these processes without any warning.