Okay. A long time ago (If you read my old blog), you’ll know that my powerbook froze up, accessing files in Finder was unresponsive, and searching with Spotlight was impossible. (Spinning beachball from hell). Well I figured out how to fix it then, and yesterday, my PowerMac Dual G5 started the same exact thing, and I was able to reproduce the fix, so here it is for your problem solving pleasure:
As I stated, Finder and Spotlight become unresponsive. I have no idea what causes this, but I noticed it yesterday when I’d try to open a file, or attach a file to an email, I’d click on the file in Finder’s ‘column’ view, and it would literally take about 20 minutes to get the details of the file in the next column. (Spinning beachball, machine and Finder completely frozen)
Open Terminal, type:
$sudo mdutil -s /
mdutil is the utility that manages your Spotlight store for each drive. You can use mdutil to even index network shares. (which is quite handy) For more information on mdutil, either read the man page, or type:
$sudo mdutil -h
Anyway -- I got sidetracked there. If mdutil -s / takes a long time to run and gives you some crap about not being able to lookup the index status of the “/” drive, then you are experiencing the same problem I was. For some reason OSX’s Spotlight index gets fubar’ed, and when that happens, no more information store (Finder) for you! So let’s fix it. Back in your terminal type:
$sudo mdutil -i off / (This turns off indexing for your drive)
$sudo mdutil -E / (This erases the information store for your drive)
If either one of these two error out, you will have to do it manually, skip the next step then read further down.
Now reboot. When your computer comes back up, open a Terminal window and type:
$sudo mdutil -i on /
$top -o cpu
This will bring up top and sort it by cpu usage. If you see ‘mds’ and ‘mdimport’ being in the top 3 or 4 or so, that’s good. OSX is rebuilding your Spotlight cache. Let it do this, and hopefully everything will return to normal. Now, if at any point your command errors out (“Can’t find index status, Can’t erase index” or similar, go to this:)
Now, if all that stuff didn’t work, so let’s fix it manually.
Step 1: Open System Preferences -> Sharing. At the top you will see the hostname of your computer. (Yes, this is the HOSTNAME.) Change this. To anything you want, for some reason Finder is tied to the hostname of your computer and if you change the hostname it magically fixes this problem.
Step 2: Back in your Terminal Window, descend to “/”. ($cd /)
Step 3: Erase your Spotlight cache. (Sounds dangerous doesn’t it? Don’t worry it’ll be rebuilt)
$sudo rm -rf /.Spotlight-V100/ (NOTICE THE DOT, it’s a hidden directory, you’d have to add a -a to your ‘ls’ to see it)
Now reboot. When your computer comes back up, your Spotlight cache will be rebuilt (may take awhile, it took about 3 hours on my Powermac (But it has 3 harddrives in it), then everything should be good to go.
Remember, changing that hostname is the magic step. Don’t forget it.
If this helps you, please leave a comment and let me know. If you have an suggestions to add to this, please leave a comment and let me know.
Over the past several years my job here at Cisco Talos has changed drastically. I took on new roles, which is awesome and exciting, but in ...
Without going off the deep-end here and discussing every single Snort rule keyword, I just wanted to touch on a few modifiers that people so...
Let me start off by saying I'm not bashing the writer of this article, and I'm trying not to be super critical. I don't want to...
1. I don't feel like I have much to say. I do a tremendous amount of writing and blogging on the Snort, ClamAV, and Talos blogs. So...