Is there a way to detect why a command line task like rm is still not done after several hours on mac os x?

Question

I was trying to get Time Machine working again on my OS X 10.7 (Lion) powered iMac, and a remote drive on airport base station, and the only solution that worked was the rename my .sparsebundle file on the hard drive to "INVALID.sparsebundle", so that it would start afresh on that volume.

The backup is a .sparsebundle (which is really a folder full of files) is about 400 gb in size. I tried this command this morning at 8 AM and at 6:30 PM it still has not completed:

sudo rm -rf INVALID.sparsebundle

Is there any way to know why it's hanging or what it's doing? There are all kinds of cool tricks possible in Mac OS X command lines and even using some of OS X's nice graphical tools, possibly involving the use of the GCC debugger, or dtrace, or maybe even some kind of kernel-monitoring process that can tell me what function call or syscall is currently executing.

I can locate the PID for the rm command:

$ ps aux |grep "rm -rf"

root             392   0.0  0.3  2454248  20232 s001  U+    9:08am   0:12.04 rm -rf /Volumes/Backup3tb/INVALID.sparsebundle

Is there anything I can do to find out what PID 392 is doing right now and whether it's truly hung or not? (I'm going to leave it overnight, and after 24 solid hours of not responding, I will consider aborting it, and if I do, I'm just going to format this volume.)

I tried iosnoop, like this:

$ sudo iosnoop -p 392
  UID   PID D    BLOCK   SIZE       COMM PATHNAME

It's not showing me anything. I suspect that means that the process is well and truly Hung Up on something?

Answer 1

Luckily a .sparsebundle is actually a directory hierarchy full of 8MB "band files". If you navigate into that directory hierarchy and watch, you can probably see whether or not any files are getting deleted. If you want to do this from the Finder, use the contextual menu option to "Show Package Contents" when right-clicking on the .sparsebundle.

I believe Time Machine only uses a .sparsebundle when you're backing up to a remote AFP server, such as a Time Capsule or Mac OS X Server (or Mac OS X "client" with file sharing turned on, or netatalk on Unix, etc). So you may be experiencing network or server slowness; it may not be a problem with your local machine. Consider rebooting your AFP server if that's feasible, and then restart the deletion process.

For a local USB drive, Time Machine usually requires a dedicated partition to back up to, and makes clever use of filesystem hardlinks to keep track of which files are unchanged from backup to backup. Your question makes it sound like it's a local USB drive, so the fact you're talking about a .sparsebundle surprised me. Did it used to be plugged into a remote AFP server, but now it's local or something?

Answer 2

I found that the System Monitor in Mac OS has a handy feature called Sample Process that lets me see if it's doing anything or if it's frozen.

By locating the possibly-hung process and sampling it I can see what functions are executing (if any). If I get nothing, it's fair to assume that the process is hung.

Note that deleting a .sparsebundle over the Apple network protocol (AFP) such as when connecting your mac to a remote networked drive on an Airport extreme base station and deleting a network-mode backup created by Time-Machine, reliably hangs up the "/bin/rm" command line darwin/bsd rm utility for me.

I also found out that Time Machine will corrupt the .sparsebundles when they grow very large, in my case, over 600 gb on my system. I can only reliably use Time Machine either (a) without networking it, or (b) if the total backup size stays below 500 gb.