secd chews up CPU cycles and Watch battery life goes in the terlet

bogus trumper

Ars Centurion
319
Subscriptor
tl;dr When secd runs amok on my Macs my Apple Watch burns through battery

Looking for any similar experiences -- maybe we can solve this

I have two M1 Macs running macOS Monterey 12.4 signed in to iCloud and using iCloud Keychain. Periodically I will notice either: a macOS system process called secd is using ~95% of a CPU core on my Mac, and then I'll see that my Apple Watch's battery is consuming battery at an alarming rate; or my Watch battery is inexplicably low for that time of day, then check on one Mac or the other and see secd running wild. (When secd starts gobbling CPU on either Mac, in almost all cases the other Mac will soon show the same issue.)

(I first noticed this secd issue in August or September 2021, prior to Monterey's release; at that time I had the 13" M1 MacBook Pro and a 2018 i7 Mini, running whatever was the up-to-date version of Big Sur. I now have an M1 Mini and the 14" MacBook Pro with the M1 Pro, because apparently the more Apple punishes me with software glitches, the more of their stuff I'll buy.)

44mm Apple Watch 6, cellular, replaced under AppleCare 7 months ago; when the gremlins aren't plaguing me, I take it off every night at bedtime after 16 hrs of wear with between 35-50% battery remaining (depends on that day's workout.)

When secd is running wild on my Macs, my Watch battery will begin the day at 100% and fall below 10% after 6 or 7 hours of wear.

Turning off "always on" on the Watch display (so the screen goes dark automatically after a few seconds) does not appreciably change battery consumption when secd is running amok on my Macs. Cellular is enabled on my Watch, but normally my phone is with me, even on my workouts, so I don't think cellular usage/battery drain is part of my problem. (When secd is quiescent on my Macs, cellular and GPS usage on the Watch doesn't drain my Watch battery before bedtime.)

When secd CPU usage is running at the problematic ~95%, when I open Keychain Access and select the "iCloud" keychain, then Edit > Select All (to highlight every item/entry in the keychain), all items in the keychain will remain selected for perhaps half a second, then fall back to just a single item being selected -- as if there is an underlying event that is incessantly pinging or refreshing the iCloud keychain in the background. (When secd is quiet, I can highlight every entry in the iCloud keychain and all items remain highlighted indefinitely -- in the course of writing up this post I inadvertently left all items in the iCloud keychain highlighted for almost an hour.)

I don't really love the idea of secd running out of control on my Macs, but the real problem is the Watch battery.

The only fix is a PITA: on both Macs, go into ~/Library/Keychains, where there's a GUID-labeled folder (folder name is like 36 characters long, plus another 4 hyphens); delete the folder and restart the computer. (A bunch of hassle follows, signing back into iCloud and re-authenticating iCloud Keychain and email accounts, etc.), but once this secd issue begins to plague me and make the Watch burn battery, the problem continues on the Watch until it gets exorcised. (The Watch will not fall back to normal battery usage on its own.) I have to unpair the Watch from my iPhone and set it back up (I always set it back up from scratch, for fear that restoring from backup will simply restore the battery usage problem.)

Dunno what sets off the secd problem; there's no action or event I can point to. For a few months this winter it seemed to recur on a weekly basis -- overnight on Sundays, if I recall correctly; lately I may get 10 days of peace before something kicks it back off.

Apple Support was no help (several calls over the past 8 months, some many hours in duration); searching the web brings evidence of other people noticing secd chewing up CPU cycles, but I haven't found any fix. In February I: unpaired my Watch; signed out of iCloud on my Mac Mini and wiped the drive & did a fresh install of Monterey, then left it sitting until I: signed out of iCloud on both my iPad Pro and iPad Mini, then wiped them using Settings > Transfer or Reset; disabled iCloud Keychain & signed out of iCloud on my iPhone; then, using my MacBook Pro, working one line at a time (because the secd glitch wouldn't let me Select All), deleted every item from iCloud Keychain (so to the extent that *I* can control things, I had nuked everything iCloud Keychain stashes on the iCloud servers.) I then wiped the MacBook Pro, also, and did a fresh install of Monterey, then painstakingly signed my iPhone back into iCloud and began the long process of restoring all the other devices. My relief from secd lasted perhaps a month. Since then I've just been waiting 10 or so days between relapses, then restoring normalcy by nuking the GUID folder from Keychains and unpairing/re-pairing my Watch.

Help.
 

chris_f

Ars Scholae Palatinae
1,264
I had a problem like this some years ago. My Macs and devices would see secd using lots of CPU and my phone would blow through cell data and battery. I don't think I had a watch at the time.
What I found was that this was something corrupt in my iCloud Keychain– the iCloud Keychain database in ~/Library/Keychains/folderwithUUIDname was several hundred megabytes when this would happen. Just signing a new device or Mac into iCloud would send secd into a loop on every other device signed into my account. The problem also correlated with having 2-factor enabled. (At the time, I could turn that on and off, but that's not an option anymore.)
Eventually I stumbled onto ckksctl. Details on what it does are pretty sparse but it did solve the problem.
Here's a link on that:
https://krypted.com/cloud/reset-connect ... h-ckksctl/


I ran the command
Code:
/usr/sbin/ckksctl reset-cloudkit
which reset the cloud side of my keychain and immediately shrunk down whatever extra data in the keychain was causing the problem and things have been fine since.
Edit: corrected wording.
 

leet

Ars Tribunus Militum
2,345
Subscriptor++
I had a problem like this some years ago. My Macs and devices would see secd using lots of CPU and my phone would blow through cell data and battery. I don't think I had a watch at the time.
What I found was that this was something corrupt in my iCloud Keychain– the iCloud Keychain database in ~/Library/Keychains/folderwithUUIDname was several hundred megabytes when this would happen. Just signing a new device or Mac into iCloud would send secd into a loop on every other device signed into my account. The problem also correlated with having 2-factor enabled. (At the time, I could turn that on and off, but that's not an option anymore.)
Eventually I stumbled onto ckksctl. Details on what it does are pretty sparse but it did solve the problem.
Here's a link on that:
https://krypted.com/cloud/reset-connect ... h-ckksctl/


I ran the command
Code:
/usr/sbin/ckksctl reset-cloudkit
which reset the cloud side of my keychain and immediately shrunk down whatever extra data in the keychain was solving the problem and things have been fine since.
I love seeing an obscure problem like this get a response. Thanks DenverCoder9!
 

bogus trumper

Ars Centurion
319
Subscriptor
I love seeing an obscure problem like this get a response. Thanks DenverCoder9!

I, too — in this case especially — love seeing an obscure problem get a response… thanks, chris_f! I took a blunt instrument (all the crap I mentioned in my initial post) to the problem the other day, and have enjoyed a few days of peace, but the next time the problem recurs (sometime next week, if previous experience is any guide) I look forward to making use of the remedy you linked. Thank you — I really appreciate it!

-bogus
 

chris_f

Ars Scholae Palatinae
1,264
I love seeing an obscure problem like this get a response. Thanks DenverCoder9!

I, too — in this case especially — love seeing an obscure problem get a response… thanks, chris_f! I took a blunt instrument (all the crap I mentioned in my initial post) to the problem the other day, and have enjoyed a few days of peace, but the next time the problem recurs (sometime next week, if previous experience is any guide) I look forward to making use of the remedy you linked. Thank you — I really appreciate it!

-bogus

When I dug into this problem I realized just how much of a hack that iCloud Keychain really is. It’s an SQLite database, and it keeps track of a lot of stuff. It’s hard to tell what all of it is as most of it is hashed, but when viewing the bloated keychain file with an SQLite viewer/editor, the corrupt data was pretty obvious, and from there it was a matter of figuring out how to get rid of that and stop it from syncing. I think this problem struck me in 2018, and I still get nervous when I sign a new device or computer into iCloud and briefly see secd taking up CPU time. For now, it settles down quickly even though my keychain.db file is up around 55MB.
I’d read somewhere, but cannot find where at this point, that this bug could hit when restoring an iPhone or iPad backup to a different device. I never filed a bug on it because I didn’t know what caused it, but probably should have.
 

yedi_yanez

Smack-Fu Master, in training
1
When I dug into this problem I realized just how much of a hack that iCloud Keychain really is. It’s an SQLite database, and it keeps track of a lot of stuff. It’s hard to tell what all of it is as most of it is hashed, but when viewing the bloated keychain file with an SQLite viewer/editor, the corrupt data was pretty obvious, and from there it was a matter of figuring out how to get rid of that and stop it from syncing. I think this problem struck me in 2018, and I still get nervous when I sign a new device or computer into iCloud and briefly see secd taking up CPU time. For now, it settles down quickly even though my keychain.db file is up around 55MB.
I’d read somewhere, but cannot find where at this point, that this bug could hit when restoring an iPhone or iPad backup to a different device. I never filed a bug on it because I didn’t know what caused it, but probably should have.
I'm having a similar issue, in my case secd not only uses high CPU it also writes tons of Gigs killing my ssd. What type of corrupt information did you find in the SQLite Database, since the ckksctl reset-cloudkit command didn't work for me. I have an iMac and a Macbook pro and I realised that secd starts at the same time in both machines, having the same behavior, I have also tried to log-out and remove the kecychain folder in both but nothing has resolved the problem .
 

chris_f

Ars Scholae Palatinae
1,264
I'm having a similar issue, in my case secd not only uses high CPU it also writes tons of Gigs killing my ssd. What type of corrupt information did you find in the SQLite Database, since the ckksctl reset-cloudkit command didn't work for me. I have an iMac and a Macbook pro and I realised that secd starts at the same time in both machines, having the same behavior, I have also tried to log-out and remove the kecychain folder in both but nothing has resolved the problem .
Unfortunately, at this point, I don't recall. You might also try turning off iCloud Keychain on every device. I think this will delete everything in your shared keychain so be careful with that if you try it.
 

bogus trumper

Ars Centurion
319
Subscriptor
The ckksctl reset-cloudkit command seemed to be the measure that finally solved the problem for me. It’s been a number of months, so I don’t have perfect recall of the details, but I know that I wound up issuing the command multiple times in succession before it seemed to take effect. (I think when I first ran it just the one time, the process seemed to time out without doing anything. Frustrated, I wound up running it again, and again, and then finally there was something in the output from the command that made me feel it had done something.) Sorry not to have better recall of the matter.