Mystery SMB mount

[Kier-XF]

We've all had issues with SMB shares being randomly dropped, but I seem to have the opposite problem. I have an SMB share that keeps on automatically reconnecting for reasons I cannot fathom.

The share is a drive (LaCie) on another Mac (Happy Meal) on the local network, to which I do connect from time to time, but the connections I am seeing are automatic and without action on my part.

It's not a System Preferences > Users > (me) > Login items entry, as the share isn't listed there, and the share is not mounted at login or system startup, it happens at (apparently?) random times while the system is up and running.

Ejecting the drive through Finder gets rid of it for a while, but before too long (could be minutes or hours) it will reconnect and show up on my desktop again. Repeating the ejection repeats the process.

I've tried quitting all running applications and services, but the issue remains.

Running `mount` in the terminal gives me the following, which isn't of much use in diagnostics:

% mount
/dev/disk1s5 on / (apfs, local, read-only, journaled)
devfs on /dev (devfs, local, nobrowse)
/dev/disk1s1 on /System/Volumes/Data (apfs, local, journaled, nobrowse)
/dev/disk1s4 on /private/var/vm (apfs, local, journaled, nobrowse)
map auto_home on /System/Volumes/Data/home (autofs, automounted, nobrowse)
//kier@Happy%20Meal._smb._tcp.local/LaCie on /Volumes/LaCie (smbfs, nodev, nosuid, mounted by kier)

Apart from seeing that LaCie on Happy Meal is mounted, there's no useful information there.

Can anyone suggest further diagnostic tools to establish what is instructing this share to be mounted so that I can isolate it and stop it happening?

Thanks for your time.

 

[techwarrior]

Is it by chance your Time Machine destination? TM will automatically mount whenever it runs (hourly).

 

[Kier-XF]

Definitely not a Time Machine destination I’m afraid, but thanks for the suggestion

 

[techwarrior]

ok, had to start with the most obvious.

So, you probably checked to have keychain remember the credentials at some point when you connected to the share. Is there anything on your Mac that uses links (Symlinks) to the share? Do you use it for photos, music, etc that might be mounting when you launch those apps?

 

[Kier-XF]

I’ve tried to find any symlinks using find -type l from With the obvious paths, but nothing is jumping out at me. I need to investigate a way to get the symlink destination to be printed out as part of the find command, otherwise it’s a laborious manual process checking everything.

I’ve got to assume that the share isn’t being triggered by an app, at least not one that I’m launching, as the mount can happen even when I’m not actually using the machine - sometimes I’ll come back from an errand and find the telltale icon sitting on the desktop.

I’m not totally sure what you mean about checking keychain, could you clarify that, please?

Thanks again for your persistence.

 

[Kier-XF]

I’m not totally sure what you mean about checking keychain, could you clarify that, please?

I'm going to presume that you're referring to saved login creds for the share, in which case - yes, I do have those saved, though I'm not sure how that could cause the automatic reconnection issue I'm seeing?

In any case, I'll delete that saved password and maybe I'll see a mystery application request access at some point later today?

 

[Kier-XF]

Argh. No, it's back anyway.

 

[Kier-XF]

Might be getting somewhere. At some point in the last, the LaCie drive was connected directly to my desktop Mac, and the Photos .photolibrary ran from there.

The path back then was /Volumes/LaCie/Photos/Photos Library.photoslibrary

Now that the LaCie drive is remote, when it mounts, its path is still /Volumes/LaCie, and the old photos library lives there too, though I can't use it with this Mac, because Photos doesn't support network storage for its library, so now I use a local path...

However, I've just spotted some logs from a few minutes ago showing Photos attempting to address the LaCie drive. This is almost certainly the cause of the reconnections - but as far as I can see, Photos is not connected to the LaCie drive in a way that is controllable by the end user. Does anyone have any ideas how to break this connection?

[automerge]1585741264[/automerge]
I've found an SQLite lock within /var/folders/x6/x68{gibberish}/T/com.apple.Photos.Migration/sqliteplocks:

kier@Chicken-Legend % ls -lh
total 64
-rw-r--r--@ 1 kier  staff     0B 31 Mar 17:09 _Volumes_LaCie_Photos_Photos Library.photoslibrary_database_Photos.sqlite:auto:
-rw-r--r--@ 1 kier  staff    32K  1 Apr 11:45 _Volumes_LaCie_Photos_Photos Library.photoslibrary_database_Photos.sqlite:auto:-shm

I wonder what will happen if I just zap these files completely

 

[Kier-XF]

And so it goes on...

 

[techwarrior]

Well, it looks like you are on the right path... good luck.

The keychain mention was simply, you had stored the creds so future connections would occur without prompting. But applications can store credentials in keychain as well, so that might explain the reconnects without cred prompts.

 

[Kier-XF]

So, quick update - had Apple Support involved, described the issue and sent the console logs I had found.

Their initial solution was to reboot into safe mode, then clear preferences for Photos defaults delete com.apple.Photos then reboot a few more times to see if the share was mounted again.

Unfortunately, it did indeed re-mount pretty much the moment I got off the call, so I'll be doing some screen and log sharing with them soon to try to track it down further.

 

[mick2]

You could try the 'lsof' command when the share is connected to see what file(s) on the share are being accessed and by which process. Eg

lsof | grep 'smb'

...or grep some other part of the path to your remote drive.

Once you have the pid(s) of whatever is using the share you have a culprit for what may be initialising the connection.

 

[Kier-XF]

Thanks, I will give that a try!