[X-Unix] How to REALLY kill Finder.

[Eric F Crist]

On May 23, 2008, at 2:49 PM, Stroller wrote:

> Hi there,
>
> I posted this question to http://discussions.apple.com before  
> realising that you guys will probably have some better answers. So  
> please excuse me in the (unlikely) event you read this twice.
>
> Last night I was converting a bunch of video files in Quicktime and  
> copying them to a samba server on the LAN (so I could play them on  
> my Linux-based media machine) when the Finder stopped responding and  
> I got the spinning beachball of death.
>
> The beachball appeared when I clicked on one of the files in Finder  
> and it tried to generate a preview in column-view. The media files  
> were fairly big ones (1 gig) and .mkv format (which seem  
> particularly processor-intensive to decode) and I'm pretty sure the  
> file in question was on the Samba server.
>
> So all in all everything seemed to be against the Finder creating  
> this preview and I figured it was going to take a long time to do  
> so, so I'd just force-relaunch the Finder and go back and open the  
> folder in a different view in order to copy it wherever it needed to  
> be.
>
> After doing so, though, Finder fails to restart - I've got no icons  
> on my desktop and I can't navigate to a folder of files to click on  
> the one I want to view.
>
> Often in the past when I've experienced this, typing `open /path/to/ 
> folder` in terminal has had the effect of forcing Finder to restart,  
> however on this occasion I get this error message:
> "2008-05-23 18:11:07.383 open7567 LSOpenFromURLSpec() returned -600  
> for application (null) urls file://localhost/Applications/."
>
> If I look for the process using `ps` I see the process name in  
> brackets:
>  $ ps -wwwwwx | grep Finder
>  5958 ?? E 0:00.00 (Finder)
>  $
> I presume the brackets indicate that Finder is behaving badly, but  
> `man ps` doesn't seem to explain exactly what they mean. Apparently  
> the "E" in the above line indicates that the process is trying to  
> exit.
>
> Anyway, I can't get any further using `kill -9 5958` or anything  
> else I've tried so far.
>
> The Finder icon is still showing in the Dock and if I right-click on  
> it I see "Application not responding" (greyed out), "Hide" and  
> "Relaunch". Choosing "Relaunch" has no effect. Finder does not seem  
> to appear in Activity Monitor (showing "All Processes") . If I open  
> the "Force Quit Applications" dialogue again the Finder is still  
> shown and highlighting it changes the button from "Force Quit" to  
> "Relaunch", but clicking that has no effect (except that Finder  
> disappears from the lit of programs; it reappears if I close the  
> "Force Quit" window and reopen it from the Apple menu).
>
> Obviously I could sort this by rebooting my computer, but I really  
> don't want to do that right now. Can anyone suggest a way of  
> properly killing this process so that Finder can restart? (a way  
> that doesn't kill off all my active windows, that is!)
>
> Many thanks in advance for any suggestions,


I tried to post a reply earlier, but it was reject due to being >5K.

First, I would try to kill the process that's involved with  
transferring or otherwise reading the file over the network.  Second,  
if that fails, I'd try killing the process that's involved with  
QuickLook.  I don't think this is internal to Finder itself, so there  
should be a separate process.  reading through all of the output for  
your user with ps should at least give you some clues as to what you  
can try to kill along the way.  Unfortunately, the only thing you can  
do is experiment.  The disturbing thing is that a kill -9 on Finder  
isn't working.  You could try nice(ing) the processes you're  
interested in save to get them the proc time so you can save your  
work, but I'm afraid you may be stuck rebooting the system if all this  
fails.

Hope this helps.  Try posting a copy of a ps auxwwwww here, or at  
least directly to me.

-----
Eric F Crist
Secure Computing Networks