This is the third knotty issue happened on my Apple devices.
By the end of June this year, my iPhone running iOS11.4 ran nearly 10G of mobile data during a single day. The log of Shadowrocket(An Network Extension app) revealed that my iPhone kept downloading unknown data from
gateway.icloud.com at the rate of about 200kb/s. I tried switching the iCloud account, but the problem appeared again after a short period of time. I was busy dealing with the exams at that time, so I simply Rejected
gateway.icloud.com in Shadowrocket. No negative influence on daily use.
After some searching, I found some people claimed they have encountered a similar problems (22nd floor): https://www.v2ex.com/t/459452 . However, his solution of logging out of iCloud on macOS devices did not work for me.
But the trouble didn’t end. Since then, a large number of apps crashes while launching on my iPhone and iPad at a frequency of 2-3 times a week. When the problem occurs, most applications will hang at the Splash Screen and crash after about 10 seconds. Applications that crashed including TIM, Notability and all of the Google apps. WeChat and Apple’s own apps are unaffected. During this time, the phone went hot, and will stuck when entering the iCloud settings. My iPhone runs iOS 11.4 and 12 Public Beta, and iPad running 11.4 and 12 Developer Beta.
December 2020 Update: Some readers found a similar issue on iOS 14, but with different symptoms. Please refer to the comments for more information.
By summarizing my observation and information collected from Internet, I sum up the symptoms of this problem as follows:
Running iOS 11.4 or lower
- There are extremely high data consumption in “Documents and Sync” section
- Device continuously downloads unknown data from
Running iOS 12 or higher
- Most 3rd party apps will crash after hanging at splash screen for about 10 seconds.
- Device went hot with higher power consumption
- Device stuck when accessing iCloud related functions and password auto fill.
I tried rebooting, force rebooting, reinstalling affected apps, upgrading iOS(to iOS 12 beta), logging out and logging back in to iCloud, didn’t work. The iPhone will recover from the problem after a while without taking any actions.
Because this problem is very subtle, and each person’s description varies, therefore it is difficult to search online. Here is a collection of posts and threads complaining about the issue.
The problem happens randomly. I have no idea how it is triggered thus no way to reproduce it manually. Considering toggling the iCloud Drive have a chance to temporarily fix this problem, I figured the problem is related to iCloud. As for the iCloud continuous download data problem that has appeared before, I guess there is a correlation between the two issues.
The console revealed that
Provision violated for watchdog scene - create message shows in the console when an app launches and crashes.This error message is caused by app forcibly killed by the system due to the long startup time.
Meanwhile, while the problem occurs, a huge number of the following logs appears in the console, up to dozens per second. (The log is long, please slide to the right)
Aug 3 13:25:01 xxx-iPad securityd : Primary key conflict; replacing <inet,rowid=6503,cdat=2018-04-22 17:45:36="" +0000,mdat="2018-04-22" +0000,desc="null,icmt=null,crtr=null,type=42,scrp=null,labl=PCS" com.apple.textinput.keyboardservices.secure2="" -="" xufxdi+c,alis="null,invi=1,nega=null,cusi=null,prot=null,acct=XUFXdi+cQQeub/ZOYDvnZxRewe58kmh3AnxFv3lIp+Y=,sdmn=ProtectedCloudStorage,srvr=10010665840,ptcl=0,atyp=0952582F6984C0B264DB84750CE0B1A111B46D1E,port=0,path=,data=0b18:070000000AA4070A...|ed9c26ec39e16db2,agrp=com.apple.ProtectedCloudStorage,pdmn=ck,sync=1,tomb=0,sha1=89ED47A44B6E99F7665FB765B9E276119D064A6B,vwht=Manatee,tkid=null,v_Data=<?">,v_pk=FB076B06972C7760C5C195A06EFAE27690F482F3,accc=310C300A0C0470726F740C02636B,u_Tomb=null,musr=,UUID=24C3EAC7-E90B-16AC-66FD-BE910BB887FA,sysb=null,pcss=42,pcsk=5D4157762F9C4107AE6FF64E603BE767145EC1EE7C926877027C45BF7948A7E6,pcsi=6181FB3081F802012A02010104205D4157762F9C4107AE6FF64E603BE767145EC1EE7C926877027C45BF7948A7E6A0673065300A02010304053003020100302702010604220420451B5C4E7ED88534FEAF98353191D43A5EF99619CCD96178C5A2A65 with CK item Aug 3 13:25:01 xxx-iPad securityd : replaced <inet,rowid=6503,cdat=2018-04-22 17:45:36="" +0000,mdat="2018-04-22" +0000,desc="null,icmt=null,crtr=null,type=42,scrp=null,labl=PCS" com.apple.textinput.keyboardservices.secure2="" -="" xufxdi+c,alis="null,invi=1,nega=null,cusi=null,prot=null,acct=XUFXdi+cQQeub/ZOYDvnZxRewe58kmh3AnxFv3lIp+Y=,sdmn=ProtectedCloudStorage,srvr=10010665840,ptcl=0,atyp=0952582F6984C0B264DB84750CE0B1A111B46D1E,port=0,path=,data=0b18:070000000AA4070A...|ed9c26ec39e16db2,agrp=com.apple.ProtectedCloudStorage,pdmn=ck,sync=1,tomb=0,sha1=89ED47A44B6E99F7665FB765B9E276119D064A6B,vwht=Manatee,tkid=null,v_Data=<?">,v_pk=FB076B06972C7760C5C195A06EFAE27690F482F3,accc=310C300A0C0470726F740C02636B,u_Tomb=null,musr=,UUID=24C3EAC7-E90B-16AC-66FD-BE910BB887FA,sysb=null,pcss=42,pcsk=5D4157762F9C4107AE6FF64E603BE767145EC1EE7C926877027C45BF7948A7E6,pcsi=6181FB3081F802012A02010104205D4157762F9C4107AE6FF64E603BE767145EC1EE7C926877027C45BF7948A7E6A0673065300A02010304053003020100302702010604220420451B5C4E7ED88534FEAF98353191D43A5EF99619CCD96178C5A2A65 in Aug 3 13:25:01 xxx-iPad securityd : with <inet,rowid=6503,cdat=2018-04-22 17:45:36="" +0000,mdat="2018-04-22" +0000,desc="null,icmt=null,crtr=null,type=42,scrp=null,labl=PCS" com.apple.textinput.keyboardservices.secure2="" -="" xufxdi+c,alis="null,invi=1,nega=null,cusi=null,prot=null,acct=XUFXdi+cQQeub/ZOYDvnZxRewe58kmh3AnxFv3lIp+Y=,sdmn=ProtectedCloudStorage,srvr=10010665840,ptcl=0,atyp=0952582F6984C0B264DB84750CE0B1A111B46D1E,port=0,path=,data=0b18:070000000AA4070A...|6d7f049148c607e2,agrp=com.apple.ProtectedCloudStorage,pdmn=ck,sync=1,tomb=0,sha1=444FB1FC5869A46B917DEDED076DDF5780E7A289,vwht=Manatee,tkid=null,v_Data=<?">,v_pk=FB076B06972C7760C5C195A06EFAE27690F482F3,accc=null,u_Tomb=null,musr=,UUID=24C3EAC7-E90B-16AC-66FD-BE910BB887FA,sysb=null,pcss=42,pcsk=5D4157762F9C4107AE6FF64E603BE767145EC1EE7C926877027C45BF7948A7E6,pcsi=6181FB3081F802012A02010104205D4157762F9C4107AE6FF64E603BE767145EC1EE7C926877027C45BF7948A7E6A0673065300A02010304053003020100302702010604220420451B5C4E7ED88534FEAF98353191D43A5EF99619CCD96178C5A2A6526DC99DBD302E02010104293 in Aug 3 13:25:01 xxx-iPad securityd : ready to process an incoming queue entry: <ckksincomingqueueentry(manatee): add="" 24c4353b-89f8-6215-1c40-0f04246d057e="" (new)=""> 24C4353B-89F8-6215-1C40-0F04246D057E add Aug 3 13:25:01 xxx-iPad securityd : insert failed for item <inet,rowid=null,cdat=2018-05-20 09:21:52="" +0000,mdat="2018-05-20" +0000,desc="null,icmt=null,crtr=null,type=42,scrp=null,labl=PCS" com.apple.textinput.keyboardservices.secure2="" -="" 0gar="" 00a,alis="null,invi=1,nega=null,cusi=null,prot=null,acct=0gaR/00AlBUNsW2kwgjgehAk7jlRyRwT6SvS7QrZwe4=,sdmn=ProtectedCloudStorage,srvr=10010665840,ptcl=0,atyp=CBE61B61899A5063B7986CE76C0B7AC220BA1066,port=0,path=,data=0b15:070000000AA4070A...|a025af7bd6af7cbf,agrp=com.apple.ProtectedCloudStorage,pdmn=ck,sync=1,tomb=0,sha1=1E6777C0DFD8D9BB94C0BA21E9E55A19CBD8DB0E,vwht=Manatee,tkid=null,v_Data=<?">,v_pk=212E2F1B786100857148F8C26A4C4212FF1173BF,accc=null,u_Tomb=null,musr=,UUID=24C4353B-89F8-6215-1C40-0F04246D057E,sysb=null,pcss=42,pcsk=D20691FF4D0094150DB16DA4C208E07A1024EE3951C91C13E92BD2ED0AD9C1EE,pcsi=6181F93081F602012A0201010420D20691FF4D0094150DB16DA4C208E07A1024EE3951C91C13E92BD2ED0AD9C1EEA0673065300A020103040530030201003027020106042204207C88B3993E919363592E44E9630F2C7BD40BA2191BC85CDE928DEE908748DE2F302E02010104293 with </inet,rowid=null,cdat=2018-05-20></ckksincomingqueueentry(manatee):></inet,rowid=6503,cdat=2018-04-22></inet,rowid=6503,cdat=2018-04-22></inet,rowid=6503,cdat=2018-04-22>
com.apple.ProtectedCloudStorage in the log, I preliminarily targeted that the issue appears in the Keychain. But I have no idea what
Manatee is after not finding valuable information on the search engine.
I found a thread on Reddit by searching the contents of the log:
The author nhcoil and I encountered almost the same problem. I sent a private message and I got the following reply:
Never found the solution. Brought my phone in multiple times and nothing, even got a replacement device and the issue persisted. The problem was something in my iCloud. I don’t know what, didn’t have anything in there at all.
Holy solution was creating a new iCloud account and not carrying anything over and manually putting everything like contacts etc.
I’m sorry I can’t be much help, I spoke with Apple live chat about the issue and gave everything I could to isolate and help with the problem.
If you do find a solution other than a new iCloud account, then that’s amazing but for now I think that’s all that can be done.
Studying the logs above and the information provided by nhcoil, I inferred that the problem is caused by some problems in the data in iCloud, resulting in unexpected synchronization errors, and the problem is likely to appear in the Keychain.
Then I searched for this thread
More information is provided:
This process will continue writing around 30000 lines to the database, and during this time, secd uses 100%+ of a CPU. Once that’s finished, I can manually edit the database using an Sqlite editor, which brings the database down to around 10-15MB, and Safari passwords will resume working. Eventually the database will grow again and Keychain stops working.
Signing all devices out of iCloud Keychain does not clear this problem. Computers running 10.11.6 and 10.12.6 work normally, so the problem seems to stem from some new feature in iOS 11 and macOS 10.13.
I went to the local Keychain database on my MacBook, and I found tons of data containing
Manatee , up to tens thousands of lines, and these data will not be displayed in Keychain Access.
I believe there are similar data in my iCloud Keychain, but I have no way to view or delete it.
Continuing the search, I found another thread on MacRumors:
From the information provided in the thread, we can determine that the problem is indeed in the Keychain.
Moreover, both of these threads mentioned that when 2-factor authentication is disabled, the problem will not happen again, and it can be regarded as a relatively feasible solution.
In conclusion, I suppose the reason of the issue is after enabling 2-factor authentication on macOS devices, a bug in a module called Manatee caused a large amount of flawed data generated and uploaded to iCloud Keychain. Leading to traffic consumption and App crash during downloading and processing these huge amounts of data on iOS devices.
The solution have been confirmed valid.
User XXL pointed out in the comments that there is a new solution in this thread, and the 22nd floor provides several commands for resetting CloudKit. These commands are only valid when 2-factor authentication is enabled. Please ensure that 2-factor authentication is enabled before operation. Although the data will not be lost in theory, please backup the health and keychain data in advance for the sake of safety.
Login to the problematic iCloud account on macOS device, check the size of
~/Library/Keychains/(UUID)/keychain-2.db. Its size may be up to hundreds of MB, even larger than 1GB.
Check the CloudKit status
Continue if the CloudKit status is logged in on every view. Turning off the 2-factor authentication may cause the CloudKit status shows logged out.
Fetch the latest data from iCloud. This command may fail, but it doesn’t matter.
Reset local Keychain database.
Reset iCloud Keychain database.
Log out and back in to the iCloud account on your macOS devices after completing these steps. if the size of
~/Library/Keychains/(UUID)/keychain-2.db decrease to about 10MB, it means the operation was successful. Please keep watching if App crashing happens again and the size of
keychain-2.dbincreases apparently in the following period of time.
Update：Soy commented that:
按文章里提到的先 “ckksctl reset” 再 “ckksctl reset-cloudkit” 在我这里一定会出现第二条命令提示 “timed out” 的情况，错误信息里面有 “pending… ” 的字样，看里面等待的任务的名字似乎是因为后台在同步所以操作超时。观察文件大小的变化发现”reset” 过程中数据库迅速变小，但提示完成之后会开始迅速增长，ckksctl 的帮助信息里面说这个 “reset” 是 “All local data will be wiped, and data refetched from CloudKit”，也就是说它重置之后会立即开始从云端下载数据，前面的错误信息也表明正在同步的时候没有办法进行操作，似乎说明不该这么用。
DELETE FROM “ckmirror” WHERE “ckzone” = “Manatee”、”DELETE FROM “inet” WHERE “vwht” = “Manatee”` 和 “VACUUM” 三条操作，然后再用 “ckksctl reset-cloudkit” 把云端的数据替换成本地清理过的版本。
操作成功之后所有有问题的 iPhone 清空数据用 iMazing 跳过钥匙串还原其他内容，现在数据库体积增长还没超过 1MB，我自己不用钥匙串保存密码，不知道这样做会不会对部分功能造成影响，暂时没发现有问题。
What Soy pointed out makes sense for me, but I have not tried it. You are welcome to try and provide feedback at your own risk.
If the problem persists
If the problem still exists, you can try the following approaches.
Wipe all the iOS devices that have logged into this iCloud account after backing up the devices.
~/Library/Keychains/(UUID)directory on macOS devices. Reboot the device immediately.
Logout and login to iCloud after reboot. Then check CloudKit status.
Reset iCloud database immediately if status of every view is logged in.
Login to iCloud on your wiped iOS devices. Meanwhile pay attention to if logs mentioned before appears in the console.
If yes, please repeat these steps; If not, please keep watching if App crashing happens again and the size of
Solution2：Turning off two-factor authentication
The approach is confirmed valid but it is not a general solution.
Turn off two-factor authentication from appleid.apple.com. Note that it is Two-factor Authentication instead of Two-step Verification.
However, AppleIDs created in iOS 10.3 or macOS 10.12.4 and higher cannot turn off 2-factor authentication. If you have 2-factor authentication enabled under these system version, you can turn off 2-factor authentication by clicking the link in the confirmation email within two weeks, and you cannot turn it off after two weeks.
If the solutions above does not work for you, you can try the following methods.
The following approaches are valid, but it may affect daily use.
- Create a brand new iCloud account and manually migrate the data from your old account (use with caution! Dirty data on your device may contaminate your new account!)
- Logging iOS devices out of iCloud account
The following solutions have been confirmed invalid
- Logging out and back in to iCloud account
- Logging macOS device out of iCloud account
- Clearing the Safari password on iOS devices
- Using Surge(A Network Extension app) to Reject the URL like p*–.icloud.com to prevent iCloud from syncing
- Turning off iCloud Keychain on iOS device
- Reseting the Keychain database from Keychain Access