By the end of June this year, my iPhone running iOS11.4 ran nearly 10G of mobile data during a single day. The log of Shadowrocket(An Network Extension app) revealed that my iPhone kept downloading unknown data from gateway.icloud.com at the rate of about 200kb/s. I tried switching the iCloud account, but the problem appeared again after a short period of time. I was busy dealing with the exams at the time, so I rejected gateway.icloud.com in Shadowrocket to stop it from using more data. There was no negative impact on daily use.
After some searching, I found some people who claimed they have encountered a similar problem: https://www.v2ex.com/t/459452. However, their solution of logging out of iCloud on macOS devices did not work for me.
But the trouble didn’t end. Since then, a large number of apps crashes while launching on my iPhone and iPad at a frequency of 2-3 times a week. When the problem occurs, most applications will hang at the Splash Screen and crash after about 10 seconds. Applications that crashed including TIM, Notability and all of the Google apps. WeChat and Apple’s own apps are unaffected. During this time, the phone went hot, and will stuck when entering the iCloud settings. My iPhone runs iOS 11.4 and 12 Public Beta, and iPad running 11.4 and 12 Developer Beta.
December 2020 Update: Some readers found a similar issue on iOS 14, but with different symptoms. See comments for more information.
Symptoms
By summarizing my observation and information collected from the Internet, I sum up the symptoms of this problem as follows:
Running iOS 11.4 or lower
- There is extremely high data consumption in “Documents and Sync” section
- The device continuously downloads unknown data from
gateway.icloud.com
Running iOS 12 or higher
- Most 3rd party apps will crash after hanging at splash screen for about 10 seconds.
- Device went hot with higher power consumption
- Device stuck when accessing iCloud-related functions and password auto fill.
Attempts
I tried rebooting, force rebooting, reinstalling affected apps, upgrading iOS(to iOS 12 beta), logging out and logging back in to iCloud, didn’t work. The iPhone will recover from the problem after a while without taking any actions.
Analysis
Because this problem is very subtle, and each person’s description varies, therefore it is difficult to search online. Here is a collection of posts and threads complaining about the issue.
https://cn0xroot.com/2018/07/17/2018-07-16/
https://discussionschinese.apple.com/thread/140132632
https://www.reddit.com/r/jailbreak/comments/8sf4u3/help_this_block_of_text_is_being_spammed_in_my/
https://forums.developer.apple.com/thread/105722
The problem happens randomly. I have no idea how it is triggered thus no way to reproduce it manually. Considering toggling the iCloud Drive have a chance to temporarily fix this problem, I figured the problem is related to iCloud. As for the iCloud continuous download data problem that has appeared before, I guess there is a correlation between the two issues.
The console revealed that Provision violated for watchdog scene - create message shows in the console when an app launches and crashes.This error message is caused by app forcibly killed by the system due to the long startup time.
Meanwhile, while the problem occurs, a huge number of the following logs appears in the console, up to dozens per second. (The log is long, please slide to the right)
Aug 3 13:25:01 xxx-iPad securityd[492] : Primary key conflict; replacing <inet,rowid=6503,cdat=2018-04-22 17:45:36="" +0000,mdat="2018-04-22" +0000,desc="null,icmt=null,crtr=null,type=42,scrp=null,labl=PCS" com.apple.textinput.keyboardservices.secure2="" -="" xufxdi+c,alis="null,invi=1,nega=null,cusi=null,prot=null,acct=XUFXdi+cQQeub/ZOYDvnZxRewe58kmh3AnxFv3lIp+Y=,sdmn=ProtectedCloudStorage,srvr=10010665840,ptcl=0,atyp=0952582F6984C0B264DB84750CE0B1A111B46D1E,port=0,path=,data=0b18:070000000AA4070A...|ed9c26ec39e16db2,agrp=com.apple.ProtectedCloudStorage,pdmn=ck,sync=1,tomb=0,sha1=89ED47A44B6E99F7665FB765B9E276119D064A6B,vwht=Manatee,tkid=null,v_Data=<?">,v_pk=FB076B06972C7760C5C195A06EFAE27690F482F3,accc=310C300A0C0470726F740C02636B,u_Tomb=null,musr=,UUID=24C3EAC7-E90B-16AC-66FD-BE910BB887FA,sysb=null,pcss=42,pcsk=5D4157762F9C4107AE6FF64E603BE767145EC1EE7C926877027C45BF7948A7E6,pcsi=6181FB3081F802012A02010104205D4157762F9C4107AE6FF64E603BE767145EC1EE7C926877027C45BF7948A7E6A0673065300A02010304053003020100302702010604220420451B5C4E7ED88534FEAF98353191D43A5EF99619CCD96178C5A2A65 with CK item
Aug 3 13:25:01 xxx-iPad securityd[492] : replaced <inet,rowid=6503,cdat=2018-04-22 17:45:36="" +0000,mdat="2018-04-22" +0000,desc="null,icmt=null,crtr=null,type=42,scrp=null,labl=PCS" com.apple.textinput.keyboardservices.secure2="" -="" xufxdi+c,alis="null,invi=1,nega=null,cusi=null,prot=null,acct=XUFXdi+cQQeub/ZOYDvnZxRewe58kmh3AnxFv3lIp+Y=,sdmn=ProtectedCloudStorage,srvr=10010665840,ptcl=0,atyp=0952582F6984C0B264DB84750CE0B1A111B46D1E,port=0,path=,data=0b18:070000000AA4070A...|ed9c26ec39e16db2,agrp=com.apple.ProtectedCloudStorage,pdmn=ck,sync=1,tomb=0,sha1=89ED47A44B6E99F7665FB765B9E276119D064A6B,vwht=Manatee,tkid=null,v_Data=<?">,v_pk=FB076B06972C7760C5C195A06EFAE27690F482F3,accc=310C300A0C0470726F740C02636B,u_Tomb=null,musr=,UUID=24C3EAC7-E90B-16AC-66FD-BE910BB887FA,sysb=null,pcss=42,pcsk=5D4157762F9C4107AE6FF64E603BE767145EC1EE7C926877027C45BF7948A7E6,pcsi=6181FB3081F802012A02010104205D4157762F9C4107AE6FF64E603BE767145EC1EE7C926877027C45BF7948A7E6A0673065300A02010304053003020100302702010604220420451B5C4E7ED88534FEAF98353191D43A5EF99619CCD96178C5A2A65 in
Aug 3 13:25:01 xxx-iPad securityd[492] : with <inet,rowid=6503,cdat=2018-04-22 17:45:36="" +0000,mdat="2018-04-22" +0000,desc="null,icmt=null,crtr=null,type=42,scrp=null,labl=PCS" com.apple.textinput.keyboardservices.secure2="" -="" xufxdi+c,alis="null,invi=1,nega=null,cusi=null,prot=null,acct=XUFXdi+cQQeub/ZOYDvnZxRewe58kmh3AnxFv3lIp+Y=,sdmn=ProtectedCloudStorage,srvr=10010665840,ptcl=0,atyp=0952582F6984C0B264DB84750CE0B1A111B46D1E,port=0,path=,data=0b18:070000000AA4070A...|6d7f049148c607e2,agrp=com.apple.ProtectedCloudStorage,pdmn=ck,sync=1,tomb=0,sha1=444FB1FC5869A46B917DEDED076DDF5780E7A289,vwht=Manatee,tkid=null,v_Data=<?">,v_pk=FB076B06972C7760C5C195A06EFAE27690F482F3,accc=null,u_Tomb=null,musr=,UUID=24C3EAC7-E90B-16AC-66FD-BE910BB887FA,sysb=null,pcss=42,pcsk=5D4157762F9C4107AE6FF64E603BE767145EC1EE7C926877027C45BF7948A7E6,pcsi=6181FB3081F802012A02010104205D4157762F9C4107AE6FF64E603BE767145EC1EE7C926877027C45BF7948A7E6A0673065300A02010304053003020100302702010604220420451B5C4E7ED88534FEAF98353191D43A5EF99619CCD96178C5A2A6526DC99DBD302E02010104293 in
Aug 3 13:25:01 xxx-iPad securityd[492] : ready to process an incoming queue entry: <ckksincomingqueueentry(manatee): add="" 24c4353b-89f8-6215-1c40-0f04246d057e="" (new)=""> 24C4353B-89F8-6215-1C40-0F04246D057E add
Aug 3 13:25:01 xxx-iPad securityd[492] : insert failed for item <inet,rowid=null,cdat=2018-05-20 09:21:52="" +0000,mdat="2018-05-20" +0000,desc="null,icmt=null,crtr=null,type=42,scrp=null,labl=PCS" com.apple.textinput.keyboardservices.secure2="" -="" 0gar="" 00a,alis="null,invi=1,nega=null,cusi=null,prot=null,acct=0gaR/00AlBUNsW2kwgjgehAk7jlRyRwT6SvS7QrZwe4=,sdmn=ProtectedCloudStorage,srvr=10010665840,ptcl=0,atyp=CBE61B61899A5063B7986CE76C0B7AC220BA1066,port=0,path=,data=0b15:070000000AA4070A...|a025af7bd6af7cbf,agrp=com.apple.ProtectedCloudStorage,pdmn=ck,sync=1,tomb=0,sha1=1E6777C0DFD8D9BB94C0BA21E9E55A19CBD8DB0E,vwht=Manatee,tkid=null,v_Data=<?">,v_pk=212E2F1B786100857148F8C26A4C4212FF1173BF,accc=null,u_Tomb=null,musr=,UUID=24C4353B-89F8-6215-1C40-0F04246D057E,sysb=null,pcss=42,pcsk=D20691FF4D0094150DB16DA4C208E07A1024EE3951C91C13E92BD2ED0AD9C1EE,pcsi=6181F93081F602012A0201010420D20691FF4D0094150DB16DA4C208E07A1024EE3951C91C13E92BD2ED0AD9C1EEA0673065300A020103040530030201003027020106042204207C88B3993E919363592E44E9630F2C7BD40BA2191BC85CDE928DEE908748DE2F302E02010104293 with
</inet,rowid=null,cdat=2018-05-20></ckksincomingqueueentry(manatee):></inet,rowid=6503,cdat=2018-04-22></inet,rowid=6503,cdat=2018-04-22></inet,rowid=6503,cdat=2018-04-22>Through the com.apple.ProtectedCloudStorage in the log, I preliminarily targeted that the issue appears in the Keychain. But I have no idea what Manatee is after not finding valuable information on the search engine.
I found a thread on Reddit by searching the contents of the log:
The author nhcoil and I encountered almost the same problem. I sent a private message and I got the following reply:
Never found the solution. Brought my phone in multiple times and nothing, even got a replacement device and the issue persisted. The problem was something in my iCloud. I don’t know what, didn’t have anything in there at all.
Holy solution was creating a new iCloud account and not carrying anything over and manually putting everything like contacts etc.
I’m sorry I can’t be much help, I spoke with Apple live chat about the issue and gave everything I could to isolate and help with the problem.
If you do find a solution other than a new iCloud account, then that’s amazing but for now I think that’s all that can be done.
Regards,
Micheal
Studying the logs above and the information provided by nhcoil, I inferred that the problem is caused by some problems in the data in iCloud, resulting in unexpected synchronization errors, and the problem is likely to appear in the Keychain.
Then I searched for this thread
iCloud Keychain database grows when 2-factor en… |Apple Developer Forums
More information is provided:
This process will continue writing around 30000 lines to the database, and during this time, secd uses 100%+ of a CPU. Once that’s finished, I can manually edit the database using an Sqlite editor, which brings the database down to around 10-15MB, and Safari passwords will resume working. Eventually the database will grow again and Keychain stops working.
Signing all devices out of iCloud Keychain does not clear this problem. Computers running 10.11.6 and 10.12.6 work normally, so the problem seems to stem from some new feature in iOS 11 and macOS 10.13.
I went to the local Keychain database on my MacBook, and I found tons of data containing Manatee , up to tens thousands of lines, and these data will not be displayed in Keychain Access.
I believe there are similar data in my iCloud Keychain, but I have no way to view or delete it.
Continuing the search, I found another thread on MacRumors:
From the information provided in the thread, we can determine that the problem is indeed in the Keychain.
Moreover, both of these threads mentioned that when 2-factor authentication is disabled, the problem will not happen again, and it can be regarded as a relatively feasible solution.
In conclusion, I suppose the reason of the issue is after enabling 2-factor authentication on macOS devices, a bug in a module called Manatee caused a large amount of flawed data to be generated and uploaded to iCloud Keychain. Leading to traffic consumption and App crash during downloading and processing these huge amounts of data on iOS devices.
Solutions
Solution1：Resetting CloudKit
The solution have been confirmed valid.
User XXL pointed out in the comments that there is a new solution in this thread, and the 22nd floor provides several commands for resetting CloudKit. These commands are only valid when 2-factor authentication is enabled. Please ensure that 2-factor authentication is enabled before operation. Although the data will not be lost in theory, please backup the health and keychain data in advance for the sake of safety.
Login to the problematic iCloud account on the macOS device, check the size of ~/Library/Keychains/(UUID)/keychain-2.db. Its size may be up to hundreds of MB, even larger than 1GB.
Check the CloudKit status
/usr/sbin/ckksctl status
Continue if the CloudKit status is logged in on every view. Turning off the 2-factor authentication may cause the CloudKit status shows logged out.
Fetch the latest data from iCloud. This command may fail, but it doesn’t matter.
/usr/sbin/ckksctl fetch
Reset local Keychain database.
/usr/sbin/ckksctl reset
Reset iCloud Keychain database.
/usr/sbin/ckksctl reset-cloudkit
Log out and back in to the iCloud account on your macOS devices after completing these steps. if the size of ~/Library/Keychains/(UUID)/keychain-2.db decrease to about 10MB, it means the operation was successful. Please keep watching if App crashing happens again and the size of keychain-2.dbincreases apparently in the following period of time.
Update：Soy commented that:
As mentioned in the post,
cksctl resetand thencksctl reset-cloudkitwill definitely result in the second command to return “timed out” error for me. The error message include “pending…”, and the name of the task waiting seems to indicate that the reason of the timed out is there are sync tasks in progress in the background.Checking the file size and found that the size of the database file shrinks during the “reset” process, but will start to grow rapidly after the command is completed.
The help message of
ckksctlmentioned that theresetmeans “All local data will be wiped, and data refetched from CloudKit”. That means, it will start downloading data from the cloud immediately after the reset, and the error message also indicates you cannot do any operation while the sync is in progress. This probably indicates it’s not the right way to use this command.I used a database tool to run these three queries:
DELETE FROM "ckmirror" WHERE "ckzone" = "Manatee"
DELETE FROM "inet" WHERE "vwht" = "Manatee"
VACUUMThen use
ckksctl reset-cloudkitto replace the cloud data with the local data that have been cleaned upAfter the finishing this I wiped my iPhones and restored data except keychain with iMazing. The database size has not grown by more than 1MB so far. Personally I don’t use the keychain to save passwords. I don’t know if this will affect some functionalities. No issue was found so far.
What Soy pointed out makes sense to me, but I have not tried it. You are welcome to try and provide feedback at your own risk.
If the problem persists
If the problem still exists, you can try the following approaches.
Wipe all the iOS devices that have logged into this iCloud account after backing up the devices.
Remove~/Library/Keychains/(UUID)directory on macOS devices. Reboot the device immediately.
Logout and login to iCloud after reboot. Then check CloudKit status.
/usr/sbin/ckksctl status
Reset the iCloud database immediately if the status of every view is logged in.
/usr/sbin/ckksctl reset-cloudkit
Log in to iCloud on your wiped iOS devices. Meanwhile, pay attention to if the logs mentioned before appears in the console.
If yes, please repeat these steps; If not, please keep watching if App crashing happens again and the size of keychain-2.dbincrease again.
Solution2：Turning off two-factor authentication
The approach is confirmed valid but it is not a general solution.
Turn off two-factor authentication from appleid.apple.com. Note that it is Two-factor Authentication instead of Two-step Verification.
However, AppleIDs created in iOS 10.3 or macOS 10.12.4 and higher cannot turn off 2-factor authentication. If you have 2-factor authentication enabled under these system versions, you can turn off 2-factor authentication by clicking the link in the confirmation email within two weeks, and you cannot turn it off after two weeks.
Alternative Solutions
If the solutions above do not work for you, you can try the following methods.
The following approaches are valid, but they may affect daily use.
- Create a brand new iCloud account and manually migrate the data from your old account (use with caution! Dirty data on your device may contaminate your new account!)
- Logging iOS devices out of the iCloud account
The following solutions have been confirmed invalid
- Logging out and back into iCloud account
- Logging macOS device out of iCloud account
- Clearing the Safari password on iOS devices
- Using Surge(A Network Extension app) to Reject the URL like p*–.icloud.com to prevent iCloud from syncing
- Turning off iCloud Keychain on iOS device
- Reseting the Keychain database from Keychain Access
References
- https://forums.developer.apple.com/thread/105722
- https://forums.macrumors.com/threads/excessive-data-consumption-for-documents-sync-and-constantly-high-cpu-load-on-iphone-and-ipad.2127349/
- https://arstechnica.com/civis/viewtopic.php?f=19&t=1433841
- https://www.reddit.com/r/jailbroke2/comments/8sgj2n/help_this_block_of_text_is_being_spammed_in_my/
- https://www.v2ex.com/t/459452
- https://forums.developer.apple.com/thread/104020
- https://stackoverflow.com/questions/26827809/app-rejection-crash-report-says-failed-to-scene-create-in-time-badf00d-what
- https://hitcon.org/2017/CMT/slide-files/d1_s2_r2.pdf
发表回复/Leave a Reply