How to efficiently track down mystery audio notifications in macOS/OS X

Apple builds a nightmare notification castle by default. Everything wants to notify the user/visitor about everything. Very soon one becomes notification blind or just wants to toss a €2800 MacBook Pro out the window.

Apple recognised this issue fairly early and has been building lots and lots of tools to allow users to restrict notifications. There’s the notification centre where one can make about six decisions per application about what kind of notification is allowed.

Granular but way-overcomplicated.¹

Then in Focus screen one can further customise what kind of notifications are allowed. I’ve set Focus to only allow notifications from Signal and RocketChat.

But don’t worry – there’s another set of hidden overrides which allow time-sensitive notifications, calls from Favourites (I turn off Messages so I’m safe) and Allow repeated calls. I don’t know if “Allow repeated calls” only applies to Messages or also to Signal and other messaging applications. Knowing Apple it applies to just its own Messages.

In principle, there’s a lot of ways to control and slow down notifications. Way too much busywork in my opinion. Steve Jobs would not have put up with it. This is anything but Zen and very Microsofty.²

Despite having most notifications locked down, I am occasionally confronted with an audio beep or gong which I can’t figure out. There’s all kinds of bad advice out there, including the incredibly shallow suggestion to “restart your computer”. The gong/beep/bing will come back again, just later.

Poring over the Notifications preference pane probably won’t help either. If we’re lucky something might show up in Notifications centre to clue us in. Often not.

Are we doomed to spend our life in notification hell? Not anymore.

lsof to the Rescue – Isolate Recently Played Sounds

There’s a quick way to track down to errant audio beeps/bings/gongs via terminal. These bings/beeps/gongs are all generated by files which are run by applications. The lsof command “List of Open Files” will let you find which sounds have opened lately which will point out which program is generating the annoying noises. Here’s what it looks like:

lsof | grep -E ".aif|.wav|.aiff"

What this means is look for all open files, filter for files with .aif, .wav and .aiff extensions. There’s no real need to treat .aif and .aiff separately as the former will find the latter but as both filetypes exist it’s cleaner in terms of housekeeping to include them explicitly. You can easily add additional filetypes to the search with a vertical pipe in the same pattern.

The capital E stands for Extended grep which is easier for mere mortals to write and read as advanced characters need not be escaped. I struggle with normal grep but grep -E makes sense to me.

lsof also helps to eject busy disks

This lsof command is also very useful to track down applications which are keeping files open and preventing safe disk ejection. In this case, you’ll be facing an error message like: “The volume can’t be ejected because it’s currently in use.” or “The disk “YourDisk” wasn’t ejected because one or more programs may be using it.”

Here’s the command for that.

sudo lsof /Volumes/MacintoshHD

MacintoshHD is for the name of your volume which you can’t eject. Running lsof on your boot drive is useless as your boot drive will potentially yield over 16355 open files (in my case right now). But for external disks it works fine.³

You should run lsof with sudo as otherwise you will miss files opened by root. The grep form of the command is sometimes recommended:

lsof | grep /Volumes/[name_of_drive]

While it works, the grep form is to be avoided as it takes about 20 to 30 seconds to run. lsof filters its own files just fine and does so instantly.

Once you have the name of the application keeping a file open, then you can:

1. quit the application
2. force quit the application in Activity Monitor
3. use kill -pid where pid is the process ID from the lsof command above

There’s also the venerable What’s Openapp originally created in 2008 by Franklin Marmon of Ham Engineering and now resurrected by Thomas Templemann. What’s Open will show all the open files for a specific volume and allow the user to kill the program directly. This is one case where it’s probably worth knowing the command line versions as they are short and sweet and open a new world of power to an expert user.

Additional lsof security functionality

lsof can do additional magic in tracking down open ports including potential security risks from applications holding ports open but that’s beyond the scope of this article.

Alec Kinnear

Alec has been helping businesses succeed online since 2000. Alec is an SEM expert with a background in advertising, as a former Head of Television for Grey Moscow and Senior Television Producer for Bates, Saatchi and Saatchi Russia.