This might be a bug in MacOS Sequoia version 15.3.2 or possibly earlier, but I started noticing a lot of disk access on my external drives in a Thunderbolt array. Looking at Activity Monitor, it looked like mediaanalysisd was reading and writing an unusually large amount of data. Running the Console application to see the log file, there appeared to be a lot of errors about medianalysisd failing to decode the first frame of an image, but the filename was displaying as <private>. In order to see the filenames in the log, I had to create and install a special custom Device Management profile (reference https://superuser.com/questions/1311578/in-console-app-how-can-i-reveal-to-what-private-tags-are-actually-referring). In case that link goes away, create a file called something like PrivateLogViewer.mobileconfig with this in it:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>PayloadDisplayName</key>
<string>ManagedClient logging</string>
<key>PayloadEnabled</key>
<true/>
<key>PayloadIdentifier</key>
<string>com.apple.logging.ManagedClient.1</string>
<key>PayloadType</key>
<string>com.apple.system.logging</string>
<key>PayloadUUID</key>
<string>ED5DE307-A5FC-434F-AD88-187677F02222</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>System</key>
<dict>
<key>Enable-Private-Data</key>
<true/>
</dict>
</dict>
</array>
<key>PayloadDescription</key>
<string>Enable Unified Log Private Data logging</string>
<key>PayloadDisplayName</key>
<string>Enable Unified Log Private Data</string>
<key>PayloadIdentifier</key>
<string>C510208B-AD6E-4121-A945-E397B61CACCF</string>
<key>PayloadRemovalDisallowed</key>
<false/>
<key>PayloadScope</key>
<string>System</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>D30C25BD-E0C1-44C8-830A-964F27DAD4BA</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>
Then double click on the file and go to System Settings->General->Device Management and temporarily enable it.
To find the problematic files, run something like from a Terminal window:
log show --last 25m |grep mediaanalysisd |grep -i file:
Most of the problematic files were old Quicktime MOV files that were encoded using obsolete codecs such as Sorenson or Cinepak. I used ffmpeg to convert them to h.264. For example, a little Perl script like:
#!/usr/bin/perl -w
my $in = $ARGV[0] or die;
my $tmp = "$$.mov";
my $cmd = qq[ffmpeg -i '$in' -c:v h264_videotoolbox -q:v 65 -c:a copy /tmp/$tmp];
system($cmd);
system("mv /tmp/$tmp '$in'");
Once the problematic files have been converted or deleted, go back to the Device Management settings and remove that profile that enables private data logging.
