Mein MacBook Pro, High Sierra, hat gestern Abend im Schlaf 13G heruntergeladen

Das System war vermutlich an meinem Arbeitsplatz geschlossen.

Wie finde ich warum? Etwas Licht auf diese 13 GB? Wie findet Activity Monitor diese Nummern? Ich werde gerne weitere Informationen bereitstellen, solange der Computer noch nicht heruntergefahren ist.

Ich habe keine automatischen Updates, das letzte war am 27. Juni, vor mehr als einer Woche.

system.log ist voll von Einträgen wie:

Aug  4 11:59:23 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug  4 11:59:33 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd[7132]): Service exited with abnormal code: 1
Aug  4 11:59:33 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug  4 11:59:44 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd[7133]): Service exited with abnormal code: 1
Aug  4 11:59:44 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug  4 11:59:54 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd[7134]): Service exited with abnormal code: 1
Aug  4 11:59:54 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug  4 12:00:04 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd[7135]): Service exited with abnormal code: 1
Aug  4 12:00:04 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug  4 12:00:14 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd[7136]): Service exited with abnormal code: 1

Während der Nacht, wenn es hätte schlafen sollen - der Laptop war sehr lebendig:

Aug  4 00:53:44 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:53:51 MacBook-Pro syslogd[45]: ASL Sender Statistics
Aug  4 00:53:54 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3849]): Service exited with abnormal code: 1
Aug  4 00:53:54 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:54:04 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3850]): Service exited with abnormal code: 1
Aug  4 00:54:04 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:54:15 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3851]): Service exited with abnormal code: 1
Aug  4 00:54:15 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:54:26 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3852]): Service exited with abnormal code: 1
Aug  4 00:54:26 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  4 00:54:36 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3853]): Service exited with abnormal code: 1
Aug  4 00:54:36 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:54:47 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3854]): Service exited with abnormal code: 1
Aug  4 00:54:47 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:54:57 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3855]): Service exited with abnormal code: 1
Aug  4 00:54:57 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:55:07 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3856]): Service exited with abnormal code: 1
Aug  4 00:55:07 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 2 seconds. Pushing respawn out by 8 seconds.
Aug  4 00:55:19 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3857]): Service exited with abnormal code: 1
Aug  4 00:55:19 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:55:28 MacBook-Pro systemstats[56]: assertion failed: 17A315i: systemstats + 641142 [8F334E9C-6F6C-3ED1-9251-D75E5C8E9EEC]: 0x5

network performance high-sierra

— Liviu
quelle

Haben Sie die automatische Aktualisierung für ein Programm oder das System aktiviert?

— Solar Mike

Nein, meine Kollegen vermuten Touristd oder so

— Liviu

Wir haben momentan nur eine begrenzte Bandbreite, daher ist dies sehr wichtig.

— Liviu

touristd ist verantwortlich für das "New to Mac?" Benachrichtigung, die angezeigt wird, wenn Sie gerade mit der Verwendung Ihres Mac beginnen. Ich schlage vor, Sie installieren Little Snitch obdev.at und überwachen die Statistiken von dort aus. Sie können sehen, welche App oder welcher Prozess so viel Datenübertragung generiert.

— l1ghthouse

@Liviu Könnte einfacher gewesen sein, es mit Little Snitch

— Skeleton Bow

Es wurde touristdalle paar Sekunden neu gestartet und mehr als 10 Millionen pro Minute heruntergeladen. Ich weiß nicht, was es tut. Ich habe versucht, alle internetbezogenen Optionen zu deaktivieren, aber es wurde immer wieder aktiviert.

$ launchctl unload /System/Library/LaunchAgents/com.apple.touristd.plist 
/System/Library/LaunchAgents/com.apple.touristd.plist: Operation not permitted while System Integrity Protection is engaged

Starten Sie "Recovery OS" neu

csrutil enable --without fs --no-internal

Dann normal neu starten und

$ sudo mkdir /backup
Password:
$ sudo mkdir /backup/System
$ sudo mkdir /backup/System/Library/
$ sudo mkdir /backup/System/Library/LaunchAgents/
$ sudo mv /System/Library/LaunchAgents/com.apple.touristd.plist /backup/System/Library/LaunchAgents/
$ ll /backup/System/Library/LaunchAgents/com.apple.touristd.plist 
-rw-r--r--  1 root  wheel  897 Mar 28 03:55 /backup/System/Library/LaunchAgents/com.apple.touristd.plist

Starten Sie "Recovery OS" neu

csrutil enable

— Liviu
quelle

Das ist schmerzhaft. Hervorragende Analyse und Schritte zum Deaktivieren von sip und zum Deaktivieren des spthat-Daemons. Ich frage mich, ob ich einen Fehler melden muss, um ein Mutterprofil zu erhalten, das das für die Arbeit deaktiviert. Offensichtlich eine Fehlerbedingung, und diese Daten werden nicht heruntergeladen, sobald High Sierra ausgeliefert wird.

— bmike