Hi guys Following this topic : https://developer.apple.com/forums/thread/654443 I test this in macOS 14 beta, audit can't work now. Is it expected or a bug? If it is expected, is there any announcement ? Thank you! Command return error: sudo audit -i Error sending trigger: (ipc/send) invalid destination port

Hi, According to https://developer.apple.com/videos/play/wwdc2022/10096/, agent user can disable login item on Ventura. In enterprise environment, IT admin may want some processes are always running in launch daemon. Is there a MDM rule to forbidden agent user to disable special login item? Thank you!

Hi, I have a endpoint security process on macOS 11.4 and it cost 900+M memory. I get the memory graph and find Accounts framework alloc many memory   Dirty      Clean  Reclaimable    Regions    Category     ---        ---          ---        ---    ---  925 MB        0 B          0 B      14012    Accounts framework Some traceTrees are like these:     3 VM: Accounts framework  0x130e78000-0x130e89000 [V=68K] r--/r--         3 Region Accounts framework  region + 0 0x121ff0000         2 0x7fcc3d023a00 [1536]  +1341:  0x7fcc3d023f3d --> offset 65536         + 1 Region __DATA_DIRTY /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation __DATA_DIRTY __data: '__CFRuntimeClassTable' + 2224 0x7fff80292090         + 1 Region __DATA_DIRTY /System/Library/Frameworks/Security.framework/Versions/A/Security __DATA_DIRTY __bss: 'Security::KeychainCore::gTypes()::nexus' 0x7fff803182a0         1 0x7fcc3be10650 [784]   +477:  0x7fcc3be1082d --> offset 65663           1 <icu::SharedDateFormatSymbols 0x7fcc3d02c000> [1536]   +128:  0x7fcc3d02c080 --> offset 8             1 0x7fcc3c813200 [3072]  +2480:  0x7fcc3c813bb0               1 0x7fcc3bf056a0 [80]     +0:  0x7fcc3bf056a0                 1 <icu::UnifiedCache 0x7fcc3bf05660> [64]     +8:  0x7fcc3bf05668                   1 Region __DATA_DIRTY /usr/lib/libicucore.A.dylib __DATA_DIRTY __bss + 3552 0x7fff8081cf30     2 VM: Accounts framework  0x112bb2000-0x112bc3000 [V=68K] r--/r--         2 Region Accounts framework  region + 0 0x110ff0000         2 0x7fcc3be06ea0 [432]   +197:  0x7fcc3be06f65 --> offset 65663           1 Region __DATA_DIRTY /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation __DATA_DIRTY __data: '__CFRuntimeClassTable' + 2176 0x7fff80292060           1 Region __DATA_DIRTY /System/Library/Frameworks/Security.framework/Versions/A/Security __DATA_DIRTY __bss: 'Security::CodeSigning::gCFObjects' 0x7fff803180d8 Is this a system bug? And what is VM: Accounts framework?

Hi, I use following code to add listener for kCMIODevicePropertyDeviceIsRunningSomewhere to get using camera notification. opa.mSelector = kCMIODevicePropertyDeviceIsRunningSomewhere;             opa.mScope = kCMIOObjectPropertyScopeGlobal;             opa.mElement = kCMIOObjectPropertyElementMaster;             result = CMIOObjectAddPropertyListenerBlock(CMIOObjectID(camera), &opa,NULL, CameralistenerBlock); This code can work as expected before. But when I test it with macOS 12 on M1, the listener callback block is invoked by mistake when I open Music.app or iTunes. When I run my application for two processes, the 1st process will get listener callback when the 2nd process invoke CMIOObjectAddPropertyListenerBlock. Is it a bug of macOS 12? Or spec is changed? Any suggestion? Thank you very much!

Hi Heap is less than footprint. Why it happen?And how can I get the detail memory info beside heap? Thank you!

Hi All, We met a kernel panic on Big Sur. Any one met similar issue?Is it about bluetooth? Should I disable bluetooth to avoid this? Or is it related to system extension?There should be no 3rd party kext on Big Sur now. System panic with bluetoothd before shutdown. "macOSPanicString" : "panic(cpu 0 caller 0xffffff800b2bf424): \"Zone element 0xffffff93775a5000 was modified after free for zone kext.kalloc.4096: \" \"Expected element to be cleared\"@\/AppleInternal\/BuildRoot\/Library\/Caches\/com.apple.xbs\/Sources\/xnu\/xnu-7195.50.7\/osfmk\/kern\/zalloc.c:1968 Backtrace (CPU 0), Frame : Return Address 0xffffffb0ce013420 : 0xffffff800aabc66d 0xffffffb0ce013470 : 0xffffff800abff073 0xffffffb0ce0134b0 : 0xffffff800abef6aa 0xffffffb0ce013500 : 0xffffff800aa61a2f 0xffffffb0ce013520 : 0xffffff800aabbf0d 0xffffffb0ce013640 : 0xffffff800aabc1f8 0xffffffb0ce0136b0 : 0xffffff800b2bee1a 0xffffffb0ce013720 : 0xffffff800b2bf424 0xffffffb0ce013730 : 0xffffff800ab17fca 0xffffffb0ce013760 : 0xffffff800ab191f2 0xffffffb0ce0137e0 : 0xffffff800aacabf4 0xffffffb0ce013830 : 0xffffff800b17a064 0xffffffb0ce013850 : 0xffffff800cf81c2e 0xffffffb0ce013890 : 0xffffff800cfb9da2 0xffffffb0ce0138d0 : 0xffffff800cf7b87f 0xffffffb0ce013900 : 0xffffff800cf76467 0xffffffb0ce013a60 : 0xffffff800b21988f 0xffffffb0ce013ac0 : 0xffffff800cf75623 0xffffffb0ce013b20 : 0xffffff800b2502bb 0xffffffb0ce013c80 : 0xffffff800abaaa61 0xffffffb0ce013d90 : 0xffffff800aac1d77 0xffffffb0ce013e00 : 0xffffff800aa985d5 0xffffffb0ce013e60 : 0xffffff800aaafb82 0xffffffb0ce013ef0 : 0xffffff800abd3823 0xffffffb0ce013fa0 : 0xffffff800aa62216 Kernel Extensions in backtrace: com.apple.iokit.IOBluetoothFamily(8.0.1f5)[4E63E05D-2B02-3854-82E6-36F67462345C]@0xffffff800cf64000->0xffffff800cffffff dependency: com.apple.iokit.IOACPIFamily(1.4)[65A1D60D-F9AF-37E7-B854-4127FBB3172A]@0xffffff800ced2000->0xffffff800ced3fff dependency: com.apple.iokit.IOBluetoothPacketLogger(8.0.1f5)[3A433EB1-3E68-3AF6-BF33-B156A3D32C09]@0xffffff800d050000->0xffffff800d055fff dependency: com.apple.iokit.IOReportFamily(47)[0EC55CCD-966C-33F4-9B8A-1E9CB2778AE7]@0xffffff800d44d000->0xffffff800d44ffff dependency: com.apple.iokit.IOUSBHostFamily(1.2)[93FDB186-D1A6-3D5E-B91E-2CF4D3DAC235]@0xffffff800d749000->0xffffff800d7d5fff

Hi If a x86 program use dlopen/dlclose to load/unload a dylib, it could trigger memory increasing on M1. I am not sure whether it is a leak, leaks command shows no leak, but memory increasing with dylib category. Dirty Clean Reclaimable Regions Category-- --- --- --- 1560 MB 0 B 0 B 1642 dylib It could be reproduced every time even only dlopen/dlclose a dylib without doing anything. Any idea?

Hi guys, I run my x8664 app in M1 Mac mini via Rosetta, but find it hang at: 2957 Thread89087 2957 threadstart (in libsystempthread.dylib) + 15 [0x7fff2039647b] 2957 pthreadstart (in libsystem_pthread.dylib) + 224 [0x7fff2039a950] 2957 Thread::threadStubFunc(void*) (in libTmUtil.dylib) + 19 [0x10af60535] 2957 decompress(void*) (in libdecompress.dylib) + 721 [0x1134a7b0a] 2957 Decompress (in lib7z.dylib) + 831 [0x1136f08e7] 7z.cpp:146 2957 CObjectVector<CCodecLib>::Clear() (in lib7z.dylib) + 81 [0x1136d9849] MyVector.h:503 2957 NWindows::NDLL::CLibrary::Free() (in lib7z.dylib) + 26 [0x1136e18d2] DLL.cpp:42 2957 dlclose (in libdyld.dylib) + 170 [0x7fff203b3a27] 2957 dlclose (in dyld) + 191 [0x2029fd7af] 2957 dyld::garbageCollectImages() (in dyld) + 964 [0x2029f25b5] 2957 ??? (in Rosetta JIT) [0x102b4647c] 2957 ??? (in Rosetta Runtime Routines) [0x102b010e8] 2957 ??? (in runtime) load address 0x7ffdffd34000 + 0x1b3c8 [0x7ffdffd4f3c8] 2957 ??? (in runtime) load address 0x7ffdffd34000 + 0x254b8 [0x7ffdffd594b8] 2957 ??? (in runtime) load address 0x7ffdffd34000 + 0x24f98 [0x7ffdffd58f98] 2957 ??? (in runtime) load address 0x7ffdffd34000 + 0xaf24 [0x7ffdffd3ef24] 2957 ??? (in runtime) load address 0x7ffdffd34000 + 0x2d10 [0x7ffdffd36d10] Is there any idea? Thank you very much!

I noticed that BSM audit is deprecated with macOS 11 beta(Xcode 12 beta). Is there any replacement? Or any suggestion?

As far as I known, there is a cache on file system. Is it impossible to disable it for special process? I have a process to access many files. I think the file system cache has size limitation.If cache is enable for it, other processes maybe lost their file system cache, then cause some performance issues on HDD. Thank you!