Multiple "ES_EVENT_TYPE_AUTH_CLONE" are created.

Have you run an fs_usage trace against the process generating doing the copy? I suspect that these excess events aren’t coming from the ES subsystem but from the source process itself, and an fs_usage trace would let you confirm that.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

I verified and found that, the extra 2 ES_EVENT_TYPE_AUTH_CLONE events … are coming from process … DesktopServicesHelper.

Yeah, that’s what I suspected. What’s happening here is that, when you copy a file using the Finder, it first tries to run that copy locally, that is, from within the Finder process itself. If that fails it passes the job off to a helper process which is able to escalate privileges. This makes sense because, in general, most permission errors can be bypassed by escalating privileges. In your case, however, it’s not going to help and thus you see these redundant requests.

I don’t think there’s anything your ES client can do about that. Then again, I don’t consider this to be major negative. An ES client has to process requests promptly and so processing a few extra requests isn’t a big deal.

However, if this is causing you significant grief I recommend that you file a bug about it. And if you do file a bug, please post your bug number, just for the record.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

That depends on what you mean by “suggest”:

• If you’re looking for a reliable solution then, no, because there’s no way for the Finder to communicate that context to the kernel and thence to your ES client.

• If you’re looking for heuristics, you can get the BSD-level credentials out of the request, right?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"