corecaptured
/usr/libexec/plistbuddy com.apple.corecaptured.plist
Command: Dict {
Label = com.apple.corecaptured
ProgramArguments = Array { /usr/libexec/corecaptured }
POSIXSpawnType = Adaptive
MachServices = Dict { com.apple.corecaptured = true }
EnableTransactions = true
StartInterval = 345600 ⇐ at least every 4 days!
LaunchEvents = Dict {
com.apple.notifyd.matching = Dict {
com.apple.MCX._managementStatusChangedForDomains = Dict { Notification = com.apple.MCX._managementStatusChangedForDomains }
com.apple.ManagedConfiguration.profileListChanged = Dict { Notification = com.apple.ManagedConfiguration.profileListChanged }
}
com.apple.iokit.matching = Dict { com.apple.corecaptured = Dict { IOProviderClass = CCCapture } }
}
}
log file example
Jan 26 17:40:35 CCProfileMonitor::setStreamEventHandler Woken up by notifyd.Jan 26 17:40:35
CCProfileMonitor::setStreamEventHandler
Woken up by notifyd.Jan 26 17:40:35 CCProfileMonitor::profileCallback Entered token:9
Jan 26 17:40:35 CCProfileMonitor::profileCallback Entered token:9
Jan 26 17:40:35 CCProfileMonitor::setStreamEventHandler
Woken up by notifyd.Jan 26 17:40:36 pruneDirectoryOnOSUpgrade: activity enabled;snapshot 16C67, osversion 16C67
Jan 26 17:40:36 pruneDirectoryNDaysRead cap 7
Jan 26 17:40:36 CCProfileMonitor::freeResources Entered
Jan 26 17:40:36 Got an XPC error: Connection invalid
Jan 26 17:40:36 CCProfileMonitor::freeResources done
Jan 26 17:40:36 CCLogTap::profileRemoved, Owner: com.apple.iokit.IO80211Family, Name: ControlPath
Jan 26 17:40:36 CCLogTap::profileRemoved, Owner: com.apple.driver.AirPort.Brcm4360.0, Name: DriverLogs
Jan 26 17:40:36 CCLogTap::profileRemoved, Owner: com.apple.iokit.IO80211Family, Name: IO80211AWDLPeerManager
Jan 26 17:40:36 CCDataTap::profileRemoved, Owner: com.apple.driver.AirPort.Brcm4360.0, Name: StateSnapshots
Jan 26 17:40:36 CCDataTap::profileRemoved, Owner: com.apple.iokit.IO80211Family, Name: AssociationEventHistory
Jan 26 17:40:36 CCLogTap::profileRemoved, Owner: com.apple.iokit.IO80211Family, Name: OneStats
Jan 26 17:40:36 CCIOReporterFormatter::refreshSubscriptionsFromStreamRegistry clearing out any previous subscriptions
Jan 26 17:40:36 CCIOReporterFormatter::addRegistryChildToChannelDictionary streams 80
Jan 26 18:38:58 CCProfileMonitor::profileCallback Entered token:1
Jan 26 18:38:58 CCProfileMonitor::setStreamEventHandler
Jan 26 18:38:58 CCProfileMonitor::setStreamEventHandler Registered for notification callback.Jan 26 18:38:58 CCProfileMonitor::
setStreamEventHandler Woken up by notifyd.Jan 26 18:38:58 CCProfileMonitor::setStreamEventHandler Woken up by notifyd.Jan 26 18:38:58
CCProfileMonitor::setStreamEventHandler
Woken up by notifyd.Jan 26 18:39:58 pruneDirectoryOnOSUpgrade: activity enabled; snapshot 16C67,osversion 16C67
Jan 26 18:40:58 pruneDirectoryOnOSUpgrade: activity enabled; snapshot 16C67, osversion 16C67
Jan 26 18:40:58 pruneDirectoryNDaysRead cap 7
Jan 26 18:40:58 CCProfileMonitor::freeResources Entered
Jan 26 18:40:58 CCProfileMonitor::freeResources done
Jan 26 18:40:58 Got an XPC error: Connection invalid
Jan 26 18:40:58 CCLogTap::profileRemoved, Owner: com.apple.iokit.IO80211Family, Name: OneStats
Jan 26 18:40:58 CCIOReporterFormatter::refreshSubscriptionsFromStreamRegistry clearing out any previous subscriptions
Jan 26 18:40:58 CCIOReporterFormatter::addRegistryChildToChannelDictionary streams 80
Jan 26 18:40:58 CCLogTap::profileRemoved, Owner: com.apple.iokit.IO80211Family, Name: IO80211AWDLPeerManager
Jan 26 18:40:58 CCDataTap::profileRemoved, Owner: com.apple.driver.AirPort.Brcm4360.0, Name: StateSnapshots
Jan 26 18:40:58 CCLogTap::profileRemoved, Owner: com.apple.driver.AirPort.Brcm4360.0, Name: DriverLogs
Jan 26 18:40:58 CCDataTap::profileRemoved, Owner: com.apple.iokit.IO80211Family, Name: AssociationEventHistory
Jan 26 18:40:58 CCLogTap::profileRemoved, Owner: com.apple.iokit.IO80211Family, Name: ControlPath