How to find process that it is spawning

[apocalipto]

Hello,
I need some help to locate a process that is spawning a log review every 10 seconds on my MAC.

I am running MAC 12.2.1 Monterrey, under enterprise management SW. I am seeing that a log process is being spawned every 10 seconds or so.

I can tell by running the following command

% ps -A | grep predicate

97913 ?? 0:10.91 log show --predicate ( process MATCHES "RTProtectionDaemon" ) || ( process MATCHES "Setup Assistant" ) || ( subsystem == "com.name.onTrack" ) || ( subsystem == "com.name.cusametrics" ) --start 2022-07-21 17:29:00+0000 --end 2022-07-21 17:29:10+0000 --style json --timezone UTC



% ps -A | grep predicate

97940 ?? 0:03.43 log show --predicate ( process MATCHES "RTProtectionDaemon" ) || ( process MATCHES "Setup Assistant" ) || ( subsystem == "com.name.onTrack" ) || ( subsystem == "com.name.cusametrics" ) --start 2022-07-21 17:29:10+0000 --end 2022-07-21 17:29:20+0000 --style json --timezone UTC


As you can see above, a new process was spawned 10 seconds apart to query the log show.

What I'd like to know is, what process is triggering those queries? What I know so far is that
The parent process of these is Launchd, but when I query the log I'm unable to see something in there. Then, I checked the different files I have on /Library/LaunchDaemons and /Library/LaunchAgents, but I did not find instructions to run every 10 seconds. Unless the default timer is 10 seconds...


I also checked the logs "log show --last 60s" to try to find out if there were processes that read RTPProtectionDeamon or Setup Assistant, but I could not find any entries (there were to many ... )

Thank you!

 

[bogdanw]

Malwarebytes RTProtectionDaemon https://forums.malwarebytes.com/topic/265080-real-time-protection-rtprotectiondaemon-cpu-hog/

 

[apocalipto]

I don't have a process name RTProtectionDeamon, that is the strangest thing. so why would a process query that

 

[NoBoMac]

under enterprise management SW

Guessing there is a monitoring process running, supplied by the corporate overlords, looking for those items. That daemon is spawning every 10 seconds.

"cusametrics", "onTrack" sure sounds like making sure employees are getting their jobs done and in a timely manner. "Setup Assistant", making sure the employees are not trying to wipe/bypass device management.

RTProtectionDaemon might be starting up on a schedule to do a "virus scan" of the machine, so that would not show up once scan is done (assuming exits after completion of scan and not providing real-time scanning), and corporate IT is making sure 1) it ran 2) see if anything bad found.