eslogger: is it expected that the instigator of a profile event is always the mdmclient process?

When you use the eslogger command line tool to dump 'profile add' and 'profile remove' notify events, the instigator process seems to always be reported to be the mdmclient process whatever the "real" instigator is:

  • the Profiles pane in System Settings.app.
  • a MDM solution
  • the profiles command line tool.

[Q] Is this expected?

Because for another family of notify events where there is also an instigator field, the instigator points to the "real" instigator.

I think you could reasonably argue that the configuration profile subsystem should do a better job of surfacing the instigator to ES. If you want to make that case, I recommend that you put it in a a bug report.

Please post your bug number, just for the record.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Feedback ticket created: FB13751871

For the record, the "problem" is at the Endpoint Security framework level. I checked with an ES client and eslogger is correctly reporting the data it's getting for the instigator field.

Hmmm, that’s weird. AFAICT eslogger uses the ES API, so I wouldn’t expect to see different behaviour between it and your ES client.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

There are no different behaviors. As mentioned, eslogger reports the same value as the ES Framework.

For the record, the "problem" is at the Endpoint Security framework level.

eslogger: is it expected that the instigator of a profile event is always the mdmclient process?
 
 
Q