Sample Header Ad - 728x90

Unix OSX invisible process, how do I identify further information?

3 votes
0 answers
209 views
Using execsnoop -v, I note a dtrace error for two processes. ID3 (ID 630) and ID2 (ID 360). ~ 03:59 am ∆:ps -p 260 PID TTY TIME CMD 260 ?? 0:02.36 /usr/libexec/UserEventAgent (Aqua) ~ 03:59 am ∆:ps -p 630 PID TTY TIME CMD ~ 03:59 am ∆:sudo execsnoop -v Password: STRTIME UID PID PPID ARGS dtrace: error on enabled probe ID 2 (ID 260: syscall::execve:return): invalid >kernel access in action #8 at DIF offset 0 dtrace: error on enabled probe ID 3 (ID 630: syscall::posix_spawn:return): >invalid kernel access in action #8 at DIF offset 0 dtrace: error on enabled probe ID 3 (ID 630: syscall::posix_spawn:return): >invalid kernel access in action #8 at DIF offset 0 dtrace: error on enabled probe ID 3 (ID 630: syscall::posix_spawn:return): >invalid kernel access in action #8 at DIF offset 0 dtrace: error on enabled probe ID 3 (ID 630: syscall::posix_spawn:return): >invalid kernel access in action #8 at DIF offset 0 dtrace: error on enabled probe ID 3 (ID 630: syscall::posix_spawn:return): >invalid kernel access in action #8 at DIF offset 0 dtrace: error on enabled probe ID 3 (ID 630: syscall::posix_spawn:return): >invalid kernel access in action #8 at DIF offset 0 dtrace: error on enabled probe ID 3 (ID 630: syscall::posix_spawn:return): >invalid kernel access in action #8 at DIF offset 0 dtrace: error on enabled probe ID 3 (ID 630: syscall::posix_spawn:return): >invalid kernel access in action #8 at DIF offset 0 dtrace: error on enabled probe ID 3 (ID 630: syscall::posix_spawn:return): >invalid kernel access in action #8 at DIF offset 0 dtrace: error on enabled probe ID 3 (ID 630: syscall::posix_spawn:return): >invalid kernel access in action #8 at DIF offset 0 dtrace: error on enabled probe ID 2 (ID 260: syscall::execve:return): invalid >kernel access in action #8 at DIF offset 0 ^C ~ 04:01 am ∆:ps -p 3 PID TTY TIME CMD ~ 04:01 am ∆:ps -p 2 PID TTY TIME CMD My understanding is this is generated by a process that has a hold on dtrace being active for that process. I note that the processes do not show up in the top command list nor in Activity Monitor. The two processes reoccur with a full restart, and are hence consistent and I presume some OSX process. Just puzzling that they can not be fully identified. Curious to understand what is going on here.
Asked by Cam_Aust (131 rep)
Dec 26, 2016, 04:19 PM
Last activity: Dec 26, 2016, 10:30 PM