8

I'm trying to help a colleague whose MacBook periodically switches off without warning (I've had similar problems on a Mac Mini, so it's not power related).

While investigating the logs in Library/Logs, I found a file talagent.log with something very odd, last updated very close to the time the computer last switched off without warning:

  Time  Bundle ID   Status  Comment
 0.000          -        -  TALagent Started (system uptime: 238.18 sec)
 0.007          -        -  Liveness: 0 -> 1 (run_as_server)
 0.038          -        -  Successfully read encryption key from keychain in 0.030809 seconds
15.007          -        -  Liveness: 1 -> 0 (__run_as_server_block_invoke)
15.007          -        -  Exiting out of boredom

What the heck is talagent and what does it mean that it is "Exiting out of boredom"?

I've read this thread but it doesn't help me understand what's going on here.

My first thought was that it must be a virus, because that's such a non-professional thing for a log entry to say, but that linked thread seems to imply it's not such a concern; but it doesn't help me understand what it is or what that means.

We use Symantec as a virus scanner, and the Mac in question is on Mavericks (can't currently update for unrelated compatibility reasons).

  • 1
    Usually that means that it is exiting because nothing has called it. (It's usually normal for Apple things to output strange messages.) Though I can't answer this as an answer, since I don't know why it's turning off your computer. – Spotlight Apr 14 '15 at 12:21
6

It's not a virus and it's not a customer facing tool since it uses the terminal. Sometimes command line tools don't even get a manual page - so this is one of the much better documented tools.

The Transparent Application Lifestyle is fancy words for versions and auto-save. If you open TextEdit and make a document, you never have to save your work or choose where the untitled document is stored. TAL saves it and then assists with versioning once you explicitly save the document to the filesystem or cloud.

If you're not convinced it ships from Apple, use mdfind talagent to examine where the tool is installed.

Apple runs it at 3 am on Mondays and Thursdays on your Mac by default, so there's not much mystery that it runs and then exits as opposed to something that runs forever waiting for work to do.

It's nice to double check since governments are now clearly equipped to suppress knowledge of their state sponsored malware by using legal threats and gag orders. I'd say some healthy skepticism is in order when you see something not right on your computer.

  • 2
    @terdon Thanks for the request for clarification-I wanted to relate to govt installation of key loggers and other trojans in the interest of national security. Things like stuxnet, quantum & much from Snowden or Greenwald or even mainstream media covering the NSA's TAO – bmike Apr 14 '15 at 16:49
  • 1
    I'll change the wording - it's not important and I'd rather not impugn anyone that works for said vendors. The idea was, my innocence in trusting vendors, governments and people to not compromise on a massive scale the personal contents of law abiding citizen's computers and digital lives has been shattered. I presume most other technical minded folk are in a similar boat. – bmike Apr 14 '15 at 16:58
3

About TALagent, you can get this from the man page :

 talagent -- helper agent for the Transparent App Lifecycle feature.

 The talagent daemon provides services related to the Transparent App
 Lifecycle feature.  talagent may also be run manually as a command line
 tool to output information about persistent state.

If you want a bit more on the Transparent App Lifecycle, there is an answer on other Ask Different post.

About the log message, it's just a weird/funny quitting message.

  • Thanks, but I'm still having trouble understanding the message. It looks like something that monitors "the progress of an app from its launch through its termination" booted up, observed something running as server, then observed something changing from 1 to 0 (shutting down?), then closed. Any idea how I could go about finding out what app was having its life cycle monitored? I'm struggling to find any clear docs on TALagent – user568458 Apr 14 '15 at 12:32
  • Browsing this thread which has an example of a TALagent log, it looks like my log is simply reporting on itself (hence no bundle ID, which normally look like com.apple.Safari). I think the above means it booted up (for reasons unknown), routinely checked the encryption key, did nothing for 15 units of time (seconds? minutes?), then shut itself down routinely. I think... – user568458 Apr 14 '15 at 12:48
  • That's what it looks like to me too. – Matthieu Riegler Apr 14 '15 at 14:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .