I have a process on my computer which keeps logging to the system.

May  2 19:50:06 laptop com.apple.xpc.launchd[1] (com.coconut-flavour.coconutBattery-Helper[23430]): Could not find and/or execute program specified by service: 155: Refusing to execute/trust quarantined program/file: com.coconut-flavour.coconutBattery-Helper

I cannot figure out where the process is located.

What I have tried:

sudo launchctl list | grep com.coc

sudo find / -iname com.coconut-flavour.coconutBattery-Helper

I have also tried sampling and finding the process in the launchd service in activity monitor.

It does not seem to exist. Anyone know what could be going on?

  • 1
    You might wanna give this a try. I've used it to diagnose weird little problems on my Mac before and it's always worked well. etrecheck.com. It's a free download. Of course it's understandable if you're hesitant to download something. But it's recommended by all the high level forum users at discussions.apple.com.
    – I0_ol
    Commented May 3, 2017 at 4:17
  • 1
    Did you try the find with a shorter part of the name and wildcards as well (*coconut*)?
    – nohillside
    Commented May 3, 2017 at 5:18
  • @I0_ol - etrecheck is an interesting tool. not sure if it fixes this issue, but I like it.
    – Dobler
    Commented May 4, 2017 at 6:09
  • @patrix - good suggestion. it found alot of stuff.
    – Dobler
    Commented May 4, 2017 at 6:11

2 Answers 2


Forgive my absence and untimely response. Okay, let's take this to the next level.

Let's attempt to locate either coconutBattery or Sparkle, a dependent, apparently. Do you find a 'coconutBattery.app' in /Applications, or any similar app?

sudo find /Applications -iname "*coconut*" -print    
sudo find /Applications -iname "*sparkle*" -print

Is there a relevant package receipt in the package utility?

sudo pkgutil --pkgs | grep -i coconut
sudo pkgutil --pkgs | grep -i sparkle

A brute method to find plists, preference files:

sudo grep -l -i "coconut" -r /System/Library/
sudo grep -l -i "sparkle" -r /System/Library/
sudo grep -l -i "coconut" -r /Library/
sudo grep -l -i "sparkle" -r /Library/

sudo grep -l -i "sparkle" -r /private/var/
sudo grep -l -i "sparkle" -r /private/etc/
sudo grep -l -i "coconut" -r /private/var/
sudo grep -l -i "coconut" -r /private/etc/


Interesting situation.

First, let us determine in what user-context the service is running: login user, or root. I suspect that the service might be running in the login user context, which would explain why you will not find it by running 'launchctl list' as root ( via sudo ). A quick check:

launchctl list | grep -i "com.coco"

Avoid prepending 'sudo' to the launchctl command.

Also, the process id is reported in the syslog messages -- found within the block brackets [ ].


The PID is 23430, in that example. I suggest using a ps like this:

ps -wwwAxo pid,ppid,state,%mem,%cpu,command | grep -i coco

Or grep the PID you discover from the syslog like this:

ps -wwwAxo pid,ppid,state,%mem,%cpu,command | grep 23430

If my hunch is correct, and it is under your login user's context that the service runs, then locate the offending plist in something like:

/Users/[your login user's short name]/Library/LaunchAgents

A quick-and-dirty method:

grep -r -i "coco" ~/Library/LaunchAgents/

This should identify the offending sneak. If not, please let me know and we will then take the hunt to the next level.

  • well i still can't find it. I've already looked in those locations. Whats the next level?
    – Dobler
    Commented May 4, 2017 at 20:21
  • I might have laughed harder, were the morphology of path more properly, comically expressed as something akin to ../~/Library/LaunchDaemons or even ~/Library/LaunchDaemons/../../... Indeed, the next level... Commented Jul 1, 2017 at 2:04

You may want to try the LaunchControl utility. It's free and will show all launchdaemons/agents, what they do, and let you disable/enable. Very handy.


  • doesn't seem to be compatible with sierra
    – Dobler
    Commented May 4, 2017 at 20:22
  • I am currently running it on Sierra.
    – Hefewe1zen
    Commented May 4, 2017 at 21:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .