15

Since Yosemite and in every later operating system OS X/macOS runs coreduetd from /usr/libexec/coreduetd with the bundle-id com.apple.coreduetd.osx in the background.

  • What exactly is this process doing?
  • On which hardware does this run (i.e.: is its functionality supported)?
  • Can it be disabled?
  • How can it be disabled?
  • Should it be disabled?
  • What are the (potential) side effects of it being disabled (dependencies)?

This question should not be read as a YX-Problem but an attempt to eventually add to the list of canonical questions.

  • We should talk about this on Ask Different Meta - it’s also a canonical question for one we want to close as “too broad” and “too wiki” - we don’t want to encourage questions that lack a practical question to be solved and we certainly don’t want to write a “macOS system internals” book one chapter a time and one daemon a time. I’ll refrain from closing from now - but there are fundamental problems with doing this systematically IMO. – bmike Sep 4 '17 at 19:02
  • did you ever have a Apogee Duet installed? – Lane Nov 27 '17 at 20:47
13

There's not much on the web as to what coreduetd does on a Mac other than "it's used for Handoff between iOS and macOS."

What is it doing?

It's keeping track of your various system and application states including states across your Apple devices.

Can it be disabled?

Technically, yes using launchctl. Though, I (highly) don't recommend doing so.

Should it be disabled?

Completely subjective question. Only you can decide if this is the right course for you. Again, I recommend that you don't.

What are the (potential) side effects of it being disabled (dependencies)?

Potentially, the following may be affected:

  • Handoff between iOS and macOS would be affected
  • iCloud sync
  • Mail sync with Office 365

However doing a little sleuthing, I was able to find an iOS security research project (on http://sans.org) that examined the coreduet.db file on iOS. I applied that thinking to the coreduet.dbfile on macOS. Here's what I found...

Making a copy of the coreduet.db file, I examined it in sqlite3 by first getting a list of all the tables

$ sudo cp /var/db/CoreDuet/coreduet.db ~/

$ sudo sqlite3 coreduet.db

sqlite> .tables
ZCDDMAIRPLANEMODEEVENT    ZCDDMFORECASTINTEGER      ZCDDMSTATISTICINTEGER
ZCDDMAPPNAMEMAPPER        ZCDDMFORECASTREAL         ZCDDMSTATISTICREAL
ZCDDMAPPSTATECHANGEEVENT  ZCDDMFORECASTSCORE        ZCDDMSTATISTICSTRING
ZCDDMATTRIBUTENAMEMAPPER  ZCDDMFORECASTSTRING       ZCDDMSTRINGATTRIBUTE
ZCDDMBACKLIGHTEVENT       ZCDDMINTEGERATTRIBUTE     ZCDDMTHERMALEVENT
ZCDDMBATTERYEVENT         ZCDDMPLUGINEVENT          ZCDDMWAKEDNESSEVENT
ZCDDMBOOKKEEPING          ZCDDMPOOL                 Z_METADATA
ZCDDMBOOTORSHUTDOWNEVENT  ZCDDMPOOLNAMEMAPPER       Z_MODELCACHE
ZCDDMDEVICEEVENT          ZCDDMREALATTRIBUTE        Z_PRIMARYKEY
ZCDDMDEVICEMAPPER         ZCDDMSCREENLOCKEVENT
ZCDDMFORECAST             ZCDDMSLEEPORWAKEEVENT
sqlite>

It appears that there is a number of events it keeps track of. However, to see what we could see, I opened up the Z_PRIMARYKEY table:

sqlite> SELECT * FROM Z_PRIMARYKEY;
1|CDDMAirplaneModeEvent|0|81
2|CDDMAppNameMapper|0|218
3|CDDMAppStateChangeEvent|0|185302
4|CDDMAttributeNameMapper|0|101
5|CDDMBacklightEvent|0|0
6|CDDMBatteryEvent|0|0
7|CDDMBookkeeping|0|1
8|CDDMBootOrShutdownEvent|0|0
9|CDDMDeviceEvent|0|0
10|CDDMDeviceMapper|0|0
11|CDDMForecast|0|0
12|CDDMForecastInteger|0|0
13|CDDMForecastReal|0|0
14|CDDMForecastScore|0|0
15|CDDMForecastString|0|0
16|CDDMIntegerAttribute|0|0
17|CDDMPluginEvent|0|0
18|CDDMPool|0|79
19|CDDMPoolNameMapper|0|66
20|CDDMRealAttribute|0|0
21|CDDMScreenLockEvent|0|0
22|CDDMSleepOrWakeEvent|0|17
23|CDDMStatisticInteger|0|0
24|CDDMStatisticReal|0|0
25|CDDMStatisticString|0|0
26|CDDMStringAttribute|0|7293
27|CDDMThermalEvent|0|0
28|CDDMWakednessEvent|0|0
sqlite>

This particular database appears to track system events. Given that I am on a iMac, it would make sense that I don't have things like "BatteryEvent" or "PlugInEvent", but I would have "AppStateChangeEvents". "AirplaneMode" is a bit confusing as this is an iMac, but I do generally keep my WiFi off except for testing; at some point, this state was added to the database.

Going a bit further into the CCDMAirplaneModeEvent, we can see that it tracks not just when, but where the event took place (though my database has 0 data for those fields) and by whom.

select * FROM ZCDDMAIRPLANEMODEEVENT;

    Z_PK        Z_ENT       Z_OPT       ZAIRPLANEMODEON  ZANONYMIZEDBEACON  ZANONYMIZEDLOCATION  ZLOCALDAYSSINCESUNDAY  ZLOCALTIME  ZLOCALTIMEQUARTERHOURSLOT  ZNETWORKQUALITY  ZUSERID     ZCREATIONDATE
----------  ----------  ----------  ---------------  -----------------  -------------------  ---------------------  ----------  -------------------------  ---------------  ----------  -------------
81          1           1           0                0                  0                    0                      80704       0                          0                0           523938304
  • 2
    Excellent, but as you point out : don't touch it ... – Solar Mike Sep 4 '17 at 18:19
  • Indeed. Very quick and already very good. And "Mail sync with Office 365" is already affected on a local, stationary iMac? That's a surprise. – LangLangC Sep 4 '17 at 18:57
  • 1
    I think you're on the wrong track here. If you search the console app, the primary messages that get logged are power handling. My hunch is that the framework is and will always be a private framework so that Apple doesn't have to publish any sort of API to developers and that it will be reachable via indirection and other more stable API. It needs to track AirPlane mode and system state to know when and how to wake up the CPU to run scheduled tasks - manage power budgets on the hardware / CPU / GPU. – bmike Sep 4 '17 at 20:30
  • 1
    @bmike - I don't think so. Examining the AppStateChangeEvents, there is location data included which contains non-unique data. Theoretically, it should be the same if it was just power handling. Though, I do agree with you it's a private framework for Apple. – Allan Sep 4 '17 at 21:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .