I'm running 11.1 on an M1 MBP. A couple of times an hour, some app starts up, very briefly puts an icon in the Dock, and quits. It's kind enough to also steal focus when it starts up, so if I'm typing, suddenly my typing goes somewhere else.

Is there a way I can track what apps start and quit, so I can figure out what is doing this and make it stop?

I thought maybe I could use execsnoop for this, but it tells me the SIP is turned on and exits.


Well the obvious solution is to temporarily disable SIP and run execsnoop as you’ve yourself identified.

There is a cruder and less reliable way which doesn’t require SIP disabled. The next time you see this happen, quickly go into Terminal and run

$ log show —-last 1m —-info —-debug —-predicate='sender contains "launchservicesd"' 

That will show you the last 1 minute of breadcrumbs from Launch Services, through which it is likely that your mystery process is being invoked. If it’s not, you won’t see it there. Look for (and/or grep) lines containing CHECKIN and DEATH.

  • Oh my goodness, using log from the terminal is good, but your comment me realize I can use Console.app to do this; it looks like filtering for "launch request" will do what I want... – Nate Feb 2 at 2:37
  • Also! Leaving a terminal up with log stream is maybe more convenient than log show as long as I'm not worried about the performance hit. Both log stream and Console.app streaming do use 5-10% CPU. – Nate Feb 2 at 2:44
  • Console is not as reliable for the high volume of system log messages as it used to be before the switch to the new logging subsystem several years ago. It also consumes more system resources. I strongly advise using log for anything other than casual review. – pion Feb 2 at 3:06
  • I specifically mentioned log show rather than log stream because of the high density of messages around process launch and termination and it is easier to review the log ex post facto than in real time, but it’s completely your choice. – pion Feb 2 at 3:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .