The process com.cisco.anyconnect.macos.acsockext hogs Mac CPU but cannot be killed or stopped from launching

Question

MacBookPro16,1 running Big Sur 11.3.1 (20E241)

This job consumes huge amounts of CPU off and on (see attached image from my Activity Monitor), often causing my laptop fans to engage to cool the processor. This is generally when the App itself (Anyconnect) is not running. The program launches automatically and relaunches every time I kill it, restart, etc. I have tried fancier things like removing the Cisco elements from launch directories etc, but it does not have any effect.

There are several discussions online about this problem, but none of the proposed solutions have helped me:

Stop Cisco AnyConnect Secure Mobility Client from starting up automatically

https://dannyda.com/2020/10/28/how-to-disable-cisco-anyconnect-secure-mobility-client-autostart-on-macos-stop-cisco-anyconnect-start-on-boot-on-macos/

I've tried all the solutions I've found online (including those in the above links), but nothing stops it. Only uninstalling AnyConnect works, but I need the Cisco VPN to work remotely with my organization.

Anyone worked this out (for real?)

t3s

Answer 1

Press Don't allow When Cisco asks Cisco AnyConnect Socket Filter” Would Like to Filter Network Content.

If you do so it creates Network Settings that automatically launches this CPU-consuming com.cisco.anyconnect.macos.acsockext.

To revert it :

1. Go to System Preferences -> Network
2. Observe several instances starting with Cisco.. next to Wi-Fi
3. Delete all of them with - button beneath
4. Press Apply
5. If any Cisco instances appears again, delete it again; Press Apply
6. Check for com.cisco.anyconnect.macos.acsockext in Activity Monitor and kill it if needed
7. NEVER! Allow Cisco to Filter Network Content again (for some reason it lacks of Don't ask again checkbox)

Answer 2

I think I’ve found a fix.

1. Go into the Applications folder and open the Cisco folder.

2. Delete the Cisco Socket Filter application but NOT the Anyconnect client.

I’ve not had the issue since and the VPN is working fine.

Answer 3

Personally, I had success from the following:

NOTE: You will need Administrator access on your Mac to accomplish these instructions

1. Open Activity Monitor
2. Kill the running process
3. Open Network Prefs
4. Remove all instances of it with the [-] button, and click apply
5. Open Terminal
6. Change permissions on the application Cisco AnyConnect Socket Filter.app

    cd /Applications/Cisco
    sudo chmod 0644 "./Cisco AnyConnect Socket Filter.app"
    sudo chown ${USER}:staff "./Cisco AnyConnect Socket Filter.app"
    exit

This will change ownership of the app to your personal account, and alter its permissions such that your account can read or write to it, but nobody, including you or the system groups, and execute it. It's a paperweight.

But since my company has a script that verifies its existence (even if it can't run it itself or it's not running at that moment) I don't care to delete it and have to explain myself.

It does not impact my AnyConnect/ability to access the corporate VPN whatsoever, doesn't trip any red flags with CorpSec (YMMV), and persists after reboot.

Hope that helps.

Answer 4

If you are using AnyConnect 4.10.x, I encountered the same problem and it was temporarily resolved by reverting back to version 4.9.06037

If your 4.9.x client automatically updates, you can set bypassDownloader to be true in /opt/cisco/anyconnect/AnyConnectLocalPolicy.xml to keep it at 4.9.x

Answer 5

In addition to Nikitas answer, you should also remove the system extension:

1. Go to CMD

2. Execute

   systemextensionsctl list
   

3. Look for TEAMID for BUNDLEID com.cisco.anyconnect.macos.acsockext

4. Execute

   sudo systemextensionsctl uninstall TEAMID com.cisco.anyconnect.macos.acsockext
   

Note: As of September 1, 2020, running the systemextensionsctl uninstall command requires System Integrity Protection (SIP) to be disabled. This limitation is supposed to be removed by Apple at some point in the very near future.

Answer 6

FWIW, the Enterprise release notes for macOS Ventura 13.3 calls out a fix in macOS 13.3:

Resolves an issue where using Cisco AnyConnect could cause high CPU usage.

Figured it was worth mentioning.

Answer 7

I found this gist on github and it worked me very well. https://gist.github.com/jasmas/22a4b1b12676c36074a4999c68e6a482

I copy paste the gist content here too:

#!/bin/sh

echo Disabling vpnagentd...
sudo launchctl disable system/com.cisco.anyconnect.vpnagentd

echo Tearing down vpnagentd...
sudo launchctl bootout system /Library/LaunchDaemons/com.cisco.anyconnect.vpnagentd.plist

echo Deactivating Cisco AnyConnect Socket Filter Extension...
/Applications/Cisco/Cisco\ AnyConnect\ Socket\ Filter.app/Contents/MacOS/Cisco\ AnyConnect\ Socket\ Filter -deactivateExt

All credit belongs the jasmas(https://gist.github.com/jasmas)

Answer 8

I'm using AnyConnect 4.10.x on Big Sur 11.5.1. What worked for me was simply to not allow Cisco AnyConnect Socket Filter from loading system software (there would be a prompt in System Preferences > Security and Privacy) when you install AnyConnect.

The VPN client still works without a problem, and it seems the Socket Filter thing isn't really necessary anyways, except for the Filter Network Content feature the comment above mentioned.

Answer 9

In Finder, control click on the Cisco AnyConnect Socket Filter, and select Show Package Contents. Expand the MacOS folder and delete the Unix Executable File.
This worked for me running Big Sur 11.6.