Apple’s Worldwide Developers Conference to kick off June 10 at 10 a.m. PDT with Keynote address

The Keynote will be available to stream on apple.com, the Apple Developer app, the Apple TV app, and the Apple YouTube channel. On-demand playback will be available after the conclusion of the stream.

Developer Forums relocated!

Need help with Apple Developer tools and technologies? Want to share information with other developers and Apple engineers? Visit Developer Forums at Apple.

How can I monitor xProtect logs and version on macOS Sonoma?

I was trying to build an automation to check if xProtect is running correctly.

When reading the logs with the following command:


log show --predicate 'subsystem == "com.apple.xprotect"'


I get a message saying that Xprotect's rules are located in a directory, under the file XProtect.yara,

and then that the file XProtect2.yara is not accessible:


2024-05-09 15:21:04 [...]    Default     0x0                  1277   0    XprotectService: [com.apple.xprotect:xprotect] Using XProtect rules location: /Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.yara
2024-05-09 20:22:48 [...]    Error       0x0                  1277   0    XprotectService: [com.apple.xprotect:xprotect] Rule path is not accessible: /Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect2.yara


I've checked the directory and permissions and the file XProtect2.yara doesn't exist. Why is it looking for that rule file when XProtect.yara already has the expected contents (I've checked it).


Do I have any other way of monitoring if XProtect is running and correctly configured? Are there any other logs I can check for it? Has someone experienced a similar error?

MacBook Pro (M3 Pro, 2023)

Posted on May 10, 2024 1:57 AM

Reply
Question marked as Best reply

Posted on May 10, 2024 2:23 AM

ezequiel ~ XProCheck: checks on XProtect Remediator scans completed and reported in the log:


https://eclecticlight.co/free-software-menu/


õ¿õ¬

4 replies

How can I monitor xProtect logs and version on macOS Sonoma?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.