Message pop up on iPad: "Warning! this is not a normal path. users shouldnt get here!

TheSlowKnife wrote:

…and in regards to beta profiles, if one is installed (yet doesnt show under vpn/profile settings), how do i get rid of it? i never signed up for it yet in a lot of my apps i see the little "beta" symbol above certain features as well as the "feedback" option that i thought was only available to beta testers.

The use of profiles to manage betas ended at iOS 16.4 and iPadOS 16.4, and support for and controls for betas are now integrated directly into iOS and iPadOS with Settings > General > Software Update for all users. Enrollment in an Apple beta program or in the free or paid tiers of the Apple Developer Program is still required, but the controls are now visible to all, always, with no profiles involved.

Ignore the nonsense already posted. The contents of analytic logs are meaningless to anyone other than Apple engineers and developers. Although it looks like diagnostics detected an error in the storage management and corrected it automatically. Unless you notice other issues with the phone you can safely ignore it.

If you registered for a beta you will see it as an option in Settings>General>Software Update. If you did not register for a beta you will not see it as an option. If you want to opt out of the beta here is guidance→Apple Beta — Unenroll Your Devices

An engineer got into that path as part of an over-the-air update, not an end-user.

If the over-the-air update worked, things are good.

Telemetry and logs are useful for Apple, and for app developers troubleshooting their own apps, and for the rest of the folks around, too often to cause confusion or concern, and posting of screenshots of little or nothing relevant. Or sometimes, though thankfully rarely, sensitive info gets posted.

Should you really want to know about telemetry and logs, acquire telemetry and logs from a couple dozen devices for comparison purposes, read those logs, get the New OS X internals books (which covers iOS and iPadOS) and read those, and maybe a book or two on digital forensics, and start your quest to learn more about this area.

Hello TheSlowKnife,

Interesting. OTA is octogon trust account which is related to security. UMEventRecorder is related to UserManagement.

Do you actually have Auto Updates disabled in settings? I don't know if it is typical but apfsd on my device has a permission key 'com.apple.private.apfs.revert-to-snapshot'.

Given that your update has been rolled back, I would suggest you have a look at your other logs. Out of interest, after updating did you have any other logs show up?

The following will likely be in the log titled with an app name than a process event log. If you do find any of these indicators, take a screenshot and post it in a reply, or copy and paste the log into the log attachment icon on the reply toolbar, it looks like a notepad and is next to the image upload button.

First, you are looking for an app log that has '.diskwrites' or '.wakeups' in the log name.

Next, open it up and you are looking in the header for the following, where the X's are will be a unique UUID number.

Beta Identifier:  XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX

Here is a better example:

{"app_name":"MobileSafari","timestamp":"2023-07-05 18:54:03.00 +1000","app_version":"16.5.1","slice_uuid":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","build_version":"8615.2.9.10.4","bundleID":"com.apple.mobilesafari","duration_ms":"74144793","share_with_app_devs":0,"is_first_party":1,"bug_type":"145","os_version":"iPhone OS 16.5.1 (20F75)","roots_installed":0,"incident_id":"XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX","name":"MobileSafari"}
Date/Time:        2023-07-04 22:18:16.417 +1000
End time:         2023-07-05 18:54:01.210 +1000
OS Version:       iPhone OS 16.5.1 (Build 20F75)
Architecture:     arm64e
Report Version:   40
Incident Identifier: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX

Data Source:      Microstackshots
Shared Cache:     XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX slid base address 0x1******00, slide 0x7****00

Command:          MobileSafari
Path:             /Applications/MobileSafari.app/MobileSafari
Identifier:       com.apple.mobilesafari
Version:          16.5.1 (8615.2.9.10.4)
Is First Party:   Yes
Beta Identifier:  XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
Resource Coalition ID: 447
Architecture:     arm64
PID:              1405

Next, you are looking in other app logs which simply have the app name and log date.

This is an example of what you are looking for, it will be not far from the start of the log:

  "coalitionName" : "com.spotify.client",
  "crashReporterKey" : "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "throttleTimeout" : 2147483647,
  "codeSigningID" : "com.spotify.client",
  "codeSigningTeamID" : "2FNC3A47ZF",
  "codeSigningFlags" : 570450689,
  "codeSigningValidationCategory" : 4,
  "codeSigningTrustLevel" : 0,

Finally, in the same log, scroll all the way to the bottom and look for anything similar to the following that mentions trialInfo, rollouts, deploymentId, or treatmentId.

},
  "legacyInfo" : {
  "threadTriggered" : {
    "queue" : "com.apple.root.utility-qos"
  }
},
  "logWritingSignature" : "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "trialInfo" : {
  "rollouts" : [
    {
      "rolloutId" : "xxxxxxxxxxxxxxxxxxxxxxxx",
      "factorPackIds" : {
        "SIRI_FIND_MY_CONFIGURATION_FILES" : "xxxxxxxxxxxxxxxxxxxxxxxx"
      },
      "deploymentId" : xxxxxxxxx
    },
    {
      "rolloutId" : "xxxxxxxxxxxxxxxxxxxxxxxx",
      "factorPackIds" : {
        "BIFROST_DEV_2" : "xxxxxxxxxxxxxxxxxxxxxxxx"
      },
      "deploymentId" : xxxxxxxxx
    }
  ],
  "experiments" : [
    {
      "treatmentId" : "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
      "experimentId" : "xxxxxxxxxxxxxxxxxxxxxxxx",
      "deploymentId" : xxxxxxxxx
    },
    {
      "treatmentId" : "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
      "experimentId" : "xxxxxxxxxxxxxxxxxxxxxxxx",
      "deploymentId" : xxxxxxxxx
    }
  ]
}

I wrote you another reply, but it’s mysteriously disappeared, which means you definitely should be checking for signs of beta apps on your device.

gravityfed wrote:

Hello TheSlowKnife,

Interesting. OTA is octogon trust account which is related to security. UMEventRecorder is related to UserManagement.

Umm, NO. OTA is “Over the Air” and has nothing to do with security; it is one way to update an iPhone. The other way uses a computer to update.

Which renders the rest of your post really ludicrous.

gravityfed wrote:

I wrote you another reply, but it’s mysteriously disappeared, which means you definitely should be checking for signs of beta apps on your device.

Nothing mysterious. You should have gotten an email explaining why it was removed. A moderator thought your post was inappropriate. I did also, but I’m not the one that reported it (this time).

I fail to see the relevance of a text label in a Chrome app power management telemetry entry to this question.

I also fail to see the relevance of some random Google-related result labeled (by Google) as “beta” is relevant to this question, given a whole lot of what is available at Google is what Google considers a “beta”, with some of the rest considered deprecated and destined for removal.

Finding the word “beta” in internal-use telemetry and more generally elsewhere on the internet is not unusual or notable.