What is Graph.db in the ~/Library/IntelligencePlatform Folder?

It is installed in my ~/Library on Sonoma 14.3.

There are two security oriented daemons that collaborate in analyzing the user content on the Mac and building a knowledge graph representing the device and user for purposes of malware protection:

• intelligenceplatformd
• knowledgeconstructiond

These build several dynamic databases and are part of Apple's protection against malware in macOS. Don't delete these sqlite3 databases.

There are two named man pages for the above daemons and essentially tell you nothing about them.

callaway wrote:

Does anything stand out to you in this EtreCheck report?

<EtreCheck Report.log>

Only that your "intelligence platform" is definitely working overtime. And your SIP is still enabled.

Is this computer really managed by some IT organization? I'm not entirely confident in EtreCheck's reporting of this information. I know I broke it recently with respect to Apple also using it for ScreenTime.

You are running both DropBox and Proton Drive. Are either of these managing the same folders? And is that your home folder? Add iCloud to that list too. If so, that would definitely confuse the system.

How big is your Photos database? It looks like there could be some photos or "media" involvement. Nobody actually knows what those tasks do. They could be involved with AI tagging your photos.

callaway wrote:

Does anything stand out to you in this EtreCheck report?

<EtreCheck Report.log>

It looks like you may be dealing with a lot of photo analysis. I suppose metadata from those photos may be stored in that file, but cannot be sure. Do you have a particularly large Photo Library?

It seems like this heavy usage of photo analysis and intelligence platform started around 1/25/24. Any changes in that time frame that you know of that may contribute to this?

Also some problem noted with spotlight with high CPU usage and possibly a problem with that process. You may want to try to rebuild the spotlight index.

Rebuild the Spotlight index on your Mac - Apple Support

Again, all just guesses based on the Etrecheck report without specific details on what is collected in Graph.db or if data in there is eventually purged after a while. I do agree your Graph.db file is unusually large.

callaway wrote:

Thank you. I don't understand why it's so much larger on my system than what others have posted here.

Please download and run (free) EtreCheck, and share the generated report to the clipboard. Then open a new reply here, and press the Additional Text button (that looks like a printed page) to get a text input box big enough to paste the hardware and software configuration report here, and paste and post that report here.

callaway wrote:

Thanks. I wonder if could be a .db which includes music and mail?

The graph.db contains security-related info, while the Music and Mail apps use their own and separate databases.

Probably the most common database used on macOS (and iOS and iPadOS) is the SQLite database.

But different apps will store their data differently, as different data has different requirements.

callaway wrote:

Hi etresoft. I'm confused about SIP. Why do you want me to disable it? Shouldn't that stay enabled?

I don't want you to disable it. I was just confused because I couldn't see that particular folder on my computer. I don't know how anyone else can see it either. The only way I could see the contents of that folder was by turning SIP off, which you shouldn't do.

So the fact that some people can see the file and some people can't suggests that this is one of Apple's many flaky pieces of code. How many other files do you see in that folder? When I turned off SIP, I saw about two dozen different files.

This computer is NOT managed by anyone but me. I own it.

Your EtreCheck report shows that they are some managed settings for Mail. But as I said, I'm not very confident that this data is anything significant. I added it because these MDM settings can significantly change the behaviour of the operating system. But it is one of many pieces, like AI, that Apple is using a lot these days.

My .photoslibrary file is a little over 23 GB. My music media folder is about 250 GB. I have 688 GB free space.

That's not very big for Photos. But that's a big Music folder. This might be a case where you simply have to let it work and then it will settle down. You had recently updated to Sonoma 14.3. Every time you update, the system has to reindex everything. Well, it doesn't have to, but it certainly does. That makes the computer slow and buggy. By the time it settles down, there's a new update available. Everybody installs it hoping it will all the slowness and bugginess of the previous version, but it just repeats the same cycle forever.

Kernel extensions present - This computer has kernel extensions that may not work in the future.

there's the problem, you have an. old Intel only program running and it is eating up processor cycles! So delete Intel only program and look for updates or alternatives!

satcomer wrote:

Kernel extensions present - This computer has kernel extensions that may not work in the future.

there's the problem, you have an. old Intel only program running and it is eating up processor cycles! So delete Intel only program and look for updates or alternatives!

I would not conclude that the kernel extension is the problem to the large Graph.db problem that the OP is reporting. The Logitech kernel extension that is showng "Not Loaded" is probably quite old based on the version number and problems with kernel extensions are associated with kernel panics or crashes.

Mine on Sonoma is 3.5MB. No info on why yours would be 4GB. Not much you can do about it and would not recommend messing with any of the info there, but also curious on if the size changes or the specific info that it collects.

callaway wrote:

Thank you. I don't really have any 3rd party software of significance. Zoom, Dropbox, ScanSnap software. I think I noticed it after one of the Sonoma updates.

It does appear to be a Sonoma file. I do have an IntelligencePlatform folder in that location on my Sonoma 14.2.1 VM. But it is SIP-protected and I can't view it. I'm trying to update the VM to 14.3 to see if it shows up.

I wouldn't run Sonoma on any of my computers unless it was in a VM.

callaway wrote:

Thank you. I don't understand why it's so much larger on my system than what others have posted here.

The fact that you can see it at all means that something is seriously wrong with your setup. I did try this on Sonoma 14.3 (in VM, of course, I'm not crazy!) and it is still under SIP. I can't see any of the many files in that folder. Do you see other files there? Chances are, whatever has screwed up your system to the point of allowing you to see these files is also causing whatever low-level Apple AI process this is, to run amuck.

And for the record, I'm very confident it is one of Apple's many AI processes. Supposedly, Apple's going "all in" on AI this year. As for myself, I'm looking for a nice cave where I can setup and live off the grid.

etresoft wrote:

And for the record, I'm very confident it is one of Apple's many AI processes. Supposedly, Apple's going "all in" on AI this year. As for myself, I'm looking for a nice cave where I can setup and live off the grid.

Sorry, but all the caves come with WiFi now!