Level 1

12 points

XProtectRemediatorSheepSwap using ridiculous amount of memory

Over the last couple days, my computer has periodically ground to a halt. The culprit appears to be XProtectRemediatorSheepSwap – which uses anywhere between 30 to 40 GB of memory! (I only have 16GB, so it's clearly using lots of swap). The only thing that helps is rebooting, but even that's only proved temporarily effective so far, as it begins to happen again after some usage.

The other thing I noticed is that it's spamming my console with thousands of these logs:

default 05:24:09.614543-0800 XProtectRemediatorSheepSwap [0x7fb5e20c8de0] activating connection: mach=true listener=false peer=false name=com.apple.bird

default 05:24:09.614682-0800 XProtectRemediatorSheepSwap [0x7fb5e20c8de0] failed to do a bootstrap look-up: xpc_error=[3: No such process]

default 05:24:09.614711-0800 XProtectRemediatorSheepSwap [0x7fb5e20c8de0] invalidated after a failed init

error 05:24:09.614851-0800 XProtectRemediatorSheepSwap Error querying cloud docs root URL: <private>

what's going on? is there anything I can do? I'd really rather not have to lose a day to a clean install.

p.s. I don't seem to be able to change the tags on this, but it got tagged incorrectly – I am indeed on macOS 14.3, not 11.3...

iMac 27″

Posted on Feb 8, 2024 5:30 AM

Top-ranking reply

Luis Sequeira1

Level 9

73,026 points

Posted on Feb 9, 2024 3:36 AM

You have a very very old version of vmware - 8.*, the current version being 13.5, I believe.

Having those obsolete kernel extensions in Sonoma is unlikely to work well.

Also others from 10.9 Mavericks vintage....

As is often the case around here, you have a mac that has been upgraded in place for many years.

At some point, something has got to give.

I strongly recommend that you start fresh. You may be surprised at just how much better your mac performs after following those simple steps:

1) Full backup using Time Machine; if possible, a second backup 2) System Settings->General->Transfer or Reset->Erase All Content and Settings This will leave only the OS itself, and erase all system modifications as well as all accounts, so you did do the backup beforehand, right? 3) When asked, choose to migrate from "another mac, drive or Time Machine backup"; select the TM backup drive used in step 1 4) Select to migrate ONLY the user accounts (no applications, settings or other files - otherwise you'd just be back to where you started) 5) Enjoy a properly working mac. Gradually install the applications that you do need. Never install any "cleaners" or "antivirus".

View in context

22 replies

smckie Author

Level 1

12 points

Feb 12, 2024 11:49 PM in response to Luis Sequeira1

I'm disappointed that I wasn't able to figure out what specifically was causing XProtect to go haywire, as I'll admit there was a lot of cruft on my computer – but nothing *new* really stood out as the cause of the issue, that started happening all of a sudden.

But I finally broke down and did the clean reinstall, just keeping the user directory, that I'd been dreading for a while. Took me the whole weekend, and I was actually worried that the computer would run out of memory / disk space while I was doing the final Time Machine backup, but it somehow made it through. Back to work today, and everything seems good!

NHughes

Level 1

18 points

Mar 14, 2024 2:54 AM in response to Ben023

I had the problem with 12.7.3, almost every day, but it hasn't happened for the last week or so. I've got security updates set to install automatically, so maybe Apple have pushed something out to fix it?

Feb 9, 2024 11:41 PM in response to Luis Sequeira1

Since the last release I have seen several computers suddenly running out of application memory. Whatever XProtectRemediatorSheepSwap is, it seems to have a bad memory leak.

jh2112

Level 1

9 points

Feb 26, 2024 9:25 AM in response to jh2112

I followed dbolli's advice to disable "Install Security Responses and system files" in the Software Update settings, but XProtect continues to run itself even after rebooting. I then booted into Recovery Mode and did "csrutil disable", then rebooted, but XProtect still runs itself. Am I missing something here, or is it actually impossible to turn this service off...?

NHughes

Level 1

18 points

Feb 29, 2024 7:53 AM in response to NHughes

Quick update....still happening every day. Most of the time I just exit Firefox, etc. and leave it to sort itself out. On 2 occasions (including just now) I couldn't do anything and eventually the Mac rebooted itself. I've sent Apple the reports.

smckie Author

Level 1

12 points

Feb 8, 2024 2:59 PM in response to Luis Sequeira1

Okay, I ran the check

EtreCheckPro report

NHughes

Level 1

18 points

Feb 12, 2024 1:06 AM in response to smckie

I've got a 4GB Mac mini running Monterey 12.7.3 and XProtectRemediatorSheepSwap is currently bogging it down with 6.2GB memory usage according to Activity Monitor.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

XProtectRemediatorSheepSwap using ridiculous amount of memory