Previous 1 2 3 Next 177 Replies Latest reply: Jul 22, 2011 2:35 AM by Alancito
pcbjr Level 2 Level 2 (265 points)

I have noticed that the XProtect.plist on 2 different computers have never updated since I installed the new Security Update on June 1. I have an Apple Care Product Specialist trying to figure it out.

 

But, I ran across this (pasted below) today when checking Console, and if anyone can dechiper logs, maybe some independent analysis will tell me why I'm not getting the "MacDefender" scan this security update was supposed to provide (and why the subject .plist  has never updated since installing the Security Update on 2 10.6.7 Intel iMacs 4 days ago).

 

If anyone can dechiper the log and tell me what I might do to correct this problem, kudos!

 

The log entries (which contain a series of "failed") are:

 

 

Version:1.0StartHTML:0000000149EndHTML:0000004433StartFragment:0000000199EndFrag ment:0000004399StartSelection:0000000199EndSelection:00000043996/4/11 8:59:20 AM    com.apple.launchd[1]    (com.apple.xprotectupdater[39]) Exited with exit code: 255
6/4/11 8:59:24 AM    com.apple.notifyd[12]    EV_DELETE failed for file watcher 22
6/4/11 8:59:24 AM    com.apple.notifyd[12]    EV_DELETE failed for file watcher 21
6/4/11 8:59:24 AM    com.apple.notifyd[12]    EV_DELETE failed for file watcher 20
6/4/11 8:59:24 AM    com.apple.notifyd[12]    EV_DELETE failed for file watcher 19
6/4/11 8:59:24 AM    com.apple.notifyd[12]    EV_DELETE failed for file watcher 18
6/4/11 8:59:24 AM    com.apple.notifyd[12]    EV_DELETE failed for file watcher 17
6/4/11 8:59:24 AM    com.apple.notifyd[12]    EV_DELETE failed for file watcher 15
6/4/11 8:59:24 AM    com.apple.notifyd[12]    EV_DELETE failed for file watcher 16


And


6/4/11 12:15:50 PM    com.apple.launchd[1]    (com.apple.xprotectupdater[39]) Exited with exit code: 255
6/4/11 12:15:54 PM    com.apple.notifyd[12]    EV_DELETE failed for file watcher 22
6/4/11 12:15:54 PM    com.apple.notifyd[12]    EV_DELETE failed for file watcher 21
6/4/11 12:15:54 PM    com.apple.notifyd[12]    EV_DELETE failed for file watcher 20
6/4/11 12:15:54 PM    com.apple.notifyd[12]    EV_DELETE failed for file watcher 19
6/4/11 12:15:54 PM    com.apple.notifyd[12]    EV_DELETE failed for file watcher 18
6/4/11 12:15:54 PM    com.apple.notifyd[12]    EV_DELETE failed for file watcher 17
6/4/11 12:15:54 PM    com.apple.notifyd[12]    EV_DELETE failed for file watcher 15
6/4/11 12:15:54 PM    com.apple.notifyd[12]    EV_DELETE failed for file watcher 16
6/4/11 12:15:54 PM    com.apple.notifyd[12]    EV_DELETE failed for file watcher 30
6/4/11 12:15:54 PM    com.apple.notifyd[12]    EV_DELETE failed for file watcher 29
6/4/11 12:15:54 PM    com.apple.notifyd[12]    EV_DELETE failed for file watcher 28
6/4/11 12:15:54 PM    com.apple.notifyd[12]    EV_DELETE failed for file watcher 27
6/4/11 12:15:54 PM    com.apple.notifyd[12]    EV_DELETE failed for file watcher 26
6/4/11 12:15:54 PM    com.apple.notifyd[12]    EV_DELETE failed for file watcher 25
6/4/11 12:15:54 PM    com.apple.notifyd[12]    EV_DELETE failed for file watcher 23
6/4/11 12:15:54 PM    com.apple.notifyd[12]    EV_DELETE failed for file watcher 24
6/4/11 12:15:55 PM    com.apple.WindowServer[80]    Sat Jun  4 12:15:55 {INFO REMOVED}-imac.local WindowServer[80] <Error>: kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.
6/4/11 12:16:32 PM    com.apple.launchd.peruser.501[126]    (com.apple.ReportCrash) Falling back to default Mach exception handler. Could not find: com.apple.ReportCrash.Self
6/4/11 12:16:39 PM    com.apple.launchd.peruser.501[126]    (com.apple.Kerberos.renew.plist[161]) Exited with exit code: 1
6/4/11 1:03:18 PM    System Preferences[222]    Could not connect the action resetLocationWarningsSheetOk: to target of class AppleSecurity_Pref
6/4/11 1:03:18 PM    System Preferences[222]    Could not connect the action resetLocationWarningsSheetCancel: to target of class AppleSecurity_Pref

  • pcbjr Level 2 Level 2 (265 points)

    Doesn't answer my question but some interesting related info (picked up from another topic here):

     

    http://www.macobserver.com/tmo/article/apple_safe_files_list_finding_your_versio n_number/

  • baltwo Level 9 Level 9 (61,830 points)

    Run this command in the Terminal app, you'll need your admin password at the prompt:

     

    sudo /usr/libexec/XProtectUpdater

     

    Then, run this AppleScript:

     

    set a to do shell script "defaults read /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta Version"

    set b to do shell script "defaults read /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta LastModification"

    display dialog "Safe Download definitions are at version " & a & "," & return & "last updated on " & b

     

    which should show something like this (the time might be different):

     

                 safe DL.png

     

    If you're not seeing version 5, then manually download and reinstall the update.

     


  • pcbjr Level 2 Level 2 (265 points)

    From the link -

     

    Safe Download does provide the info w/o having to run a script.

     

    It looks like some of us are not being updated regularly (or at all) from the .003 Security Update. Apparantly a bug.

     

    I'm now w/ engineering (3 - 5 day lag time they tell me), and am sending them this info to supplement the data from one of my iMacs I sent earlier.

     

    But - if anyone else has input, please provide so I can do likewise with the product specialist I'm working with.

  • baltwo Level 9 Level 9 (61,830 points)

    pcbjr wrote:

     

    Safe Download does provide the info w/o having to run a script.

    Didn't see your post before composing and posting mine. However, it's not clear what you're saying. I gave you the way to update and check. My AS is the vanilla way to check the version and date last updated. It's similar to one in the linked article, but has its genesis with http://hints.macworld.com/article.php?story=20110602091032338

     

    Run the AS to determine if yours is getting updated. It should be at least version 4. If you run the Terminal command, then it should show version 5.

  • powerbook1701 Level 3 Level 3 (550 points)

    My experience is this:

    I have two MBP's, both updated via Software update for 2011-003.  Neither had the issue out there of the high CPU usage, either.  I do see this in my console log by itself upon restarts:

     

    6/4/11 4:49:59 PM          com.apple.launchd[1]          (com.apple.xprotectupdater[17]) Exited with exit code: 255

     

    Now, there is nothing else around it that denotes anything to do with xprotect. Is this a good line or a bad one?

    Does this line denote an issue? I am not seeing any of the other errors listed at the start of this thread in my console log.

     

    I am in hopes that Apple with modify the system preference/security pane to include a display of "last updated on" and "update now" to provide a much easier way to see if this is working.  Things can really go south in Terminal if you mess something up, so an easier way would be nice by Apple.

     

    Since console logs everything else, you would think there would be log just for this xprotect updates..

  • Doug Hardie Level 1 Level 1 (25 points)

    I am having the same problem.  I have found that turning off automatic updates and then turning them back on in the Security Control Panel will bring down the latest version.  However, it doesn't update after that.  launchctl list shows XProtectUpdater returning a code of 255 when the next update is available.  Running /usr/libexec/XprotectUpdater as root returns the following error message when there is an update available:

     

    2011-06-04 14:12:03.883 XProtectupdater[3435:903] Unable to verify signature: Error Domain=com.apple.security Code=-25307 UserInfo=0x101905ac0 "The operation couldn’t be completed. (com.apple.security error -25307.)"

  • steveBinLA Level 1 Level 1 (5 points)

    I also do not seem to be getting the daily updates and have the console log entry, " com.apple.launchd[1] (com.apple.xprotectupdater[29]) Exited with exit code: 255". The non-zero exit code is troubling to me, since in the Unix and C world this usually indicates an error. But I could be wrong.

     

    Someone suggested reinstalling the update. I tried this, this time from an administrator account, just in case. I then rebooted, just in case. Then I checked the console log, but the com.apple.xprotectupdater[29]) Exited with exit code: 255" message is still there.

     

    I bet this is a bug, hopefully to be fixed soon.

  • baltwo Level 9 Level 9 (61,830 points)

    I've not seen the error. If I read the description correctly, you and the others have a corrupt installation. Step one is to remove the com.apple.xprotectupdater.plist file from /System/Library/LaunchDaemons/, manually download the update, restart, and reinstall it. If the error pops up again, then, also remove the XProtect files from /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/, restart, reinstall it, and try again. Finally, if still no go, repeat the above steps, download and install the 10.6.7 COMBO update, repair permissions, restart, and try the security update again.

  • powerbook1701 Level 3 Level 3 (550 points)

    well, I am seeing this on multiple computers, updated via SU. This would seem odd to be faulty installs, meaning the updater downloaded from Apple during the software update process is faulty.

    I guess the bottom line is that line actually saying there is an issue?

    I only have this line with nothing else around it indicating an error

    6/4/11 4:49:59 PM          com.apple.launchd[1]          (com.apple.xprotectupdater[17]) Exited with exit code: 255

     

    could this be the result of "no updates needed" ?

     

    I am wondering if Apple forgot to let this pass the firewall too..

     

    I did the try the trick to toggle the box in the security preference pane..

  • powerbook1701 Level 3 Level 3 (550 points)

    balto, question.

    The message, for me, pops up in the console log among the first few lines after a restart. This seems to be where this line is popping up. Could you do a restart, look at console all messages and see if you see it?thanks

  • jsd2 Level 5 Level 5 (6,200 points)
    I am seeing this on multiple computers, updated via SU.

     

    It might be of interest for those who are not getting the automatic updates to ask other Mac owners who live in the same geographical area as you whether they are also having this problem. Apple may be using local Akamai content servers for this feature, and if so, there might be server-side problems that are location-specific.

  • baltwo Level 9 Level 9 (61,830 points)

    Sorry, not seeing it at all. I went back four days of system logs.

  • powerbook1701 Level 3 Level 3 (550 points)

    ok, thank you. Was that after a restart? I have noted the message doesn't pop up when waking from sleep..

  • powerbook1701 Level 3 Level 3 (550 points)

    one you drill down to the xprotect plist, can you use quicklook to read it without opening it?

Previous 1 2 3 Next