Is the New Security Update Working on My Computers?

Run this command in the Terminal app, you'll need your admin password at the prompt:

sudo /usr/libexec/XProtectUpdater

Then, run this AppleScript:

set a to do shell script "defaults read /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta Version"

set b to do shell script "defaults read /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.meta LastModification"

display dialog "Safe Download definitions are at version " & a & "," & return & "last updated on " & b

which should show something like this (the time might be different):

If you're not seeing version 5, then manually download and reinstall the update.

pcbjr wrote:

Safe Download does provide the info w/o having to run a script.

Didn't see your post before composing and posting mine. However, it's not clear what you're saying. I gave you the way to update and check. My AS is the vanilla way to check the version and date last updated. It's similar to one in the linked article, but has its genesis with http://hints.macworld.com/article.php?story=20110602091032338

Run the AS to determine if yours is getting updated. It should be at least version 4. If you run the Terminal command, then it should show version 5.

My experience is this:

I have two MBP's, both updated via Software update for 2011-003. Neither had the issue out there of the high CPU usage, either. I do see this in my console log by itself upon restarts:

6/4/11 4:49:59 PM com.apple.launchd[1] (com.apple.xprotectupdater[17]) Exited with exit code: 255

Now, there is nothing else around it that denotes anything to do with xprotect. Is this a good line or a bad one?

Does this line denote an issue? I am not seeing any of the other errors listed at the start of this thread in my console log.

I am in hopes that Apple with modify the system preference/security pane to include a display of "last updated on" and "update now" to provide a much easier way to see if this is working. Things can really go south in Terminal if you mess something up, so an easier way would be nice by Apple.

Since console logs everything else, you would think there would be log just for this xprotect updates..

I am having the same problem. I have found that turning off automatic updates and then turning them back on in the Security Control Panel will bring down the latest version. However, it doesn't update after that. launchctl list shows XProtectUpdater returning a code of 255 when the next update is available. Running /usr/libexec/XprotectUpdater as root returns the following error message when there is an update available:

2011-06-04 14:12:03.883 XProtectupdater[3435:903] Unable to verify signature: Error Domain=com.apple.security Code=-25307 UserInfo=0x101905ac0 "The operation couldn’t be completed. (com.apple.security error -25307.)"

I also do not seem to be getting the daily updates and have the console log entry, " com.apple.launchd[1] (com.apple.xprotectupdater[29]) Exited with exit code: 255". The non-zero exit code is troubling to me, since in the Unix and C world this usually indicates an error. But I could be wrong.

Someone suggested reinstalling the update. I tried this, this time from an administrator account, just in case. I then rebooted, just in case. Then I checked the console log, but the com.apple.xprotectupdater[29]) Exited with exit code: 255" message is still there.

I bet this is a bug, hopefully to be fixed soon.

I've not seen the error. If I read the description correctly, you and the others have a corrupt installation. Step one is to remove the com.apple.xprotectupdater.plist file from /System/Library/LaunchDaemons/, manually download the update, restart, and reinstall it. If the error pops up again, then, also remove the XProtect files from /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/, restart, reinstall it, and try again. Finally, if still no go, repeat the above steps, download and install the 10.6.7 COMBO update, repair permissions, restart, and try the security update again.

well, I am seeing this on multiple computers, updated via SU. This would seem odd to be faulty installs, meaning the updater downloaded from Apple during the software update process is faulty.

I guess the bottom line is that line actually saying there is an issue?

I only have this line with nothing else around it indicating an error

6/4/11 4:49:59 PM com.apple.launchd[1] (com.apple.xprotectupdater[17]) Exited with exit code: 255

could this be the result of "no updates needed" ?

I am wondering if Apple forgot to let this pass the firewall too..

I did the try the trick to toggle the box in the security preference pane..

balto, question.

The message, for me, pops up in the console log among the first few lines after a restart. This seems to be where this line is popping up. Could you do a restart, look at console all messages and see if you see it?thanks

I am seeing this on multiple computers, updated via SU.

It might be of interest for those who are not getting the automatic updates to ask other Mac owners who live in the same geographical area as you whether they are also having this problem. Apple may be using local Akamai content servers for this feature, and if so, there might be server-side problems that are location-specific.

Sorry, not seeing it at all. I went back four days of system logs.

ok, thank you. Was that after a restart? I have noted the message doesn't pop up when waking from sleep..

one you drill down to the xprotect plist, can you use quicklook to read it without opening it?

ok, I was able to use Quicklook to examine both plst files regarding Xprotect (avoiding having to actually open them). System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/

Xprotect.meta.plst

xprotect.plst

Viewing the meta one, I was able to read the contents and saw "5"

So, the consolve message, for me, seems to be a normal thing and doesn't indicate an issue as I seem to be getting updates.