krypted.com

Tiny Deathstars of Foulness

Apple Configurator 2 is a great tool. But you need to debug things from time to time. This might mean that a profile is misconfigured and not installing, or that a device can’t perform a task you are sending it to be performed. This is about the time that you need to enable some debug logs. To do so, quit Apple Configurator and then write a string of ALL into the ACULogLevel key in ~/Library/Containers/com.apple.configurator.ui/Data/Library/Preferences/com.apple.configurator.ui.plist:

defaults write ~/Library/Containers/com.apple.configurator.ui/Data/Library/Preferences/com.apple.configurator.ui.plist ACULogLevel -string ALL

To disable, quit Apple Configurator and then delete that ACULogLevel key:

defaults delete ~/Library/Containers/com.apple.configurator.ui/Data/Library/Preferences/com.apple.configurator.ui.plist ACULogLevel

April 19th, 2016

Posted In: Apple Configurator, iPhone

Tags: , , , , ,

The default logs in Windows Server can be tweaked to provide a little better information. This is really helpful, for example, if you’re dumping your logs to a syslog server. Here’s a script that can make it happen with a few little tweaks to how we interpret data (to be run per host, just paste into a Powershell interface as an administrator):

auditpol /set /subcategory:"Security State Change" /success:enable /failure:enable
auditpol /set /subcategory:"Security System Extension" /success:enable /failure:enable
auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable
auditpol /set /subcategory:"IPsec Driver" /success:disable /failure:disable
auditpol /set /subcategory:"Other System Events" /success:disable /failure:enable
auditpol /set /subcategory:"Logon" /success:enable /failure:enable
auditpol /set /subcategory:"Logoff" /success:enable /failure:enable
auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable
auditpol /set /subcategory:"IPsec Main Mode" /success:disable /failure:disable
auditpol /set /subcategory:"IPsec Quick Mode" /success:disable /failure:disable
auditpol /set /subcategory:"IPsec Extended Mode" /success:disable /failure:disable
auditpol /set /subcategory:"Special Logon" /success:enable /failure:enable
auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable
auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable
auditpol /set /subcategory:"File System" /success:enable /failure:enable
auditpol /set /subcategory:"Registry" /success:enable /failure:enable
auditpol /set /subcategory:"Kernel Object" /success:enable /failure:enable
auditpol /set /subcategory:"SAM" /success:disable /failure:disable
auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable
auditpol /set /subcategory:"Application Generated" /success:enable /failure:enable
auditpol /set /subcategory:"Handle Manipulation" /success:disable /failure:disable
auditpol /set /subcategory:"File Share" /success:enable /failure:enable
auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:disable /failure:disable
auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:disable
auditpol /set /subcategory:"Other Object Access Events" /success:disable /failure:disable
auditpol /set /subcategory:"Sensitive Privilege Use" /success:disable /failure:disable
auditpol /set /subcategory:"Non Sensitive Privilege Use" /success:disable /failure:disable
auditpol /set /subcategory:"Other Privilege Use Events" /success:disable /failure:disable
auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable
auditpol /set /subcategory:"Process Termination" /success:enable /failure:enable
auditpol /set /subcategory:"DPAPI Activity" /success:disable /failure:disable
auditpol /set /subcategory:"RPC Events" /success:enable /failure:enable
auditpol /set /subcategory:"Audit Policy Change" /success:enable /failure:enable
auditpol /set /subcategory:"Authentication Policy Change" /success:enable /failure:enable
auditpol /set /subcategory:"Authorization Policy Change" /success:enable /failure:enable
auditpol /set /subcategory:"MPSSVC Rule-Level Policy Change" /success:disable /failure:disable
auditpol /set /subcategory:"Filtering Platform Policy Change" /success:disable /failure:disable
auditpol /set /subcategory:"Other Policy Change Events" /success:disable /failure:enable
auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable
auditpol /set /subcategory:"Computer Account Management" /success:enable /failure:enable
auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable
auditpol /set /subcategory:"Distribution Group Management" /success:enable /failure:enable
auditpol /set /subcategory:"Application Group Management" /success:enable /failure:enable
auditpol /set /subcategory:"Other Account Management Events" /success:enable /failure:enable
auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable
auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable
auditpol /set /subcategory:"Directory Service Replication" /success:disable /failure:disable
auditpol /set /subcategory:"Detailed Directory Service Replication" /success:disable /failure:disable
auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable
auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable
auditpol /set /subcategory:"Other Account Logon Events" /success:enable /failure:enable
auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable

eventviewer

April 23rd, 2014

Posted In: Windows Server

Tags: , , , , , , , , , , ,

Powermetrics is a command that shows very specific information about what’s using your systems power. This makes it handy for troubleshooting what processes are taking up CPU, GPU, etc. To run a basic iteration of the command, we’re going to look at a usage summary report, using the –show-usage-summary option:

powermetrics -a --show-usage-summary

The output is as follows:

Machine model: MacBookAir6,2
OS version: 13A598

*** Sampled system activity (Sun Dec 1 23:04:13 2013 -0600) (5006.04ms elapsed) ***

*** Running tasks ***

Name PID CPU ms/s User% Deadlines (<2 ms, 2-5 ms) Wakeups (Intr, Pkg idle) java 42754 541.18 12.92 0.00 0.00 12.39 0.00 kernel_task 0 452.41 0.00 141.63 0.00 386.13 0.00 blued 45 39.58 94.31 0.00 0.00 0.00 0.00 cfprefsd 48518 23.67 1.31 0.00 0.00 0.00 0.00 Knock 44431 16.41 90.28 0.00 0.00 0.00 0.00 com.apple.WebKit 16795 15.29 92.11 0.00 0.00 2.20 0.00 UserEventAgent 385 15.00 91.51 0.00 0.00 0.00 0.00 UserEventAgent 13 14.47 88.45 0.00 0.00 0.20 0.00 com.apple.WebKit 1048 11.61 95.80 0.00 0.00 2.40 0.00 com.apple.WebKit 94216 8.98 90.29 0.00 0.00 6.19 0.00 com.apple.WebKit 997 8.24 82.89 0.00 0.00 40.55 0.00 WindowServer 194 6.04 59.63 1.20 0.80 2.20 0.00 com.apple.WebKit 1154 5.52 68.49 0.00 0.00 42.15 0.00 hidd 90 5.49 72.13 0.00 0.00 0.00 0.00 com.apple.WebKit 1027 5.40 65.94 0.00 0.00 41.95 0.00 Terminal 44349 5.31 87.13 0.00 0.00 1.40 0.00 com.apple.WebKit 1054 5.01 67.33 0.00 0.00 41.35 0.00 prl_disp_service 369 3.15 97.11 0.00 0.00 2.20 0.00 distnoted 386 3.14 97.03 0.00 0.00 0.00 0.00 com.apple.WebKit 16780 1.86 60.00 0.00 0.00 16.78 0.00 com.apple.WebKit 55388 1.75 69.71 0.00 0.00 0.20 0.00 com.apple.WebKit 1505 1.71 87.44 0.00 0.00 3.00 0.00 Remote Desktop C 48336 1.69 32.47 0.00 0.00 98.88 0.00 Dropbox 508 1.36 79.03 0.00 0.00 0.60 0.00 distnoted 22 1.13 87.55 0.00 0.00 0.20 0.00 com.apple.WebKit 64843 1.07 93.07 0.00 0.00 1.00 0.00 powermetrics 48592 0.96 28.21 0.00 0.00 0.20 0.00 Safari 431 0.90 44.27 0.20 0.00 1.00 0.00 com.apple.WebKit 16799 0.88 90.05 0.00 0.00 1.60 0.00 com.apple.WebKit 93194 0.55 67.81 0.00 0.00 4.59 0.00 networkd 44 0.45 11.35 0.00 0.00 0.00 0.00 fseventsd 41 0.42 44.20 0.00 0.00 3.40 0.00 mds 81 0.37 44.11 0.00 0.00 2.20 0.00 com.apple.WebKit 1215 0.28 73.38 0.00 0.00 2.00 0.00 IPSecuritasDaemo 348 0.28 55.84 0.00 0.00 1.00 0.00 com.apple.WebKit 93143 0.27 68.84 0.00 0.00 2.00 0.00 PluginProcess 3573 0.26 77.60 0.00 0.00 1.40 0.00 com.apple.WebKit 16781 0.23 76.76 0.00 0.00 1.00 0.00 com.apple.WebKit 1679 0.23 69.04 0.00 0.00 1.60 0.00 usbmuxd 66 0.20 29.81 1.40 0.00 1.40 0.00 dbfseventsd 43670 0.19 26.12 0.00 0.00 0.00 0.00 Finder 434 0.18 22.45 0.00 0.00 0.00 0.00 com.apple.WebKit 16763 0.17 69.84 0.00 0.00 1.60 0.00 notifyd 17 0.16 21.54 0.00 0.00 0.00 0.00 galileod 107 0.15 41.56 0.00 0.00 1.00 0.00 dbfseventsd 43671 0.12 8.20 0.00 0.00 0.00 0.00 mds_stores 237 0.11 34.95 0.00 0.00 0.40 0.00 distnoted 585 0.09 67.90 0.00 0.00 0.00 0.00 com.apple.WebKit 33839 0.08 69.56 0.00 0.00 0.60 0.00 pacemaker 78 0.07 28.13 0.00 0.00 1.00 0.00 com.apple.WebKit 3572 0.05 67.81 0.00 0.00 0.40 0.00 Mail 428 0.05 65.29 0.00 0.00 0.40 0.00 dbfseventsd 43669 0.05 7.35 0.00 0.00 1.60 0.00 com.apple.MailSe 89428 0.04 57.83 0.00 0.00 2.00 0.00 loginwindow 84 0.02 65.43 0.00 0.00 0.00 0.00 com.apple.WebKit 33836 0.02 39.42 0.00 0.00 0.20 0.00 ALL_TASKS -2 1204.27 19.05 144.43 0.80 734.51 0.00 **** Battery and backlight usage **** Backlight level: 563 (range 0-1024) **** Network activity **** out: 1.40 packets/s, 399.12 bytes/s in: 1.40 packets/s, 265.28 bytes/s **** Disk activity **** read: 2.40 ops/s 291.28 KBytes/s write: 4.00 ops/s 1867.16 KBytes/s **** Interrupt distribution **** CPU 0: Vector 0x49(MacBookAir6,2): 68.92 interrupts/sec Vector 0x92(IGPU): 113.46 interrupts/sec Vector 0x94(XHC1): 14.18 interrupts/sec Vector 0x97(ARPT): 5.79 interrupts/sec Vector 0x9e(SSD0): 5.59 interrupts/sec Vector 0xdd(TMR): 721.53 interrupts/sec Vector 0xde(IPI): 4743.47 interrupts/sec CPU 1: Vector 0xdd(TMR): 136.44 interrupts/sec Vector 0xde(IPI): 444.26 interrupts/sec CPU 2: Vector 0xdd(TMR): 718.93 interrupts/sec Vector 0xde(IPI): 3874.52 interrupts/sec CPU 3: Vector 0xdd(TMR): 136.24 interrupts/sec Vector 0xde(IPI): 170.79 interrupts/sec **** Processor usage **** Intel energy model derived package power (CPUs+GT+SA): 9.79W LLC flushed residency: 0% System Average frequency as fraction of nominal: 174.83% (2272.84 Mhz) Package 0 C-state residency: 0.00% (C2: 0.00% C3: 0.00% C6: 0.00% C7: 0.00% C8: 0.00% C9: 0.00% C10: 0.00% ) Core 0 C-state residency: 1.95% (C3: 0.00% C6: 0.00% C7: 1.95% ) CPU 0 duty cycles/s: active/idle [< 16 us: 48421.92/53709.13] [< 32 us: 1616.05/1451.05] [< 64 us: 3725.90/942.06] [< 128 us: 2403.50/430.28] [< 256 us: 328.60/15.78] [< 512 us: 29.56/0.00] [< 1024 us: 8.19/0.00] [< 2048 us: 7.79/0.00] [< 4096 us: 2.60/0.00] [< 8192 us: 2.40/0.00] [< 16384 us: 0.60/0.00] [< 32768 us: 1.20/0.00] CPU Average frequency as fraction of nominal: 174.99% (2274.86 Mhz) CPU 1 duty cycles/s: active/idle [< 16 us: 59157.15/44087.35] [< 32 us: 565.72/11942.98] [< 64 us: 233.72/2441.65] [< 128 us: 106.07/1535.94] [< 256 us: 33.96/91.49] [< 512 us: 6.79/4.19] [< 1024 us: 2.00/4.19] [< 2048 us: 1.20/1.20] [< 4096 us: 3.40/2.00] [< 8192 us: 1.20/1.20] [< 16384 us: 0.60/0.40] [< 32768 us: 0.80/0.20] CPU Average frequency as fraction of nominal: 174.88% (2273.49 Mhz) Core 1 C-state residency: 1.63% (C3: 0.00% C6: 0.00% C7: 1.63% ) CPU 2 duty cycles/s: active/idle [< 16 us: 52772.26/58135.39] [< 32 us: 2563.70/1559.12] [< 64 us: 2825.19/779.46] [< 128 us: 2252.48/405.91] [< 256 us: 427.08/17.78] [< 512 us: 32.36/0.00] [< 1024 us: 10.39/0.00] [< 2048 us: 7.39/0.00] [< 4096 us: 3.20/0.00] [< 8192 us: 1.40/0.00] [< 16384 us: 1.40/0.00] [< 32768 us: 0.80/0.00] CPU Average frequency as fraction of nominal: 174.76% (2271.94 Mhz) CPU 3 duty cycles/s: active/idle [< 16 us: 45270.92/29302.61] [< 32 us: 507.99/9788.78] [< 64 us: 320.81/5017.34] [< 128 us: 85.10/1920.88] [< 256 us: 31.76/192.17] [< 512 us: 6.39/2.20] [< 1024 us: 2.40/4.79] [< 2048 us: 2.60/3.00] [< 4096 us: 4.99/2.00] [< 8192 us: 0.80/1.00] [< 16384 us: 0.40/0.00] [< 32768 us: 0.60/0.00] CPU Average frequency as fraction of nominal: 174.46% (2267.93 Mhz) **** GPU usage **** GPU 0 name IntelIG GPU 0 C-state residency: 99.69% (0.02%, 99.67%) GPU 0 P-state residency: 1000MHz: 0.00%, 950MHz: 0.00%, 900MHz: 0.00%, 850MHz: 0.00%, 800MHz: 0.00%, 750MHz: 0.00%, 700MHz: 0.00%, 650MHz: 0.00%, 600MHz: 0.00%, 550MHz: 0.00%, 500MHz: 0.00%, 450MHz: 0.00%, 400MHz: 0.00%, 350MHz: 0.31%, 300MHz: 0.00%, 250MHz: 0.00%, 200MHz: 0.00% GPU 0 average frequency as fraction of nominal (200.00Mhz): 0.55% (1.09Mhz) GPU 0 GPU Busy 0.31% GPU 0 FB Test Case 0.00% *** Sampled system activity (Sun Dec 1 23:04:18 2013 -0600) (5004.69ms elapsed) ***

You can also hide CPU duty cycle data with the --hide-cpu-duty-cycle option, GPU duty cycle data with the --hide-gpu-duty-cycle option and show information about the entire uptime with --show-initial-usage. Overall, there's a good bit of information that can be obtained between powermetrics and systemstats, provided you have the time to parse the data and find the specific pieces of information that are pertinent to your debugging attempts.

December 4th, 2013

Posted In: Mac OS X, Mac OS X Server, Mac Security

Tags: , , , , , ,