When did you last browse your Mac’s log following a boot? It’s not something that I do very often, but it’s a valuable exercise every couple of months, at least. I did it when I ran my UPS test a couple of days ago, so that I could familiarise myself with the changes in 10.14.2, and any differences in this new Mac.
All I do is open Consolation 3 once my Mac has completed starting up, and view all log entries from around 20 seconds before the last shutdown to a couple of minutes after starting up. I then have a quick look through it before saving it as an RTF file and browsing at my leisure using DelightEd.
There are lots of interesting passages to study in greater detail over the next week or so, but one oddity impressed me in this latest log extract: com.apple.securityd was complaining mightily about a ‘stapled ticket’ in a very old QuickTime extension. Each of these hundreds of entries included one such as:
Error loading /Library/QuickTime/EyeTV MPEG Support.component/Contents/MacOS/EyeTV MPEG Support: dlopen(/Library/QuickTime/EyeTV MPEG Support.component/Contents/MacOS/EyeTV MPEG Support, 0x0106): code signature in (/Library/QuickTime/EyeTV MPEG Support.component/Contents/MacOS/EyeTV MPEG Support) not valid for use in process: mapped file has no cdhash, completely unsigned? Code has to be at least ad-hoc signed.
Some years ago, I used EyeTV with a satellite TV feed, but I hadn’t used that for years. Because the software was old but not included in any of Migration Assistant’s blacklists, the EyeTV support had been migrated from one iMac to the next, and finally to my new iMac Pro. Although it had sat there unused for years, all of a sudden Mojave 10.14.2 had decided to check its code signing, and found it wanting.
Judging by the persistent log activity, this problem over the unsigned QuickTime extension was taking up quite a lot of my Mac’s time and effort shortly after every startup. At the very least it was slowing startup down and diverting attention, when all my Mac should have been doing was completing startup.
I don’t and won’t use commercial ‘app uninstaller’ or housekeeping tools, which so often make a real mess of trying to remove apps and their components. All I did was use Spotlight to find all files and folders with EyeTV in their name, ensuring in its options that it would examine both visible and invisible files, including in system folders.
That enabled me to identify /Library/QuickTime/EyeTV MPEG Support.component and its associated components and put them all in the Trash. They’re gone now, but next time that I start this Mac up I will check the logs again to ensure that nothinng else is causing a similar glitch.
This highlights several points:
- Migration Assistant’s blacklist is intended to stop you migrating software which is known to be incompatible, but it doesn’t check for components like this which are old and graunchy and can still slow your Mac down.
- macOS is getting better at spotting problems with old, unsigned software.
- The unified log may appear forbidding, but it can still be very useful. Just because Console can’t easily browse the log retrospectively doesn’t mean that you can’t do so using other free tools.
- You don’t have to understand every entry in the log to make important discoveries.