Thank you to all who have responded to my first article concerning MRT updates being installed repeatedly. It’s clear from your responses that many of you are seeing this, but in almost every case this is normal. Let me explain.

MRT and XProtect, the main updatable security tools in recent macOS, are pushed independently of macOS updates and Security Updates. In the normal run of events, you’d expect to see an update sequence such as:
2021-10-26 macOS 12.0.1
2021-11-09 MRT 1.85
2021-12-13 macOS 12.1
2021-12-16 XProtect 2153
2022-01-20 MRT 1.86
2022-01-26 macOS 12.2
2022-01-26 XProtect 2154
2022-02-03 MRT 1.88
2022-02-03 XProtect 2155
2022-02-10 macOS 12.2.1
and so on.

Sometimes, macOS updates and Security Updates install versions of MRT or XProtect which are already out of date. This had been quite common in the past, but Apple has improved considerably in Monterey. However, it’s still not uncommon with Security Updates. In that case, once the Security Update has been installed, the current version of MRT or XProtect has to be reinstalled. You might then see (a hypothetical example):
2022-02-03 MRT 1.88
2022-02-03 XProtect 2155
2022-02-10 macOS 12.2.1
2022-02-10 MRT 1.88
2022-02-10 XProtect 2155
where each version of MRT and XProtect get installed twice.

The next complication occurs when you have automatic security data updates enabled and use SilentKnight or LockRattler too. If you run those straight after one of those Security Updates, you might choose to manually install the updates offered, unaware that softwareupdate is about to do the same. If that happens, you could see (hypothetically):
2022-02-03 21:16:27 MRT 1.88
2022-02-10 18:49:55 macOS 12.2.1
2022-02-10 19:34:02 MRT 1.88
2022-02-10 19:34:23 MRT 1.88
Note how close together those two re-installs of MRT 1.88 are.

When this system is malfunctioning, what you’ll see is very different, and more like
2022-02-03 21:16:27 MRT 1.88
2022-02-10 18:49:55 macOS 12.2.1
2022-02-10 19:34:02 MRT 1.88
2022-02-11 10:52:23 MRT 1.88
2022-02-14 08:11:05 MRT 1.88
2022-02-18 17:41:33 MRT 1.88
and so on.

In that case, MRT was updated again to 1.88 following the macOS update, but for an unknown reason, it keeps on being updated repeatedly. Explaining why that’s happening is important, as one cause could be that something is damaging or removing MRT, in which case it may not be available to do its job by detecting and removing malware. That would be serious.

There are two other phenomena that you’re seeing when studying the results from SystHist: missing updates from the right panel, and additional updates possibly for other systems, notably in the left panel.

Unlike the left and centre panels, the list in the right is built from installer receipts created when an installer has finished. Prior to Catalina, those were stored as a ‘Bill of Materials’ (BoM) in the folder /System/Library/Receipts, but with the use of the System Volume Group in Catalina and later, that location became read-only. Eventually, BoM files were written to /Library/Apple/System/Library/Receipts, but for most systems there are large gaps during 2020-21, and this list has only become reliable again in Monterey.

The left and centre panels take their data from a different source, the Property List file at /Library/Receipts/InstallHistory.plist, which should contain entries for all installations performed by Installer and its equivalents when that system was running. Some users report that it may also contain entries for other updates, which appear confusing. For example, it might mix Security Updates for an older macOS with updates for Monterey. That shouldn’t happen, as those two sets of updates should occur when booted into different systems, and be recorded in their own local InstallHistory.plist files. I’m not sure why this is happening on some Macs.

I hope this has made clear the different patterns seen in software update histories, and how some apparently strange patterns can occur. Most of all, I hope this has shown the pattern of repeated updates which is pathological, and could indicate that macOS security isn’t working properly.