Security

Why is Splunk coming up in my system logs? I had never heard of it prior to this?

chase_daniel
New Member

I found these log messages in my system log on macOS High Sierra after a fresh install. Prior to this I had never heard of Splunk so this seems odd that information is being sent to Splunk. Can anyone explain this? Anti-virus software has preveiously found keyloggers and other spyware on my computers. The messages start either during the installation or immediatley after. To be clear I had never heard of Splunk before I saw these log messages recently.

2018-07-16 03:03:03.561239-0700 0x43f Default 0x0 128 0 mobileassetd: Syncing Splunk session info

2018-07-16 03:03:03.561533-0700 0x471 Default 0x0 128 0 mobileassetd: [com.apple.mobileassetd:Notice] -[DownloadManager syncSplunkTasks]_block_invoke_2: splunk session sync call back in progress

2018-07-16 03:03:03.561536-0700 0x471 Default 0x0 128 0 mobileassetd: [com.apple.mobileassetd:Notice] -[DownloadManager syncSplunkTasks]_block_invoke_2: Syncing splunk complete

2018-07-16 03:20:10.202139-0700 0x436c Default 0x11a40 678 0 identityservicesd: (FTServices) [com.apple.IDS:Registration] SplunkHint: SH:1:VEN-PROD:(deleted)

2018-07-16 03:20:10.966117-0700 0x436c Default 0x11a40 678 0 identityservicesd: (FTServices) [com.apple.IDS:Registration] SplunkHint: SH:1:VEN-PROD:(deleted)

2018-07-16 03:35:36.980057-0700 0x436c Default 0x0 678 0 identityservicesd: (FTServices) [com.apple.IDS:Registration] SplunkHint: (null)

2018-07-16 03:35:37.421807-0700 0x436c Default 0x0 678 0 identityservicesd: (FTServices) [com.apple.IDS:Registration] SplunkHint: SH:1:VEN-PROD:(deleted)

2018-07-16 03:35:37.758109-0700 0x436c Default 0x0 678 0 identityservicesd: (FTServices) [com.apple.IDS:Registration] SplunkHint: SH:1:VEN-PROD:(deleted)

2018-07-16 03:35:38.158736-0700 0x436c Default 0x0 678 0 identityservicesd: (FTServices) [com.apple.IDS:Registration] SplunkHint: SH:1:VEN-PROD:(deleted)

2018-07-17 11:19:37.066339-0700 0x20899 Default 0x0 2376 0 securityuploadd: [com.apple.securityd:upload] Splunk upload challenge for TrustTopic

2018-07-17 14:58:08.209481-0700 0x32f7c Default 0x0 2835 0 securityuploadd: [com.apple.securityd:upload] Splunk upload challenge for TrustTopic

2018-07-17 21:06:19.594937-0700 0x491 Default 0x0 175 0 mobileassetd: Syncing Splunk session info

2018-07-17 21:06:19.595647-0700 0x4db Default 0x0 175 0 mobileassetd: [com.apple.mobileassetd:Notice] -[DownloadManager syncSplunkTasks]_block_invoke_2: splunk session sync call back in progress

2018-07-17 21:06:19.595651-0700 0x4db Default 0x0 175 0 mobileassetd: [com.apple.mobileassetd:Notice] -[DownloadManager syncSplunkTasks]_block_invoke_2: Syncing splunk complete

0 Karma

FrankVl
Ultra Champion

Looks like Apple uses Splunk to collect certain events from customer systems. See also this discussion: https://discussions.apple.com/thread/8339138?answerId=8339138021#8339138021

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...