A lot of logs in console related to WindowServer (Long render detected)

Sorry, but you are simply going down a rabbit hole with no end in site. "Rendering" is exactly what it means as the computer is displaying the UI elements onto the window. You jumped the shark when you somehow seem to connect this to a device connecting remotely to the computer viewing what is taking place.

Of course you will see open sockets streaming and here is a partial list of communication ports used and their purpose.

TCP and UDP ports used by Apple software products - Apple Support

You will also find quite a bit of communication with Apple servers for various reasons including:

• Has the device been Activation Locked on restart?
• Find My communicates with nearby device to update locations on a private network
• Bluetooth devices have to be recognized
• Playing content requires verification
• Data is synced with iCloud
• Push Notifications
• Email Polling
• Many widgets running on computer will require external connections.

What we have found is there are many third party processes that will run on startup and conflict with the OS. This is why the EtreCheck report is essential to determine what these are and removing them has solved this problem for many. CleanMyMac is one application that has been shown to interfere with the OS causing unexpected results. Without the EtreCheck results, nothing will be able to be identified and jumping to other conclusions without any evidence is irresponsible.

To start with Activation Lock showing disabled, follow these steps in order:

• Turn off both Find My options in the iCloud Settings
• Restart computer
• Turn on Find My in iCloud Settings
• Restart computer
• Check Activation Lock status in System Information.

This issue has been reported before and those steps resolved the glitch that caused Activation Lock to show disabled. I assume Two Factor Authentication is showing on at  > System Settings > [name on top] > Sign in & Security > Two Factor Authentication.

To make sure you do not have any Management Profiles, what do you have showing at  > System Settings > General > Device Management?

I don't have any insight into that the Ethernet Adapters showing on the EtreCheck report, other than to say that most reports show them. The developer of EtreCheck hangs around here, so we may see them jump in with more information.

As for the log files, I agree with HWTech that they are basically useless and provide no information to the user. In the snippet you showed there are 15 logs in less than a second and thousands more are likely there as well. The apsd process that reported them is the Apple Push Notification Service Daemon. The WWAN logs are usually related to cellular connections. Not sure if you were charging your phone while connected to your Mac or if your Wifi is one of those 5g boxes used with a cellular provider. In any case, those logs along with the PCConnectionManager are not unique to your computer.

There is no solution because there is no problem. The contents of the Console are notes from the developers to themselves, there are no user-serviceable parts or information there. Ignore and go on with your life.

Rooting around in Console Logs used to useful back in the times of OS X 10.6 Snow Leopard

Since that time to now.

Using Console Logs to Trouble Shoot is a waste of your and my productive time

Most of what will appear in those logs, will Only be Understood by Apple Software Engineers

And Yes, the same messages may or will repeat 10s of time or thousands of time and still not make any meaningful sense to we normal human being

That said, is there a Specific Issue with the computer that needs attention ?

If not, move on to better things

Thanks Mac Jim JD for your suggestions.

Re: Ethernet ports, when I check the service order

I dragged WiFi to be first, but you can see here there is no Ethernet (en3 or en4). I can confirm my WiFi is secured with the lock icon as shown in your example.

I just did a MacOS reinstall this evening so all settings are "default" out of the box and the Activation Lock Status is still disabled:

My Network Preferences:

Firewall:

When I go to check iCloud Find My:

When I go to Battery/Energy Saver, I expect the options list to be those listed under Additional Options but clearly some are missing:

Change Battery settings on a Mac laptop - Apple Support (CA)

Changed the option Wake for Network Access to: Always

Activation Lock Status did not change with reboot.

There is something odd happening with my WiFi. If I leave my computer "on" over night by just closing the lid, the WiFi will disconnect and by some other mechanism, the laptop connects to a WWAN??

The only thing you can do is make sure you do not have a third party apps launching processes on startup that could be causing a conflict. Even if you are not actively running an application, some of these apps will install processes that run constantly. Post the free EtreCheck report and we will be able to identify the processes that are running on your computer. The report contains no personal information.

How to use the Add Text Feature When Post… - Apple Community

Logs are not used to identify a problem, but if you are experiencing an issue with your device, post those details.

In my case I'm coming off a fresh DFU restore done at the Apple Store on a new 2024 MBA M3.

The open ports are all in the 49152–65535 range which appear to be related to the Xsan Filesystem Access (thanks for the reference!)

I'm a regular consumer with no association to any corporate workplace. My sense is this machine is bound to a VPN that I cannot control or remove, and my web content and experience seems to be altered. For example, my Google search results are different when I search from other devices. I appear to be shown older, less relevant content going back to late 2000s to 2020 (could this be a form of censorship from a DNS-redirect or DNS cache poisoning?)

Many System Settings pages are modified with standard options missing (e.g. Power/Battery Preferences, Network Preferences etc.) compared to the content described in the MacOS software manuals. This leads me to believe that my device may have been MDM'ed some way.

Despite being logged in with Apple Account with FileVault enabled, the "Activation Lock Status" continues to be reported as "Disabled" in System Information.

Since doing the DFU restore at Apple, I have searched and come across references to a Mojo/Thor malware/virus that is believed to be transmitted through Thunderbolt adapters. It makes me wonder if the Apple Stores' Thunderbolt adapters may be a common vector?

From the EtreCheck report, it makes no sense that there are two additional ethernet adapters (en3/en4) configured as I am not connected except by WiFi (en0).

Nothing suspicious with the Ethernet Adapter showing under Networks in the Ethernet report. I can give you a couple of tips to gain more information:

• Go to  > System Settings > Network, then choose the button with 3 dots on the bottom of the screen and select Set Service Order. Note the order that these are in as this is the order your computer will look to find a network. The one on top is the first one and you will see in the next step this is called Service Order 0.
• Hold the Option key and choose then go to  > System Information. Release the Option key and choose Network. Here you will see each of these interfaces and get more information on them. The last item on each one shows the Service Order which you just saw.

I would want to make sure you are connected to a secure Wifi by going to  > System Settings > Wifi, and make sure you have the lock icon like what is seen in this screenshot.

For your search results being different on Google between devices, that will happen. Google acknowledges this as your results will vary depending on:

• Browsing History
• Device Type
• Personalized results
• I suspect they also take other information into consideration than what they disclose here:

https://support.google.com/websearch/answer/12412910?hl=en

To review the missing Settings, I would need to see a screenshot.

Your Activation Lock may be disabled because you are blocking all connections from your Firewall. What to do you show when going to  > System Settings > [name on top] > iCloud > See All > Find My?

Both @PRP_53 and @Mac Jim ID are both absolutely correct....the macOS logs are to be avoided at all costs if you value your sanity....it is too late for me. There are tons of weird, crazy, nonsensical, and scary sounding entries many of which do not mean what you think they mean.

I'm an experienced tech who was brought up on using system logs to investigate problems, but that is nearly impossible with the macOS system logs these day. In fact the system logs that Apple somewhat exposes now really don't have that much to do with the system. Most of the log entries are not hidden away and must be recreated on demand using command line utilities. Even then, they are a complete mess with entries sometimes repeating 100+ times per second.....yes per second. I'm not even sure the original developers understand them. Most of those entries should not even be filling the logs.....at best they should only belong to the developers debug mode & turned off on production code.

If there is any useful nuggets within the logs, they are far overshadowed by all the repeating nonsense.

The only somewhat useful macOS log these days are the Kernel Panic logs, but even they are becoming harder to decipher.

Do yourself a favor and ignore the macOS logs as those logs will only drive you insane.

macOS has great built in security especially when the user also practices safe computing practices as outlined in the following article:

Effective defenses against malware and other threats - Apple Community

Hey etresoft,

Sorry to cause alarm. In the time between posting the report and the snapshots, I did a wipe and clean install to make sure my problems weren't due to a preference or option I had changed.

There was a fault with MacOS where stealth mode was still engaged, even though I had turned the Firewall off (confirmed by System Information -- so perhaps your program was correct and not a mistake.)

As for questioning if there is MDM, I agree it does not show in your report. What do you make of this:

Here's the report after wipe and reinstall:

For some reason the two Ethernet adapters disappeared (en3/en4) and I attribute this to when the Apple Store employee attached their adapter to my USB-C ports (in the first attempt, the employee tried to do DFU restore on the non-DFU restore port, and then had to try again). Just like the Original Poster (OP) WindowServer is running above 10% on idle.

My only point about FileVault and Activation Lock was that when I went into Restore Mode, I was not being prompted to enter any password for my Admin account. Very unusual behaviour. Anyone could access my computer, boot into Restore mode, and then access the Terminal, Disk Utility, and "Reset Password" function.

I don't expect anyone to provide me an education. Like many others here who have worries and concern for their privacy and safety, I am willing and wanting to learn how I can show myself there is nothing to be concerned about.

Mac Jim ID wrote:

• To start with Activation Lock showing disabled, follow these steps in order:

Turn off both Find My options in the iCloud Settings

• Restart computer

• Turn on Find My in iCloud Settings

• Restart computer

• Check Activation Lock status in System Information.

This issue has been reported before and those steps resolved the glitch that caused Activation Lock to show disabled. I assume Two Factor Authentication is showing on at  > System Settings > [name on top] > Sign in & Security > Two Factor Authentication.

2FA is on. I tried your suggestion (thank you) but no cigar.

To make sure you do not have any Management Profiles, what do you have showing at  > System Settings > General > Device Management?

https://discussions.apple.com/content/attachment/3d9867aa-876d-4fc4-9774-c5f93f77ee93

No device management profiles showing.

I don't have any insight into that the Ethernet Adapters showing on the EtreCheck report, other than to say that most reports show them. The developer of EtreCheck hangs around here, so we may see them jump in with more information.

https://discussions.apple.com/content/attachment/de5dd2ad-c0cc-4e66-982a-5ae47801fe00

I suspect they showed up when Apple was doing the DFU restore attempts. As I mentioned to etresoft, they tried doing DFU using both ports, which explains why the adapter got added to the device map. With the fresh wipe yesterday, it seems to have cleared them out of the current device map.

As for the log files, I agree with HWTech that they are basically useless and provide no information to the user. In the snippet you showed there are 15 logs in less than a second and thousands more are likely there as well. The apsd process that reported them is the Apple Push Notification Service Daemon. The WWAN logs are usually related to cellular connections. Not sure if you were charging your phone while connected to your Mac or if your Wifi is one of those 5g boxes used with a cellular provider. In any case, those logs along with the PCConnectionManager are not unique to your computer.

https://discussions.apple.com/content/attachment/b0326f85-bd13-44e8-abbd-c589696d3573

Definitely no cellular or mobile phone connecting to this device recently, and in fact, I cancelled my data plan a few months ago. I have an older MBA that was behaving strangely... after doing Internet Recovery, the device installed Bluetooth drivers to run a cellular modem off the chipset.

I found software called "Bambi" as a Private Framework and the only reference online I could find was this: https://www.hibambi.com/

I found logs in a folder called "CoreTelephonyTraceScratch":

and in another folder called "CSI.scratch":

YogurtD1979 wrote:

I found software called "Bambi" as a Private Framework and the only reference online I could find was this:

I found logs in a folder called "CoreTelephonyTraceScratch":

Bambi is a character you will find in the logs.You have nothing to worry about seeing any reference to Bambi. Software Engineers are "funny" people and you will see many names or messages that will not make any sense to you. Some will be related to fictional characters or to the internal codename for the project they are working on. The only person who it does make sense for if the one that told the process to print the message. More Bambi info is here:

Log file; what is "Bambi"? - Apple Community

And you will even recognize those same logs here:

Conflict on Mac Restart - Apple Community

References to telephony logs are seen with any log related to the communication chip. This is an integrated chip that includes anything from Wifi, Bluetooth, Radio Frequency, and even Cellular. Apple may not use all the features of the chipset even though you will see those logs. For example, the chipsets have also included the ability to receive radio stations with the RF module and Apple does not include the antenna or software to implement that feature, even though you may see a reference to it.

The logs you see are specifically written to print the message you see. You will not find a nefarious process that is going to print a log of what it is doing. They would want to hide their activity on your device and would not be telegraphing this to you. It is not the OS that is warning you of anything that is nefarious, it is the actual process itself that is printing the message because the engineer told it to print that.

The classic log message that has worried users for over 25 years is the famous "Goodnight, Gracie" message you will find. Users were concerned that they had someone logged into their computer name Gracie and there have been many posts about this where they think they have been hacked. It is just another example of the humor engineers used while programming:

http://jonnywot.blogspot.com/2009/11/interesting-new-easter-egg-in-mac-os.html

Yes that same Enter Old Password is normal including the product name that you see.

MacBook Pro stuck on "Enter Old Password"… - Apple Community

I have no idea why your privacy report shows a different Mac than what you have, but would be a good question for Apple. I would suspect you have found a bug with their reporting as apparently it does show the correct SN of your device and Apple should be able to determine product model by its serial number.

Contact Apple for support and service - Apple Support

Hey there, just letting you know you're not the only one. Although I don't have a solution, I say trust your gut. Something is very not right with our computers.

My best hunch is that "rendering" refers to one of two things:

1. Devices on the internet are connecting to view what is taking place on our device screen
2. Our device is rendering on-screen what is taking place on a virtual machine - local or on a server.

I think it's reasonable to believe our MacOS instance is running "virtually" hosted on a surreptitiously-installed Linux installation, and running as a passthrough on machine.

If you look at the output from Terminal and use command: netstat -A you will see many open sockets "streaming" data. My question is, what kind of data is being streamed from my computer, or to my computer and from what source?

Perhaps someone will share some technical knowledge and skill and try to problem solve instead of saying "this is normal process." If it's normal, Apple should explain what it is and how it works.