The Pane Info

System Information

The item System Information lists technical details about the current computer system. This includes data not accessible by the System Information application of macOS.

The section Computer contains the name of the system as you have defined it (which may not be identical to the name used to identify this computer in the network), Apple’s official model name (also known as marketing name), a short description and a picture of this model series, the Apple model identifier which is the code Apple and macOS internally use to identify this series, the computer’s serial number, its unique hardware identification, and the week of production. If you are using a Macintosh model available in different colors, a small color field next to the line with the model identifier shows the color of the enclosure.

The second section Processor lists details about the processor configuration, as well as the available cache sizes. This includes the official processor model identification, the vendor identification, the number of processors, available processor cores and active cores, the information whether each core is capable of executing multiple threads of instructions (Simultaneous Multi-Threading, if active, the hardware will simulate twice the number of processors), the processor generation specifier for x86 systems which includes the family number, model number, stepping number (hardware version), and the decimal signature which compresses all identification code into one single number, the processor’s main clock frequency, the sizes of the level 1 caches (I for instructions, D for data), and the sizes of the level 2 and 3 caches.

The section Memory shows the size of physical memory (Random Access Memory, RAM) currently built into your computer and the optimum free size. This size specifies the small amount of physical memory the operating system should try to keep free for best performance. The optimum is reached when no RAM is wasted (nearly everything is in use), but a small remainder is left free for current handling. The line Addressable memory defines the size of physical and virtual memory the processor can internally manage. This does not mean that this amount could actually be used in practice. The number of slots available for memory modules and other limitations of the computer’s chipset will reduce these theoretical values. For more information on memory management, please also see the section Introduction to virtual memory.

The fourth section Logicboard contains detail data about the computer’s main logic board, namely the vendor information, its internal model code, and its serial number. This section also shows the version number of the System Management Controller (SMC) and its firmware. The SMC is an auxiliary processor which manages the computer’s internal sensors and its power management features. It operates the “always-on” parts of the system, still running when the actual computer is in sleep mode or shut down. It is also responsible to identify the computer as genuine Apple-branded product, constituting the main difference between a generic personal computer and a Macintosh.

A special detail sheet, available via the button Show management records lists technical information which has been stored into the management memory of the computer. It includes:

• data about the system unit
• detail information on each processor
• detail information on each cache unit
• detail information on each memory slot or memory device
• a description of the system’s firmware
• management data about the system board
• management data about the system enclosure
• detail information about each connector on the system board or system enclosure
• detail information on each expansion slot
• list of built-in system devices
• list of jumpers and switches on the system board.

These management records are not computed by TinkerTool System but only retrieved by it. They have been stored by the manufacturer into the so-called System Management BIOS area of the system’s firmware when the computer was assembled. Some parts are also computed dynamically by macOS by retrieving the necessary data from the available hardware.

Another detail sheet BridgeOS Info is available if your computer is equipped with Apple BridgeOS Processor technology. This can either be the original iBridge system or the Apple T2 Security Processor. The BridgeOS system is a secondary computer built into your Mac which controls security features such as the TouchID fingerprint sensor or SSD encryption, depending on model. This auxiliary system runs its own operating system Apple BridgeOS and may always be on if power is available. The entry Apple BridgeOS Processor indicates whether such technology is used in your Mac. If yes, you can press the BridgeOS Info button to learn more details about its configuration.

The last section Operation Environment summarizes the version information about the computer’s firmware, the Darwin operating system on which macOS and iOS are based, the kernel version and revision codes, as well as the operating system version and build numbers. The line Release Status indicates whether you are using an officially released version of the operating system, or a preview version from one of Apple’s software seeding programs.

Note that the source of the operating system is more important to define its release status than the version number. When you receive a specific system version as a pre-release copy, exactly the same system may later become the official version. So identical operating systems can sometimes be marked as official and sometimes as pre-release, depending on where they came from.

This section also shows the computer’s hardware setting for System Integrity Protection that is currently taking effect for the operating system. (For information on the technical background of this feature, please see the end of the chapter Basic Operations.) The feature can either be fully enabled, completely disabled, or enabled partially. In the partial case, TinkerTool System uses the following abbreviations to indicate which operations are permitted by the current computer settings:

• kext: untrusted kernel extensions can be loaded into the system kernel.
• fsac: the system has permission to modify or delete objects in the file system for which the attribute restricted is set.
• tpid: the system has permission to use features that determine which process is belonging to a specific process identification number.
• kdbg: kernel debugger features can be used.
• appl: the system has permission to use functions which are considered Apple-internal.
• trac: the system has permission to use program execution tracing (based on dtrace technology) without limitations.
• pram: the system has permission to modify all entries in the non-volatile RAM (NVRAM).
• devc: device configuration is permitted.
• reco: the computer has permission to use any of the available recovery operating systems.
• akex: the system can load trusted third-party kernel extensions which are not approved by an administrator yet.
• expo: the system has permission to override the security policy for executable applications.

All protection items not listed by TinkerTool System are in full effect. The exact meaning of these settings is defined by Apple and can be changed without notice.

The last line of the overview shows the start time of the operating system, both as absolute time and as interval that has passed since then, the so-called uptime.

It is possible to either print the contents of the main information window, or to save it into an HTML-based text file. Such documents can be used to automatically generate inventory records for all your computers. Click the buttons Print… or Save as text…, respectively. Created text files can be opened by any web browser or by the TextEdit application included with macOS.

The startup time of the system is a volatile item that is not included in text reports.

Malware Protection

macOS offers multiple built-in security measures against malicious software (malware). One of these security features works like a virus scanner which automatically scans downloaded files, searching for known code patterns (signatures) in the background. Apple refers to this technology as Safe Downloads List. It is also known under the name XProtect. Its function is enabled by default. The virus signatures are automatically updated when the option Install system data files and security updates is enabled on the pane App Store in System Preferences. In addition to detecting malicious software, this component also monitors the version numbers of specific Internet plug-ins installed in the system. Such plug-ins are used by Internet browsers to support optional web technologies like Adobe® Flash® or Java™.

By use of the tab item Protection, you can review the current contents of the Safe Downloads List. The upper table shows the malicious programs which can be recognized by the operating system at the moment. The name of the malware, as defined by Apple, and the file types used for the distribution of the software are listed.

The lower table lists the Internet plug-ins which are monitored by the operating system, checking them for outdated versions. The name of each plug-in and the versions which are considered to be critical are shown.

Below the tables, TinkerTool System displays when Apple has revised the list for the last time, when the list has been transferred to this computer, and whether the system checks automatically if a new version of the list is available.

Please note the following points:

• The tables show which threats can potentially be detected by the operating system. They give no indication if this computer had encountered such malicious software in the past or had removed it. So if there is an entry abc in one of the tables, this will only indicate that macOS would detect the component abc, but it doesn’t mean that abc is currently on your system.
• Entries in the table can be repeated multiple times, in cases where the malware appears in different variants with different signatures, but Apple decided not to give each version its own name.
• Data in the columns Type and Name can vary, depending on which version of macOS you are using and which other programs are available on your computer. For example, an internal, technical designation could be listed, an English name, or a name in the primary language you have currently selected.

App Blacklist

After you open the tab App Blacklist, TinkerTool System shows you the operating system’s currently list of known applications that should be excluded from using certain features, or should be prevented from running at all. This list is also updated when the option Install system data files and security updates is enabled on the pane App Store in System Preferences.

Three different types of blacklists are shown on this tab:

• The upper table lists applications which should not use the feature App Nap by default. App Nap is an Apple technology for saving energy at the application level: When the operating system detects that a running program is currently not visible or audible to the user (all its windows are hidden and the application is currently not playing any sounds), and is also not performing any background services (like downloading a file), this program will be slowed down automatically, basically putting it into a certain kind of sleep mode, waking it up only in longer time intervals, checking if there is something to do. Some older software products are not prepared for this technology yet, and won’t work correctly when App Nap becomes active. macOS “knows” the affected applications listed here and automatically disables App Nap for them.
• The middle table lists applications which are known not to work correctly with the High Resolution features of macOS, also known as HiDPI (High number of Dots Per Inch). If you are working with a Macintosh system equipped with a Retina or 5k display, macOS will automatically rescale all graphics to make use of the sharp, high-resolution screen. Some older applications don’t work correctly in this mode. If they are listed here, macOS won’t enable Retina functions for them.
• The lower table lists applications which are known not to work at all with the current version of the operating system, or which will even cause technical problems. macOS will refuse to launch or migrate these applications when they are detected on your system.

Each table has three columns with the following meaning:

• Name or identification: the name or internal identification code of the application that is blacklisted. If the affected application is available on your computer, TinkerTool System tries to show the name of the software product in your preferred language. In that case, the whole entry will also be shown in bold print. Programs which cannot be found on your system are shown with their unique identification code only.
• Enforced: If a dot is shown in this column, macOS will strictly enforce blocking the corresponding application. The user cannot override this decision. If the blacklist entry is not enforced, you can use the Finder to unblock the application. Please see the next paragraph for details.
• Affected versions: This column identifies the exact application versions for which the blacklist entry should become effective. In some cases, only old, outdated versions of a software product should be blocked.

You can override Apple’s recommendation to block applications from using certain features if you have reason to do so. In that case, perform the following steps:

1. Select the affected application in the Finder.
2. Open the menu item File > Get Info or press ⌘ + I.
3. Remove the check mark at Prevent App Nap, or Open in Low Resolution, respectively, if available.
4. Close the Info panel.

Driver Blacklist (macOS Mojave only)

For technical reasons, this feature is not needed in macOS 10.15 or later. Catalina basically rejects all third-party drivers, but uses special certificates and internal whitelists to accept a few selected ones.

Similar to the application blacklist, macOS also maintains multiple driver blacklists, or more exact, lists which automatically deactivate certain kernel extensions when they are detected in your system installation. Because kernel extensions can cause the entire operating system to fail or prevent the computer from starting up, all blacklist entries are always enforced. TinkerTool System shows two lists in separate tables.

The upper list shows kernel extensions which are known to cause a crash of specific versions of macOS. The extensions in this list cannot be easily identified by comparing version numbers or are comprised of multiple components, so macOS uses additional internal checks to verify if these files have cause problems on your system in the past.

The column Software component shows a readable description of the affected driver or extension, while the column Kernel Extension or other bundle to remove shows the file name used by macOS to recognize and delete the component.

The extensions listed in the lower table can be identified by version numbers. The column Identification shows the known bundle names, the column Affected versions the ranges of versions that must not be loaded by the current operating system.

Software publishers need explicit permission from Apple to develop kernel extensions. All extensions that don’t have this permission are additionally blocked automatically, so they don’t need to appear in this blacklist. The operating system only uses this blacklist to remove incompatible drivers in advance, for example when upgrading or migrating from a previous version of macOS, or when the security feature to ignore unauthorized kernel extensions has been switched off explicitly, for example on a developer computer. For more information, please also see the subsection on Security options in the chapter for the Startup pane.

Classic Logs and Reports

After selecting the tab item Classic Logs & Reports, you will have direct access to a high number of log recordings kept by macOS and the macOS Server app. The operating system collects notification, warning and error messages in such files, especially for components of the system which don’t have a direct graphical user interface. Administrators can use this information to keep track and analyze problem situations which occurred in the past. The classic logs are simple text files which are filled line by line over time. Most services also note time and date in each line, so it becomes easier to understand the series of events that occurred.

The possibly available logs and reports are accessible via three pop-up buttons. The upper button Standard logs and reports allows you to select the most important log files maintained by macOS:

• System logs: The main system log which collects the warnings and error messages of all running applications.
• Application crash reports: Detail information about all events where an application had to be quit unexpectedly because a serious internal error occurred.
• Application hang reports: Details about events where an application entered a non-responding state. The affected program hung, i.e. it only performed some internal processing but could no longer react to user activity, like mouse clicks, for example.
• System crash reports: Technical information about events where a serious error was detected by the inner core of the operating system, the system kernel, so the entire computer had to be shut down immediately to avoid damage of data. In older versions of macOS, such an event was also known as kernel panic.
• High CPU activity reports: These reports keep track of incidents where macOS detected that an application consumed a lot of processing power, occupying one or more processor cores for an extended period of time. Those events can be normal for specific types of applications, so the reports may not indicate abnormal activity. The reports can be used to become aware of applications that need more energy than others, which can be interesting on battery-powered mobile computers.
• High application activity reports: The reports on high application activity refer to events where a program was woken up very frequently in a short time frame. Very similar to high CPU activity, these reports are also not critical but help to understand energy usage.
• High memory usage reports: If it makes sense, software developers can define a typical memory usage behavior of their applications. When such an application starts to behave unusual, i.e. it needs more memory than expected, this problem can be reported, or countermeasures can be initiated. For example, the application could try to reduce its memory usage or it could be shut down. These reports keep track of such events and contain the related memory statistics.
• Disk write activity reports: Because most Macintosh computers use flash-based storage, which is subject to wear, Apple collects statistics how many write operations occur on specific storage units. This allows to estimate the remaining lifetime of the flash memory cells.
• Slow response reports: macOS monitors whether applications respond to user interactions such as a key press or a mouse click within acceptable time intervals. If an application is currently too busy to respond to an event quickly enough, or experiences a technical problem, macOS will show a spinning cursor. It will also create this type of report.
• Slow shutdown report: A special kind of slow response is a computer that needs an unusually long time to shut down. To find the cause of such issues, macOS will create a slow shutdown report when such a problem occurs.
• Differential Privacy submissions: Apple devices collect information about how the different products, applications, and services are used. If your privacy settings grant Apple permission to do so, this information is sent to Apple from time to time, anonymizing the data by a technique called differential privacy. Each submission to Apple is logged.
• Apple Wireless Diagnostics report: When the operating system observes specific issues with WiFi operation, it automatically collects diagnostical data about each event. The data may contain private information about networks in the neighborhood. For this reason, the logs are usually encrypted and can only be decoded by authorized Apple service engineers.
• Report on iCloud services: These logs contain diagnostic information and statistical data about communication with Apple’s iCloud services.
• Report on baseband processing incidents: For technical reasons, all operations that convert radio signals to digital data and backwards are collectively called baseband processing. This log category is used to record special events that occur in any of the radio-based components of the Mac, such as WiFi or Bluetooth.
• Report on telephony monitoring: These logs contain information collected by the telephony features of macOS.
• Report on trust checks: Trust checks are used by macOS to assure that a software component is genuine. This usually involves checking a digital signature of executable code and its certificate chain.
• Report on iPhone updates: The system creates a report each time you are using iTunes or macOS to update iOS on an attached iPhone.
• Report on iPad updates: The same type of report is created for each operating system update of an iPad.
• Proactive events reports: macOS collects statistical data each day how many times Siri could “learn” something new about the user in order to improve its behavior as personal assistant. For example, Siri might have identified a family relationship between the user and another person.

The second pop-up button named Server logs permits access to the log files collected by the server features of macOS. Some of the logs are only kept when you install the macOS Server app in addition to macOS and enable the corresponding services, but some logs apply to network service features of macOS in general. TinkerTool System automatically adds menu items to the pop-up button depending on what services are active on your system. The names of the logs and reports should be self-explanatory and are not repeated here. TinkerTool System groups the individual items into the following service categories:

• Open Directory: logs of the Open Directory client and server components
• Profile Manager: logs of the Mobile Device Management (MDM) server

The third pop-up button collects Other logs and reports. This includes known activity reports of macOS, e.g. related to the App Store, Disk Utility, the Resume feature, power down monitoring, etc., as well as unknown logs created by third-party applications. In the latter case, TinkerTool System cannot know the exact contents and meaning of the log files in advance, so the respective items are listed with their raw file names in the menu.

For security reasons, logs that may keep potentially confidential or security-critical information cannot be opened by every user. You must be logged in as administrative user to ensure that you are capable of seeing and opening the complete set of log files. TinkerTool System will give you a warning in this respect if you are not using an administrator account.

After you have selected a log category with one of the three buttons, the table will give you an overview of the available logs. Each one is listed with a short description, date and time, which usually corresponds with the last entry recorded in the log, and file size. Either double-click a listed entry or click the button Open to open the respective log. A text window will show you the contents of the selected log file. Note that you can open as many windows simultaneously as you like. The logs can also be printed or saved into text files, using the buttons at the lower right corner of each window.

If you assume that macOS has created new reports while TinkerTool System was running, click the button Rescan in the lower left corner of the tab item to update the pop-up buttons accordingly.

Modern Logging and Tracing

In addition to classic logging where message lines are added at the end of several text files, macOS supports a modern log technology, based on databases. They contain structured, compressed records which are distributed between files and main memory, depending on case.

The structure of today’s applications create new challenges:

• Programs are separated into different processes, e.g. to handle privileges more safely.
• Processes are divided into different threads, to distribute work onto multiple processor cores.
• Threads might be executed in parallel or in random order, unknown in advance.

When trying to diagnose problems with applications by the use of old-fashioned text reports, it can become difficult or even impossible to track related events between all those processes and threads. Their problem messages might have been recorded in chaotic order and it might not be clear how they are connected with each other. Generating text lines with detailed diagnostic information (which might not be needed under normal circumstances) puts the applications and the operating system under unnecessary stress.

macOS tries to solve these problems by establishing techniques which are more appropriate for current applications:

• Instead of using text files, logging and tracing information is recorded in high-performance databases.
• Applications no longer need to prepare complex text lines themselves (e.g. by computing a textual presentation of a network address which should become part of an error message). They can send such data in raw form to a central logging component. The component can later create the text on demand, if and when it is actually needed. This way, the decision to generate text and to format diagnostic data is postponed as far as possible. In many cases, the data can just be discarded after some time, without ever being processed.
• The same technology is used on all system levels. The inner system kernel uses exactly the same technology as a high-level application with graphical user interface.
• There are system-wide severity levels that define how important a message will be. Unimportant messages that are only useful for debugging purposes can be hold in memory for a short, limited time instead of saving it permanently to files. Discarding, archiving and cleaning of logs can be controlled more precisely.
• Messages can be associated with so-called activity identifiers. They make it easier to track which messages belong to a certain operation in the system, even if the computations needed to execute that operation are distributed onto several processes and threads.
• The log entries in the database can be enriched with additional information. When logging data is needed to fix a problem, database filtering can be used to find the necessary information, hiding all entries which are unrelated. So-called subsystem identifiers and category identifiers can be used to organize log entries.
• References to user data which could be critical for the users’ privacy can be removed before processing or storing them in the log database. This makes it easier to share logging data with technicians, avoiding the risk that private information or trade secrets are accidentally transferred to unauthorized individuals.

Activities contain a short clear-text description together with a numeric identifier. TinkerTool System shows an activity identifier as hexadecimal number with 16 digits. What to identify as separate activity and how to describe it is left to the author of the application that created an activity record.

Subsystem and category identifiers are also defined by the individual applications. So if you like to filter log messages associated with a specific software component, you’ll need information from the software developer what identifiers to use. Subsystem identifiers should be used to define a location within a program, e.g. a specific module. Category identifiers should be used to define a certain mode of operation, e.g. “test mode” or “network-related.”

TinkerTool System automatically analyzes your current operating system and tries to “guess” some of the most important subsystem identifiers. The names appear in the combo box at Filter by macOS logging subsystem identifier and can be selected as menu items. You can also overwrite the entry field and enter any other valid name not listed here.

macOS uses five different levels to define the role or severity of a log message:

• Fault: a message reporting an error situation that affects the entire operating system or multiple components of a software product.
• Error: a message for a problem that is related to a single software component only.
• Default: a message which does not indicate an abnormal behavior, but is still so important that it might be worth noting it in the log.
• Info: a message of purely informational nature. Such messages are not stored permanently by default. They are usually retrieved on specific request only.
• Debug: a message which is only of interest for software developers, helping to track the behavior of a program at the source code level. Such entries are suppressed by default and may occur at very high frequencies, e.g. several hundred log items per second.

TinkerTool System can be used to either

• extract selected entries from the live logging database or from an exported archive, converting them to readable text which can be shown and saved, or to
• export selected or all entries from the logging database, so that they can be reviewed on a different computer.

Apple has defined a specific file format, the macOS Log Archive with the name extension logarchive to transfer logging and tracing data between different macOS systems. The archives cannot be used directly with previous system generations (OS X or Mac OS X).

To work with modern macOS logs, perform the following steps:

1. Open the tab item Logs of the pane Info.
2. Select the Operation that should be executed. You can either create and show log text or export log data.
3. Select the source for the operation (if applicable). This can either be the current log database of the local computer or imported log data taken from a macOS Log Archive file.
4. Use the pop-up button at Time range to select either all log data available in the chosen source, or to specify a time interval. The time interval can be set with the From and To calendar/clock elements. You can either move the clock handles or enter the time as text. The button +12h can be clicked to quickly switch from AM to PM or vice versa, respectively.
5. Choose the Severity level with the slider. A lower level includes all messages of all higher levels, which is visualized by using bold labels.
6. If you like to add information for software developers to the log when available, set the respective check marks at Developer Info.
7. Enable or disable the filter options you need.
8. Click the button Execute in the upper right corner.

By default, TinkerTool System will choose a time interval that includes the last two hours before the application was launched. To use a filter, enable the respective check mark, then enter the name or identification for this filter into the field right next to it.

It is not recommended to let TinkerTool System generate very large log texts. The system may have problems to format and show such a long text in a standard window within an acceptable time. For this reason, the application automatically limits text reports to half a million lines.

TinkerTool System uses the small icons shown next to the controls to also mark messages with the corresponding severity level or activity messages in the result text. The markers are shown at the beginning of the associated line.

The marker <private> in the log text indicates that the macOS logging subsystem has removed some information from the output, because the application which had logged the message did not explicitly confirm that the text can be considered public. The removed part might contain data which could affect a user’s privacy or could otherwise be subject to data protection. This behavior ensures that log excerpts can be transferred to third parties, respecting national data protection laws. TinkerTool System cannot make these “censored” parts visible.

You can save the generated log text by clicking the button Save… in the display sheet. It will be stored in plain text format, so it can be opened by any text editor.