Mon MacBook Pro, High Sierra a téléchargé la 13G hier soir pendant son sommeil

Le système était probablement fermé sur mon lieu de travail.

Comment puis-je trouver pourquoi? Un peu de lumière sur ces 13 Go? Comment Activity Monitor trouve ces chiffres? Je serai heureux de fournir plus d'informations tant que l'ordinateur n'est pas encore éteint.

Je n'ai pas de mises à jour automatiques, la dernière date du 27 juin, il y a plus d'une semaine.

system.log est plein d'entrées comme:

Aug  4 11:59:23 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug  4 11:59:33 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd[7132]): Service exited with abnormal code: 1
Aug  4 11:59:33 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug  4 11:59:44 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd[7133]): Service exited with abnormal code: 1
Aug  4 11:59:44 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug  4 11:59:54 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd[7134]): Service exited with abnormal code: 1
Aug  4 11:59:54 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug  4 12:00:04 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd[7135]): Service exited with abnormal code: 1
Aug  4 12:00:04 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug  4 12:00:14 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd[7136]): Service exited with abnormal code: 1

Pendant la nuit, alors qu'il aurait dû dormir - l'ordinateur portable était très vivant:

Aug  4 00:53:44 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:53:51 MacBook-Pro syslogd[45]: ASL Sender Statistics
Aug  4 00:53:54 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3849]): Service exited with abnormal code: 1
Aug  4 00:53:54 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:54:04 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3850]): Service exited with abnormal code: 1
Aug  4 00:54:04 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:54:15 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3851]): Service exited with abnormal code: 1
Aug  4 00:54:15 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:54:26 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3852]): Service exited with abnormal code: 1
Aug  4 00:54:26 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  4 00:54:36 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3853]): Service exited with abnormal code: 1
Aug  4 00:54:36 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:54:47 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3854]): Service exited with abnormal code: 1
Aug  4 00:54:47 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:54:57 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3855]): Service exited with abnormal code: 1
Aug  4 00:54:57 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:55:07 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3856]): Service exited with abnormal code: 1
Aug  4 00:55:07 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 2 seconds. Pushing respawn out by 8 seconds.
Aug  4 00:55:19 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3857]): Service exited with abnormal code: 1
Aug  4 00:55:19 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:55:28 MacBook-Pro systemstats[56]: assertion failed: 17A315i: systemstats + 641142 [8F334E9C-6F6C-3ED1-9251-D75E5C8E9EEC]: 0x5

C'est touristdce qui redémarre toutes les quelques secondes et télécharge plus de 10M par minute. Je ne sais pas ce qu'il fait, j'ai essayé de désactiver toutes les options liées à Internet, mais cela continuait de s'allumer.

$ launchctl unload /System/Library/LaunchAgents/com.apple.touristd.plist 
/System/Library/LaunchAgents/com.apple.touristd.plist: Operation not permitted while System Integrity Protection is engaged

Redémarrez "Recovery OS"

csrutil enable --without fs --no-internal

Redémarrez ensuite normalement et

$ sudo mkdir /backup
Password:
$ sudo mkdir /backup/System
$ sudo mkdir /backup/System/Library/
$ sudo mkdir /backup/System/Library/LaunchAgents/
$ sudo mv /System/Library/LaunchAgents/com.apple.touristd.plist /backup/System/Library/LaunchAgents/
$ ll /backup/System/Library/LaunchAgents/com.apple.touristd.plist 
-rw-r--r--  1 root  wheel  897 Mar 28 03:55 /backup/System/Library/LaunchAgents/com.apple.touristd.plist

Redémarrez "Recovery OS"

csrutil enable