34

Since Yosemite and in every later operating system OS X/macOS runs coreduetd from /usr/libexec/coreduetd with the bundle-id com.apple.coreduetd.osx in the background.

  • What exactly is this process doing?
  • On which hardware does this run (i.e.: is its functionality supported)?
  • Can it be disabled?
  • How can it be disabled?
  • Should it be disabled?
  • What are the (potential) side effects of it being disabled (dependencies)?

This question should not be read as a YX-Problem but an attempt to eventually add to the list of canonical questions.

LаngLаngС
  • 8,279
  • We should talk about this on [meta] - it’s also a canonical question for one we want to close as “too broad” and “too wiki” - we don’t want to encourage questions that lack a practical question to be solved and we certainly don’t want to write a “macOS system internals” book one chapter a time and one daemon a time. I’ll refrain from closing from now - but there are fundamental problems with doing this systematically IMO. – bmike Sep 04 '17 at 19:02
  • did you ever have a Apogee Duet installed? – Lane Nov 27 '17 at 20:47
  • 5
    Disagree very strongly about trying to get rid of questions like this. I've answered questions here and certainly do want to help create a Mac OS systems internal handbook. The question is not too basic ("how does the mouse work") and is sufficiently specific. I.e. I'd be against questions which make Ask Different become computing 101 and bury Ask Different under repetitive poorly posed questions. – Foliovision Apr 29 '21 at 10:57

3 Answers3

32

There's not much on the web as to what coreduetd does on a Mac other than "it's used for Handoff between iOS and macOS."

What is it doing?

It's keeping track of your various system and application states including states across your Apple devices.

Can it be disabled?

Technically, yes using launchctl. Though, I (highly) don't recommend doing so.

Should it be disabled?

Completely subjective question. Only you can decide if this is the right course for you. Again, I recommend that you don't.

What are the (potential) side effects of it being disabled (dependencies)?

Potentially, the following may be affected:

  • Handoff between iOS and macOS would be affected
  • iCloud sync
  • Mail sync with Office 365

However doing a little sleuthing, I was able to find an iOS security research project (on http://sans.org) that examined the coreduet.db file on iOS. I applied that thinking to the coreduet.dbfile on macOS. Here's what I found...

Making a copy of the coreduet.db file, I examined it in sqlite3 by first getting a list of all the tables

$ sudo cp /var/db/CoreDuet/coreduet.db ~/

$ sudo sqlite3 coreduet.db

sqlite> .tables
ZCDDMAIRPLANEMODEEVENT    ZCDDMFORECASTINTEGER      ZCDDMSTATISTICINTEGER
ZCDDMAPPNAMEMAPPER        ZCDDMFORECASTREAL         ZCDDMSTATISTICREAL
ZCDDMAPPSTATECHANGEEVENT  ZCDDMFORECASTSCORE        ZCDDMSTATISTICSTRING
ZCDDMATTRIBUTENAMEMAPPER  ZCDDMFORECASTSTRING       ZCDDMSTRINGATTRIBUTE
ZCDDMBACKLIGHTEVENT       ZCDDMINTEGERATTRIBUTE     ZCDDMTHERMALEVENT
ZCDDMBATTERYEVENT         ZCDDMPLUGINEVENT          ZCDDMWAKEDNESSEVENT
ZCDDMBOOKKEEPING          ZCDDMPOOL                 Z_METADATA
ZCDDMBOOTORSHUTDOWNEVENT  ZCDDMPOOLNAMEMAPPER       Z_MODELCACHE
ZCDDMDEVICEEVENT          ZCDDMREALATTRIBUTE        Z_PRIMARYKEY
ZCDDMDEVICEMAPPER         ZCDDMSCREENLOCKEVENT
ZCDDMFORECAST             ZCDDMSLEEPORWAKEEVENT
sqlite>

It appears that there is a number of events it keeps track of. However, to see what we could see, I opened up the Z_PRIMARYKEY table:

sqlite> SELECT * FROM Z_PRIMARYKEY;
1|CDDMAirplaneModeEvent|0|81
2|CDDMAppNameMapper|0|218
3|CDDMAppStateChangeEvent|0|185302
4|CDDMAttributeNameMapper|0|101
5|CDDMBacklightEvent|0|0
6|CDDMBatteryEvent|0|0
7|CDDMBookkeeping|0|1
8|CDDMBootOrShutdownEvent|0|0
9|CDDMDeviceEvent|0|0
10|CDDMDeviceMapper|0|0
11|CDDMForecast|0|0
12|CDDMForecastInteger|0|0
13|CDDMForecastReal|0|0
14|CDDMForecastScore|0|0
15|CDDMForecastString|0|0
16|CDDMIntegerAttribute|0|0
17|CDDMPluginEvent|0|0
18|CDDMPool|0|79
19|CDDMPoolNameMapper|0|66
20|CDDMRealAttribute|0|0
21|CDDMScreenLockEvent|0|0
22|CDDMSleepOrWakeEvent|0|17
23|CDDMStatisticInteger|0|0
24|CDDMStatisticReal|0|0
25|CDDMStatisticString|0|0
26|CDDMStringAttribute|0|7293
27|CDDMThermalEvent|0|0
28|CDDMWakednessEvent|0|0
sqlite>

This particular database appears to track system events. Given that I am on a iMac, it would make sense that I don't have things like "BatteryEvent" or "PlugInEvent", but I would have "AppStateChangeEvents". "AirplaneMode" is a bit confusing as this is an iMac, but I do generally keep my WiFi off except for testing; at some point, this state was added to the database.

Going a bit further into the CCDMAirplaneModeEvent, we can see that it tracks not just when, but where the event took place (though my database has 0 data for those fields) and by whom.

select * FROM ZCDDMAIRPLANEMODEEVENT;

    Z_PK        Z_ENT       Z_OPT       ZAIRPLANEMODEON  ZANONYMIZEDBEACON  ZANONYMIZEDLOCATION  ZLOCALDAYSSINCESUNDAY  ZLOCALTIME  ZLOCALTIMEQUARTERHOURSLOT  ZNETWORKQUALITY  ZUSERID     ZCREATIONDATE
----------  ----------  ----------  ---------------  -----------------  -------------------  ---------------------  ----------  -------------------------  ---------------  ----------  -------------
81          1           1           0                0                  0                    0                      80704       0                          0                0           523938304
Allan
  • 101,432
  • 4
    Excellent, but as you point out : don't touch it ... – Solar Mike Sep 04 '17 at 18:19
  • Indeed. Very quick and already very good. And "Mail sync with Office 365" is already affected on a local, stationary iMac? That's a surprise. – LаngLаngС Sep 04 '17 at 18:57
  • 1
    I think you're on the wrong track here. If you search the console app, the primary messages that get logged are power handling. My hunch is that the framework is and will always be a private framework so that Apple doesn't have to publish any sort of API to developers and that it will be reachable via indirection and other more stable API. It needs to track AirPlane mode and system state to know when and how to wake up the CPU to run scheduled tasks - manage power budgets on the hardware / CPU / GPU. – bmike Sep 04 '17 at 20:30
  • 1
    @bmike - I don't think so. Examining the AppStateChangeEvents, there is location data included which contains non-unique data. Theoretically, it should be the same if it was just power handling. Though, I do agree with you it's a private framework for Apple. – Allan Sep 04 '17 at 21:36
  • 1
    coreduetd is still using considerable cpu for me (esp after coming back from sleep) even though handoff is turned off on all my devices. – minusf Jun 20 '22 at 07:16
1

A way of disabling the process that has worked for me (in macOs Sonoma 14.1.1 ) is the following:

  1. Disable the System Integrated Protection (SIP).*

  2. In the terminal write the following:

    sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.coreduetd.plist

That's it, no more loud fans again.

*To disable SIP do the following:

  1. Restart your computer in Recovery Mode (pressing cmd+r until the apple logo appears)
  2. Launch Terminal from the Utilities menu.
  3. Run the command csrutil disable.
  4. Restart your computer.
Alex Arroyo
  • 11
  • 1
    This can help people even more if you were to list your macOS version and link to how SIP was disabled ( Apple article, article here or just list out the steps with words) - with sealed system volumes, SIP alone won’t help much but your version might be still easily altered. – bmike Nov 20 '23 at 17:46
  • @bmike - Thank you for the feedback. I've just updated the information. – Alex Arroyo Nov 21 '23 at 00:35
  • Awesome thanks and Welcome to Ask Different.! – bmike Nov 21 '23 at 02:46
0

coreduetd helps manage Duet and its database on your system, which in essence forms the basis of “on device intelligence”. It aggregates information about the apps you launch, the places you visit, etc. and then tries to offer suggestions or make performance decisions based on your behavior. You might be able to disable it but expect these things to stop working at the very least.

saagarjha
  • 166