Reporting on running macOS processes

Content Authoring
1

I’m trying to check if netbiosd is running on our Macs, after disabling it with

sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.netbiosd.plist

(per How to disable SMB 1 or NetBIOS in macOS - Apple Support)

Continuing with Apple’s guide, if I check the status of netbiosd with

sudo ps aux | grep -i netbiosd | grep -v grep

I get nothing back, indicating that it’s been disabled.

I then tried using the following relevance:

Q: exists "netbiosd" of processes
A: True
T: 200
I: boolean

but it tells me netbiosd is running. I tried re-arranging the statement, and it then tells me netbiosd is not running:

Q: exists process whose (name of it is "netbiosd")
A: False
T: 2724
I: boolean

Could someone help me understand the difference between these statements? Thank you

2

In the first case, you’re checking for the existence of a string, which is always true. If you recast it as:

Q: exists process "netbiosd"

you would also get false, because here, you’re instantiating a process object, rather than a string object named “netbiosd”,

3 Likes
3

Note that this example requires the “named” constructor for processes, which was introduced on macOS in 11.0.4.

https://developer.bigfix.com/relevance/reference/process.html

3 Likes