Monitor & restart SecurityAgent Process

We are running Mac Pro's with 64GB & 10.12 as VDI-Servers.

We have problems with the SecurityAgent. The process will take more than 100% CPU (how can this be?) after 6 hours of work according to top.

At this point no user can login anymore. We have to reboot or kill one or more SecurityAgent instances (Sometimes there are more then 5 instances running) I would like to monitor this and restart the Service when the CPU load exeeds a given limit.

My questions are :

  • How can I determine the CPU load for this process and their instances with a shell-script?
  • Since simply killing the process seems to be a bad idea, I would like to restart (kickstart?) the process instead. How can I achieve this?

Security Agent

The Security Agent is a separate process that provides the user interface for the Security Server in macOS (not iOS). Its primary purpose is to request authentication whenever an app requests additional privileges.

Test by running in Safe Mode.

Boot into safe mode then restart normally. This clears out a number of caches that may stop the process from eating up so much CPU time. Safe mode is much slower than a normal startup, so be patient.

How to boot macOS in Safe Mode

  • Start or restart your Mac, then immediately press and hold the Shift key. The Apple logo appears on your display.
  • Release the Shift key when you see the login window. If your startup disk is encrypted with FileVault, you might be asked to log in twice: once to unlock the startup disk, and again to log in to the Finder.

To leave safe mode, restart your Mac without pressing any keys during startup.

In most of the forums they have written that after running in Safe mode, it has resolved the issue.

I haven't use Kickstart on the remote machine yet, but this might be helpful for you if you want to look into it:

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -restart -agent

You can check Apple official site for more detail: https://support.apple.com/en-us/HT201710