As kernel extensions have been considered deprecated for several OS releases, this page will cover troublshooting the system extension and related topics.
While there’s an entire page on santactl, it’s one of the best ways to start determining the cause of an issue:
Conveniently, the order the information is displayed may indicate the likelihood of commonly experienced issues:
- In the first section, if “Driver Connected” does not read Yes, start by confirming the MDM is considered ‘supervising’ the computer via DEP or UAMDM, (see configuration.md) this command would help:
/usr/bin/profiles status -type enrollment
The profile payloads that rely on the supervision relationship cannot be applied manually for testing, so it’s important to ensure the MDM connection is as expected when mass-deploying.
Additionally, confirm the system extension and TCC/PPPC profiles are present as mentioned under the “MDM-Specific Client Configuration” section of that page
The local preferences would dictate the sync server used as well, and the next sections help you confirm how many rules have in fact been recognized by Santa as well as its details and live connection state
Looking into logs would be instructive for the majority of how Santa is operating, and the pages on scopes and rules would assist in determining precedence and why decisions are made. Most helpful is the output of
fileinfo verb when called with the path/binary in question as described on the santactl page.
Depending on the presence or implementation details of a sync server, there may be queues and a process for allowing binaries or updated developer certificates. Events may also be observable from the server