> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-agent-5.0-for-mac/troubleshooting-resources-for-the-traps-agent-for-mac/cytool-for-mac.md). # Cytool for Mac Cytool is a command-line interface that is integrated into Traps that enables you to query and manage both basic and advanced functions of Traps. Any changes that you make using Cytool are active until Traps receives the next heartbeat communication from the Traps management service. On Mac endpoints, you can access Cytool as a super user using a terminal. Cytool is located in the `/Library/Application Support/PaloAltoNetworks/Traps/bin` directory on the endpoint. The following table displays the Cytool options available on Mac endpoints. | Command Option | Description | | --------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **`-h --help`** | `Traps-Mac:bin Traps$`` `**`sudo ./cytool`**\` Usage: cytool cytool - Support tool Options: -h --help Display help information. enum List processes protected by Traps. startup query List startup status for Traps agent and daemons. startup \Enumerate protected processes.

Usage: sudo ./cytool enum

For example:

Traps-Mac:bin Traps$ sudo ./cytool enum List of protected processes: Process name Process ID User Photos 2047 Traps Mail 2099 Traps

| | **`startup`** |

Enable, disable, or query the startup state of Traps components.

Usage: sudo ./cytool startup \ \

where:

For example:

Traps-Mac:bin Traps$ sudo ./cytool startup disable traps\_agent pmdProcess name Startup status traps\_agent Disabled trapsd Enabled authorized Enabled pmd Disabled kproc-ctrl Loaded Traps-Mac:bin Traps$sudo ./cytool startup enable allProcess name Startup status traps\_agent Enabled trapsd Enabled authorized Enabled pmd Enabled kproc-ctrl Loaded

| | **`runtime`** |

Stop or start product components.

Usage: sudo ./cytool runtime \ \

where:

For example:

Traps-Mac:bin Traps$ sudo ./cytool runtime queryName PID User Status Command traps\_agent 1055 Traps Running /Library/Application Support/PaloAltoNetworks/Traps/bin/traps\_agent.app/Contents/MacOS/traps\_agent trapsd 906 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/trapsd authorized 927 \_traps\_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 909 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd kproc-ctrl 159 root Loaded com.paloaltonetworks.driver.kproc-ctrl Traps-Mac:bin Traps$sudo ./cytool runtime stop allName PID User Status Command authorized N/A N/A STOPPED N/A pmd N/A N/A STOPPED N/A traps\_agent N/A N/A STOPPED N/A trapsd N/A N/A STOPPED N/A kproc-ctrl N/A N/A Unloaded N/A Traps-Mac:bin Traps$sudo ./cytool runtime start all Name PID User Status Command system call failed for command='/usr/bin/su -l Traps -c "/bin/launchctl start traps\_agent.plist"', returned status code=768 authorized 1883 \_traps\_panw Running /Library/Application Support/PaloAltoNetworks/Traps/bin/authorized pmd 1889 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/pmd traps\_agent N/A N/A FAILED TO START N/A trapsd 1901 root Running /Library/Application Support/PaloAltoNetworks/Traps/bin/trapsd kproc-ctrl 160 root Loaded com.paloaltonetworks.driver.kproc-ctrl

| | **`persist`** |

Traps stores policy and security event information such as the list of trusted signers, local verdicts, and one-time actions in local databases on the endpoint. To troubleshoot policy issues and security events, you can use cytool persist operations to import, export, and view information stored in the local database.

Usage: sudo ./cytool persist \

where \ :

| | **`log`** |

Set log level for the desired process.

Usage: sudo ./cytool log \ \

where:

For example:

Traps-Mac:bin Traps$ sudo ./cytool log 2 all

Then use the sudo ./cytool log collect command to generate a support file archive of all logs in a TGZ file. On Mac endpoints running OS X 10.10 and OSX 10.11, Cytool outputs the logs to the /var/log/traps directory. On Mac endpoints running macOS 10.12, you can view logs from the Console application.

| | **`wakeup`** |

Wake up the endpoint from an OS incompatibility state.

Traps-Mac:bin Traps$ sudo ./cytool wakeup SIGTERM caught

| | **`dump`** |

Enable or disable dump generation or restore policy settings.

Traps-Mac:bin Traps$ sudo ./cytool dump enableTraps-Mac:bin Traps$sudo ./cytool dump disableTraps-Mac:bin Traps$sudo ./cytool dump restore

| | **`checkin`** |

Initiate check-in to the server.

Usage: sudo ./cytool checkin

To verify the checkin, view the check-in time on the Traps console.

| | **`opswat`** |

Check Traps Agent status and version.

Usage: sudo ./cytool opswat \

where \ is:

Traps-Mac:bin Traps$ sudo ./cytool opswat version5.0.0.1042 Traps-Mac:bin Traps$sudo ./cytool opswat installedPassword: true Traps-Mac:bin Traps$sudo ./cytool opswat runningtrue Traps-Mac:bin Traps$sudo ./cytool opswat protected true

| --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent/5.0/traps-agent-5.0-for-mac/troubleshooting-resources-for-the-traps-agent-for-mac/cytool-for-mac.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.