Meu MacBook Pro, High Sierra baixou 13G ontem à noite enquanto dormia

O sistema provavelmente estava fechado no meu local de trabalho.

Como posso encontrar o porquê? Alguma luz sobre esses 13Gb? Como o Activity Monitor encontra esses números? Ficarei feliz em fornecer mais informações enquanto o computador ainda não estiver desligado.

Não tenho atualizações automáticas, a última foi em 27 de junho, há mais de uma semana.

O system.log está cheio de entradas como:

Aug  4 11:59:23 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug  4 11:59:33 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd[7132]): Service exited with abnormal code: 1
Aug  4 11:59:33 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug  4 11:59:44 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd[7133]): Service exited with abnormal code: 1
Aug  4 11:59:44 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug  4 11:59:54 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd[7134]): Service exited with abnormal code: 1
Aug  4 11:59:54 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug  4 12:00:04 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd[7135]): Service exited with abnormal code: 1
Aug  4 12:00:04 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug  4 12:00:14 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd[7136]): Service exited with abnormal code: 1

Durante a noite, quando deveria ter dormido - o laptop estava muito vivo:

Aug  4 00:53:44 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:53:51 MacBook-Pro syslogd[45]: ASL Sender Statistics
Aug  4 00:53:54 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3849]): Service exited with abnormal code: 1
Aug  4 00:53:54 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:54:04 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3850]): Service exited with abnormal code: 1
Aug  4 00:54:04 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:54:15 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3851]): Service exited with abnormal code: 1
Aug  4 00:54:15 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:54:26 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3852]): Service exited with abnormal code: 1
Aug  4 00:54:26 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  4 00:54:36 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3853]): Service exited with abnormal code: 1
Aug  4 00:54:36 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:54:47 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3854]): Service exited with abnormal code: 1
Aug  4 00:54:47 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:54:57 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3855]): Service exited with abnormal code: 1
Aug  4 00:54:57 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:55:07 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3856]): Service exited with abnormal code: 1
Aug  4 00:55:07 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 2 seconds. Pushing respawn out by 8 seconds.
Aug  4 00:55:19 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3857]): Service exited with abnormal code: 1
Aug  4 00:55:19 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:55:28 MacBook-Pro systemstats[56]: assertion failed: 17A315i: systemstats + 641142 [8F334E9C-6F6C-3ED1-9251-D75E5C8E9EEC]: 0x5

Foi o touristdque reinicia a cada poucos segundos e baixa mais de 10 milhões por minuto. Não sei o que está fazendo, tentei desativar todas as opções relacionadas à Internet, mas ela continuou ativando.

$ launchctl unload /System/Library/LaunchAgents/com.apple.touristd.plist 
/System/Library/LaunchAgents/com.apple.touristd.plist: Operation not permitted while System Integrity Protection is engaged

Reinicie o "OS de recuperação"

csrutil enable --without fs --no-internal

Em seguida, reinicie normalmente e

$ sudo mkdir /backup
Password:
$ sudo mkdir /backup/System
$ sudo mkdir /backup/System/Library/
$ sudo mkdir /backup/System/Library/LaunchAgents/
$ sudo mv /System/Library/LaunchAgents/com.apple.touristd.plist /backup/System/Library/LaunchAgents/
$ ll /backup/System/Library/LaunchAgents/com.apple.touristd.plist 
-rw-r--r--  1 root  wheel  897 Mar 28 03:55 /backup/System/Library/LaunchAgents/com.apple.touristd.plist

Reinicie o "OS de recuperação"

csrutil enable