macOS

On macOS, install the agent with the one-line command from the dashboard's Install Agent page (see Agent Installation). The installer downloads the binary, enrolls the endpoint, writes its configuration and certificates, and registers a launchd service that starts automatically.

Where things land depends on whether the installer runs with sudo (system-wide) or as a regular user (per-user, monitoring only):

	System install (sudo)	User install
launchd job	/Library/LaunchDaemons/io.sielum.agent.plist (LaunchDaemon)	~/Library/LaunchAgents/io.sielum.agent.plist (LaunchAgent)
Binary	/usr/local/bin/sielum-agent	~/.local/bin/sielum-agent
Certificates & config	/Library/Application Support/Sielum	~/Library/Application Support/Sielum
Firewall enforcement	✅ (pf)	❌ (monitoring only)

This page covers macOS-specific service management and removal.

Managing the service

The launchd job label is io.sielum.agent in both modes.

# Status (shows the job and its last exit code)
launchctl list io.sielum.agent

# Live logs
log stream --predicate 'process == "sielum-agent"' --info

# Stop / start a system daemon (run with sudo)
sudo launchctl unload /Library/LaunchDaemons/io.sielum.agent.plist
sudo launchctl load -w /Library/LaunchDaemons/io.sielum.agent.plist

# Stop / start a user agent
launchctl unload ~/Library/LaunchAgents/io.sielum.agent.plist
launchctl load -w ~/Library/LaunchAgents/io.sielum.agent.plist

The endpoint appears in Dashboard → Devices on the agent's first check-in. The agent sends its first report right after startup, then checks in on its regular interval (default 5 minutes, see Agent Configuration).

Privileged vs. user mode

A system install (via sudo) runs in privileged mode so the agent can enforce firewall rules through macOS's packet filter (pf), covering both IPv4 and IPv6. A user install runs in user mode (monitoring only). See Agent Installation for the feature comparison.

Uninstall

The installer ships an uninstall script that detects both install modes and removes the launchd job, binary, certificates, and logs:

# System-wide install
curl -fsSL https://app.sielum.io/api/install/uninstall.sh | sudo sh

# Per-user install
curl -fsSL https://app.sielum.io/api/install/uninstall.sh | sh

Useful flags: --dry-run shows what would be removed without touching anything, --yes skips the confirmation prompt, and --mode system / --mode user restricts the scope to a single install.

To remove things by hand instead:

# System daemon
sudo launchctl unload -w /Library/LaunchDaemons/io.sielum.agent.plist
sudo rm /Library/LaunchDaemons/io.sielum.agent.plist
sudo rm /usr/local/bin/sielum-agent
sudo rm -rf "/Library/Application Support/Sielum"

# User agent
launchctl unload -w ~/Library/LaunchAgents/io.sielum.agent.plist
rm ~/Library/LaunchAgents/io.sielum.agent.plist
rm ~/.local/bin/sielum-agent
rm -rf ~/Library/Application\ Support/Sielum

The agent remains visible in the dashboard as offline after a local uninstall. Revoke its registration from Dashboard → Devices if you do not intend to re-enroll the same machine.