Mi MacBook Pro, High Sierra descargó 13G anoche mientras dormía

El sistema fue presumiblemente cerrado en mi lugar de trabajo.

¿Cómo puedo encontrar por qué? ¿Alguna luz sobre esos 13Gb? ¿Cómo Activity Monitor encuentra esos números? Estaré encantado de proporcionar más información mientras la computadora aún no esté apagada.

No tengo actualizaciones automáticas, la última fue el 27 de junio, hace más de una semana.

system.log está lleno de entradas como:

Aug  4 11:59:23 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug  4 11:59:33 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd[7132]): Service exited with abnormal code: 1
Aug  4 11:59:33 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug  4 11:59:44 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd[7133]): Service exited with abnormal code: 1
Aug  4 11:59:44 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug  4 11:59:54 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd[7134]): Service exited with abnormal code: 1
Aug  4 11:59:54 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug  4 12:00:04 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd[7135]): Service exited with abnormal code: 1
Aug  4 12:00:04 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug  4 12:00:14 MacBook-Pro-de-... com.apple.xpc.launchd[1] (com.apple.touristd[7136]): Service exited with abnormal code: 1

Durante la noche, cuando debería haber dormido, la computadora portátil estaba muy viva:

Aug  4 00:53:44 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:53:51 MacBook-Pro syslogd[45]: ASL Sender Statistics
Aug  4 00:53:54 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3849]): Service exited with abnormal code: 1
Aug  4 00:53:54 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:54:04 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3850]): Service exited with abnormal code: 1
Aug  4 00:54:04 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:54:15 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3851]): Service exited with abnormal code: 1
Aug  4 00:54:15 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:54:26 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3852]): Service exited with abnormal code: 1
Aug  4 00:54:26 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 4 seconds. Pushing respawn out by 6 seconds.
Aug  4 00:54:36 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3853]): Service exited with abnormal code: 1
Aug  4 00:54:36 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:54:47 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3854]): Service exited with abnormal code: 1
Aug  4 00:54:47 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:54:57 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3855]): Service exited with abnormal code: 1
Aug  4 00:54:57 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:55:07 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3856]): Service exited with abnormal code: 1
Aug  4 00:55:07 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 2 seconds. Pushing respawn out by 8 seconds.
Aug  4 00:55:19 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd[3857]): Service exited with abnormal code: 1
Aug  4 00:55:19 MacBook-Pro com.apple.xpc.launchd[1] (com.apple.touristd): Service only ran for 3 seconds. Pushing respawn out by 7 seconds.
Aug  4 00:55:28 MacBook-Pro systemstats[56]: assertion failed: 17A315i: systemstats + 641142 [8F334E9C-6F6C-3ED1-9251-D75E5C8E9EEC]: 0x5

Fue el touristdque se reinicia cada pocos segundos y descarga más de 10 millones por minuto. No sé qué está haciendo, intenté desactivar todas las opciones relacionadas con Internet, pero seguía encendiéndose.

$ launchctl unload /System/Library/LaunchAgents/com.apple.touristd.plist 
/System/Library/LaunchAgents/com.apple.touristd.plist: Operation not permitted while System Integrity Protection is engaged

Reinicie el "sistema operativo de recuperación"

csrutil enable --without fs --no-internal

Luego reinicie normalmente y

$ sudo mkdir /backup
Password:
$ sudo mkdir /backup/System
$ sudo mkdir /backup/System/Library/
$ sudo mkdir /backup/System/Library/LaunchAgents/
$ sudo mv /System/Library/LaunchAgents/com.apple.touristd.plist /backup/System/Library/LaunchAgents/
$ ll /backup/System/Library/LaunchAgents/com.apple.touristd.plist 
-rw-r--r--  1 root  wheel  897 Mar 28 03:55 /backup/System/Library/LaunchAgents/com.apple.touristd.plist

Reinicie el "sistema operativo de recuperación"

csrutil enable