Troubleshooting

App doesn't appear in menu bar

• Check if Pulse Endpoint is running in headless mode: /usr/local/bin/pulse --status
• Disable headless mode: /usr/local/bin/pulse --no-headless

No metrics being collected

• Verify monitoring started (button shows "Stop")
• Check destination configured (local storage or Splunk)
• Check status: /usr/local/bin/pulse --status

Can't connect to Splunk

• Verify HEC URL format: https://host:8088/services/collector/event
• Test token: curl -k $URL -H "Authorization: Splunk $TOKEN" -d '{"event":"test"}'
• Try verifySSL: false for self-signed certificates

Seeing 'top' or 'ps' in process lists

Pulse Endpoint uses /bin/ps for CPU/process data and /usr/bin/top for memory footprint. This is by design — Pulse Endpoint runs entirely in user context with no elevation or root privileges required. Using top allows Pulse Endpoint to collect memory metrics for all processes system-wide without needing admin rights, keeping your security posture clean.

• Why top? It provides memory footprint for all users' processes without requiring elevated privileges — essential for a zero-privilege monitoring tool
• Async architecture: Pulse Endpoint runs ps and top on separate timers so they don't appear in each other's output — you won't see them in your process lists
• Still seeing them? Pulse Endpoint automatically filters top and ps from its built-in dashboard, but they may still appear in Splunk data since the raw metrics are shipped unfiltered

Metrics not appearing in Splunk

• Verify upload is enabled: uploadEnabled: true
• Check HEC endpoint format: https://host:8088/services/collector/event
• Test HEC token manually: curl -k $URL -H "Authorization: Splunk $TOKEN" -d '{"event":"test"}'
• Check logs for upload errors: grep upload ~/Library/Logs/Pulse Endpoint/pulse.log
• Verify the HEC token has permission to write to the configured index

How to fully uninstall Pulse Endpoint

Use the official uninstall script to completely remove Pulse Endpoint and all related files from every user on the system. The script handles quitting the app, unloading LaunchAgents, removing all application files and data, and forgetting package receipts.

curl -O https://pulseformac.com/uninstall.sh
sudo bash uninstall.sh

Or download the script directly and run it with sudo.

The script removes: /Applications/Pulse Endpoint.app, /usr/local/bin/pulse, application support data, logs, preferences, caches, saved state, and LaunchAgent plists — across all user accounts. A log is written to /var/log/pulse-uninstaller.log.