Troubleshooting

App doesn't appear in menu bar

• Check if Pulse Endpoint is running in headless mode: /usr/local/bin/pulse --status
• Disable headless mode: /usr/local/bin/pulse --no-headless

No metrics being collected

• Verify monitoring started (button shows "Stop")
• Check destination configured (local storage or Splunk)
• Check status: /usr/local/bin/pulse --status

Can't connect to Splunk

• Verify HEC URL format: https://host:8088/services/collector/event
• Test token: curl -k $URL -H "Authorization: Splunk $TOKEN" -d '{"event":"test"}'
• Try verifySSL: false for self-signed certificates

Seeing 'top' or 'ps' in process lists

Pulse Endpoint uses /bin/ps for CPU/process data and /usr/bin/top for memory footprint. This is by design — Pulse Endpoint runs entirely in user context with no elevation or root privileges required. Using top allows Pulse Endpoint to collect memory metrics for all processes system-wide without needing admin rights, keeping your security posture clean.

• Why top? It provides memory footprint for all users' processes without requiring elevated privileges — essential for a zero-privilege monitoring tool
• Async architecture: Pulse Endpoint runs ps and top on separate timers so they don't appear in each other's output — you won't see them in your process lists
• Still seeing them? Pulse Endpoint automatically filters top and ps from its built-in dashboard, but they may still appear in Splunk data since the raw metrics are shipped unfiltered

Metrics not appearing in Splunk

• Verify upload is enabled: uploadEnabled: true
• Check HEC endpoint format: https://host:8088/services/collector/event
• Test HEC token manually: curl -k $URL -H "Authorization: Splunk $TOKEN" -d '{"event":"test"}'
• Check logs for upload errors: grep upload ~/Library/Logs/Pulse Endpoint/pulse.log
• Verify the HEC token has permission to write to the configured index

How to fully uninstall Pulse Endpoint

Two options — pick whichever fits your workflow:

sudo installer -pkg Pulse-Uninstaller.pkg -target /

curl -O https://pulseformac.com/uninstall.sh
sudo bash uninstall.sh

Both paths remove: /Applications/Pulse Endpoint.app, /usr/local/bin/pulse, the root helper daemon (com.qlabs.pulse.helper), both current and legacy LaunchAgent labels (com.qlabs.pulse.agent + com.qlabs.pulse), application support data, logs, preferences, caches, saved state, and PKG receipts — across all user accounts. A log is written to /private/var/log/pulse-uninstaller.log. MDM-managed preferences are intentionally preserved.