How can I figure out what program is starting and quitting? I'm running 11.1 on an M1 MBP. A couple of times an hour, some app starts up, very briefly puts an icon in the Dock, and quits. It's kind enough to also steal focus when it starts up, so if I'm typing, suddenly my typing goes somewhere else.
Is there a way I can track what apps start and quit, so I can figure out what is doing this and make it stop?
I thought maybe I could use execsnoop for this, but it tells me the SIP is turned on and exits.
Well the obvious solution is to temporarily disable SIP and run execsnoop as you’ve yourself identified.
There is a cruder and less reliable way which doesn’t require SIP disabled. The next time you see this happen, quickly go into Terminal and run
$ log show —-last 1m —-info —-debug —-predicate='sender contains &quot;launchservicesd&quot;' 

That will show you the last 1 minute of breadcrumbs from Launch Services, through which it is likely that your mystery process is being invoked. If it’s not, you won’t see it there. Look for (and/or grep) lines containing CHECKIN and DEATH.