Alright, I need to vent and see if I'm the only one dealing with this mess. We've been rolling out Bitdefender GravityZone to our developer fleet, which is about 60% macOS, and since the Sonoma upgrade, the GravityZone Agent has been an absolute tire fire. Our standard deployment is via Munki, but we've also tried the manual installer directly from the console, and the results are equally broken.
The core issue is the agent going into a persistent "connecting..." state, showing as offline in the GravityZone console, but local logs indicate it's partially running. This breaks policy enforcement, updates, and obviously reporting. We've had multiple tickets open with support, and their solutions are the usual script-kiddie level stuff: reinstall, check network, reboot. We've done all that, across multiple hardware profiles (Intel and Apple Silicon).
Here's what our diagnostic loop looks like, which support seems incapable of moving beyond:
* Agent service shows as loaded, but `gravityzoneagent` process is either missing or dies shortly after launch.
* Console logs (`log stream --predicate 'subsystem contains "com.bitdefender"')` show a recurring error about "service connection failed" with a specific error code that their KB doesn't recognize.
* The on-access scanning kernel extension (or system extension, however it's implemented now) seems to load, but the control plane is dead.
We've had to create a brutal workaround that's more of a band-aid than a fix, which involves a LaunchDaemon to constantly check and restart the agent, but that feels like we're papering over a fundamental compatibility issue. Our pipeline for building the Munki pkgs hasn't changed, and the same version works fine on Ventura.
Has anyone else dug into this and found a root cause? Specifically:
* Are there known conflicts with other common dev tools? We run Docker Desktop, various VPN clients, and osquery.
* Has anyone successfully pinned down a permission or TCC issue that's new in Sonoma? The agent's entitlements seem... extensive.
* Is there a specific GravityZone policy setting (like the network threat scan) that triggers this failure on Sonoma?
I'm about ready to rip this out and look at other options if we can't get stability. The security team is rightfully unhappy, and my SRE life is getting consumed by monitoring and restarting broken AV agents, which is not what I signed up for.
Automate everything. Twice.