Helping your children establish their own routines in the morning and after school is important for the back to school season. You should plan before school starts but if you are always running for the school bus or find afternoons stressful, it's never too late to design a routine that fits your family, creates a calm atmosphere. Under Mac OS X 10.5 Leopard®, the daily script also prunes the asl.db file that replaced the asl.log file for Apple System Logging. The output from the daily script is written to the /var/log/daily.out file, which can be viewed in Console. By default, the daily script is scheduled to run daily at 03:15 hours local time. Daily Workouts combines all of the individual apps: Daily AB Workout, Daily ARM Workout, Daily BUTT Workout, Daily CARDIO Workout and Daily LEG Workout. You may want to check out more software for Mac, such as Daily Ab Workout FREE, Daily Leg Workout. Apple has made some modifications to Mac OS X tools for its own purposes, but many of these changes will be noticeable only to the hard-core Linux and UNIX faithful. Keywords System Administration Activity Monitor Command Line System Preference Network File System.
I recently attended the awesome SANS DFIR, Mac and iOS Forensics and Incident Response course with Sarah Edwards. This has obviously given me lots of great inspiration on how to negotiate Mac analysis in general and to take a closer look at some of those system files that we covered in training.
I've spent a little bit of time digging through the log files on my MacBook (Mojave 10.14.2). I'm sure this isn't new to most practised Unix beards but for those who aren't aware, there's a really great little log file called daily.out in /var/log. I had previously given little credence to this log but realised it can be used to determine a whole wealth of useful information. I also reviewed the weekly.out and monthly.out files but these were, in my case, far less granular.
At a high level daily.out contains information relating to disk usage and networking, this file is written at least daily and the configurations for all three of the periodic logs are stored in plist files in the following location: Age of spires iv mac os.
/System/Library/LaunchDaemons/com.apple.periodic-*****.plist
After reviewing the content of this file, it made me consider how this might assist in some of my casework?
Disk Usage
Firstly, I borrowed some grep skills from a very knowledgeable and tall colleague on my team to see if we could parse out just some specific information from the daily.out file. We extracted the lines only containing the dates, followed by the lines which related specifically to disk usage.
From this, we were able to find entries dating back as early as 3 months, and that the log contains:
- Logical volumes mounted at the time entries are written
- Size of volumes
- Space used on volumes
As you can imagine, disk volume information will be highly valuable in showing drives or images which were attached when the log was written and especially if you know the volume name used by a device you're looking to prove access to.
We can also ascertain some other information from this log which is quite valuable.
Bootcamp!
You may have an instance where a suspect, subject or general bad person is saying they have never used their Bootcamp install, however, you can see from the Bootcamp disk usage that the volume is being written to and from regularly. Perhaps a big chunk of data has been deleted before a date of interest?
Uptime
Another interesting piece from the daily.out file is that it will show uptime of the system when the log entries are written. This could help prove whether or not the system was switched on and in use over a specific period.
This may also show some interesting information about account usage on the computer. As Mac computers generally tend to be used by individuals, this means there's usually only ever one account logged on at any time. If you have an experienced user who is elevating to root every day, then seeing multiple accounts logged on may not be uncommon. Although, if an inexperienced user who has no knowledge of the root account, is logged on many times when another account is logged on, it may be suspicious or warrant further analysis.
Again, we extracted the lines from the daily.out file we are interested in using a simple grep command:
As you can see we can pull some interesting information about computer and account usage:
- Shows uptime of the system at the point in which the daily.out entry is written
- Also shows the number of users logged on, remember this is usually going to be one
There are also some very useful network interface statistics listed in this file which are probably more relevant to IR investigations but we may look at these another time.
Reference:
Running system maintenance utilities is more often than not an act of faith – or at least hopeful optimism – with no really tangible evidence to indicate that it's doing anything. However, once in a while it does fix an obvious problem.
Some folks disparage running OS X system maintenance routines 'routinely', most conveniently executed with a GUI maintenance utility like OnyX, Mac Pilot, Cocktail, MainMenu, or a raft of others, as a waste of time. The counter-assertion is that the system is very robust, designed and configured to take care of itself.
However, I'm a believer.
For one thing, the cron maintenance scripts are cleanup scripts intended to be run by the cron Unix utility in order to clean up unnecessary junk files, rotate log files, maintain activity logs, update databases, and throw away files that need to be cleared out and/or updated from time to time. The maintenance tasks performed by the scripts include:
- The daily script removes old log files, 'scratch' and 'junk' files, backs up the NetInfo database, reports a variety of system and network statistics, and rotates the system.log file. Under OS X 10.4 Tiger and 10.5 Leopard, the daily script also cleans up scratch fax files and prunes asl.log, the log for the Apple System Logging facility.
- The weekly script rebuilds the locate and whatis databases and rotates the following log files: ftp.log, lookupd.log, lpr.log, mail.log, netinfo.log, ipfw.log, ppp.log, and secure.log.
- The monthly script reports per-user usage accounting and rotates the wtmp, install.log, and cu.modem.log files.
This works as it should on Unix machines that are left running 24/7, since the cron utility is programmed to run the cleanup scripts at times when the machines are theoretically least likely to be in use – between 03:15 and 05:30 local time, depending on the script. There are three scripts, designated 'daily', 'weekly', and 'monthly'. In OS X, the daily script is scheduled to run every morning at 3:15 a.m., the weekly script at 4:30 a.m. on Saturday mornings, and the monthly script at 5:30 a.m. on the first day of each month.
If your Mac is shut down or in sleep mode during these hours, the maintenance scripts will not run. (I have heard, but haven't been able to confirm as yet, that recent versions of OS X have been configured to run the cron jobs at a different time if the computer was asleep or off during the regular scheduled time. Any information on this will be appreciated.) If the cron jobs don't get run, log files that will grow over time, consuming free space on your startup disk.
Mac OS X 10.5 Leopard will run these cron jobs after startup or waking up if the computer was off or asleep when they were scheduled. Earlier versions of Mac OS X do not do this.
However, if your Mac is shut down or left in sleep mode overnight, you can manually invoke these maintenance routines, most conveniently by using one of the maintenance utilities mentioned above or similar software.
Like most Mac users, I don't leave my computer on 24/7. Space (jaredlevi) mac os. In fact, other than the very occasional instance of me doing an overnight software download, my computers are never on at the scheduled times – I put them to sleep or shut them off overnight, so the cron scripts never get run (at least at their normal times). That means that files don't get deleted, log files grow, and databases are not updated. If you don't leave your Mac on (and not sleeping) all night, running the scripts manually from time to time is a good idea.
Repairing Permissions
Daily Routine Mac Os 11
Then there's repairing permissions. While it's hard to imagine anyone arguing that running the cron scripts is useless on the majority of computers that don't stay on all the time, permissions repair is more controversial. John Gruber over at Daring Fireball calls it 'voodoo' and states unequivocally that Apple does not recommend it as routine or preventative maintenance.
Mac OS X incorporates a subsystem based on a Unix-style operating system that uses permissions in the file system. Every file and folder on your hard drive has an associated set of permissions that determines who can read, write to, or execute it. For a thorough definition and discussion of OS X permissions, see this Apple Knowledge Base article: Troubleshooting Permissions Issues in Mac OS X .
When you use Apple's Disk Utility or another maintenance utility to verify or repair disk permissions, it reviews each of the .bom files in /Library/Receipts/ and compares its list to the actual permissions on each file listed. If the permissions differ, Disk Utility reports the difference (and corrects them if you use the Repair feature).
The X-Lab notes that
'there is considerable debate about performing Repair Permissions as part of regular maintenance. Our advice is that it is a good prophylactic step after installing third-party software that employs its own installer. This is primarily due to the fact that some poorly-written, third-party installers have been known to change permissions on System-related folders, then neglect to set them back, causing problems after the installation.
'Repairing permissions has gained the undeserved status of a ‘magic incantation' that can fix anything, and some recommend it as part of regular maintenance. While it can be a useful troubleshooting step, we do not regard it as part of regular maintenance: it will not hurt anything, it merely wastes time when run unnecessarily. However, it is still a good idea to Repair Permissions after installing third-party software….'
Also see X-Labs' Side Effects of System Cache Cleaning.
Using OnyX
Personally, since it's so easy to do with OnyX, which of the dozen or so OS X system maintenance utilities out there is the one I use most often, I usually just run Repair Permissions along with the cron scripts and some cache dumps using the configurable do-all Automator pane.
While this maintenance routine is most often, as I said, an act of faith, with no really tangible evidence to indicate that it's doing anything, sometimes it does fix obvious problems.
For example, there was the time after I updated the second OS X system on my hard drive (I keep two systems installed on separate partitions, which allows me to, among other things, check out system updates without burning my bridges to the version I know is reliable). That proceeded without drama, but I was slightly pressed for time and decided to skip doing my usual OnyX maintenance run before running the Combo updater. False economy of time.
The system installed and booted just fine, but I discovered that the Finder's 'Find' function was not working (nothing would happen), and the little text search utility SpeedSearch would find document titles but not display contents summaries. Bummer. The same sort of thing once happened on my Pismo PowerBook running OS X 10.4.4.
I figured I might have to run the system updater again, but I decided to give OnyX a shot first. I ran the cron scripts, Repair Permissions, and some selected cache dumps, but omitted optimizing the system, since the update installer had just done that. When I rebooted after OnyX had done its thing, both Find and SpeedSearch had been restored to working normally. Cool.
OnyX has a nice interface, is updated frequently, performs well, and is free. The latest version of OnyX for Leopard is 1.9.6, and versions are still available for OS X 10.4 Tiger (version 1.8.5), OS X 10.3 Panther (version 1.5.3), and OS X 10.2 Jaguar (version 1.3.1).
Aside from OS X system maintenance and optimization – including verifying and repairing permissions, running cron maintenance scripts, optimizing the system, verifying your disk media, and updating databases – OnyX allows you to configure certain hidden parameters of the Finder, Dock, Safari, Dashboard, Exposé, Disk Utility… to delete caches, to remove a certain number of files and folders that may become cumbersome, to see the detailed info of your configuration, to preview the different logs and CrashReporter reports, to check the Preferences files and more.
You can customize Dock position, alignment, and minimization options, and you can activate hidden and system files, transparent icons for hidden applications, animate opening applications, put a menu item Quit Finder in the Dock, and relaunch the Dock. To remove a certain number of files and logs, preview the different logs and CrashReporter and more.
OnyX allows you to clean or clear selected or all Internet, user, and System caches. The browsers recognized are: Safari, Internet Explorer, and OmniWeb, You can enable/disable file journaling, import IE and Mozilla/Netscape bookmarks to Safari, smooth small fonts in Safari, enable Disk Copy Expert Mode, enable Debug Menu in Safari, Address Book, and DVD Player, delete recent servers, and reset Mac OS Help.
New in version 1.9.6:
- Deleting logs option improved
- Rebuilding the display of folders content corrected
- New tab Parameters > Spotlight
- Show/hide Bonjour browser in Screen Sharing
- Show/hide full toolbar in Screen Sharing
- Desktop saved before modifying and relaunching the Finder
- Set Help Viewer window to floating or non-floating mode
- Choose the application to execute at launch of X11
- Enable/disable the .DS_Store files creation on network volumes
- Automation panel modified
- Auto Restart/shutdown modified
- New replacement icons (application and toolbar)
- Misc corrections in the translations
- Help updated and reindexed
- Searching update improved
- Deleting the application from Uninstaller improved
OnyX was compiled with Xcode 3.1.
OnyX was compiled with Xcode 3.1.
The OnyX interface displays eight tabbed panels:
- Verify – Contains panes for S.M.A.R.T. Status, Structure of Volume, and Preferences.
- Maintenance – Lets you verify and repair Permissions, run chron scripts, optimize the system, and reset several other functions.
- Cleaning – Allows you to clean or clear selected or all Internet, user, and System caches. The browsers recognized are: Safari, Internet Explorer, OmniWeb, Camino (formerly Chimera), Netscape, Mozilla, Firebird (formerly Phoenix), Opera and iCab. Safari's URL icons can also be removed. Also can clean Logs, System caches, force empty the Trash, and more.
- Utilities – The Man command allows you to format and display the Unix manual pages. You can also run the plutil, locate, and system_profiler commands from this pane.
- Automation – Runs Repair Permissions and all or selected maintenance routines. By default, cron scripts run automatically, but early in the AM, between 3 and 6, and only if the computer is turned on and not sleeping.
- Parameters – Shows basic configuration specs; Allows you to customize scroll bar arrows, screen capture format, and many other configuration elements in the Finder, Dock, Dashboard and Exposé, Safari, the Login window, iTunes, and more in seven subcategory panes
- Log – Stores the date, hour, and description of each operation executed by OnyX
The OnyX interface is streamlined and intuitive to work with. I don't imagine anyone runs the full slate of functions. For regular tune ups, the key scripts to run are Verify and Repair Permissions, the daily, weekly, and monthly Maintain scripts, and I usually optimize the system as well, all of which can be configured in the 'Automate' pane.
System requirements: Mac OS X 10.2 and up (see details above)
System support: PPC/Intel
Daily Routine Mac Os X
OnyX is freeware; you may copy and distribute it at will.
Further Reading
- Routine maintenance tasks still run inconsistently in Leopard, Charles W Moore, Miscellaneous Ramblings, 2008.09.10. Apple has been trying to get routine maintenance scripts to run consistently since the release of Mac OS X 10.4, but users are still reporting problems under 10.5.4.
Short link: http://goo.gl/eNN8Xf
Daily Routine Mac Os Download
searchword: systemmaintenance
