I use EasyFind. All I have for crsud is
If I use Go to folder for /private/var/root/Library/Caches/crsud I get folder not found. If I enter just /private/var/root I don't have permission to see its contents.
If I enter sudo open /private/var/root/Library/Caches/crsud nothing happens.
But even if I just enter sudo open /private/var/root/ I get a Preview root folder showing with no access. I would have thought sudo open would blow away all ACLs. I guess it doesn't.
I'm going to try to set up EF with root privileges.
use sudo ls,or cat/less if you want to see the cache.db content
FaF makes it very easy, I use both that & EF
even Devon suggest it " Alternative: Feel free to have a look at Thomas Tempelmann's Find Any File. In contrast to EasyFind you'll get a hierarchical result list, you can search as "root" user, search after date ranges and file sizes, and save searches and re-run them later." although I'd expect that EF can be usefully run via sudo, like disk usage apps.
Michael Schmitt wrote:
The clues would imply that crsud runs every 4 hours to check for the important security updates.
I have Little Snitch asking for crsud, it seems to go by the time and date as if it didn't run it will try during log-in time, but not all the time, else it asks about once day or so, I think it's like every 26 hours or so.
This is 10.6.8, might be more often on the Lions.
Michael Schmitt wrote:
It's scheduled to run every 4 hours in Snow Leopard, but Snow Leopard only counts awake time.
It might be running every four hours, but it's checking for updates every 20 something hours unless it missed it, then it will check for updates upon login time.
If it checked for updates every four hours, it would have bugged the crap out me as I watch all my network connections.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
Must be every four hours of actual running time. I've since allowed it in Little Snitch to run behind the scenes. But before I did, I'm pretty sure I wasn't being prompted to allow every four hours, even of running time.
I'd still love to see this thing bring over an actual update. Would that go to XProtect or what? Since XProtect is already set to bring things over on a regular basis, I'm still puzzled what this thing actually does. Hard to imagine it silently installing a security update, since those have always required a restart. No one seems to have figured this out; all the hits I get for crsud are from around 3/15, when this thing first appeared.
Message was edited by: WZZZ
I'm possibly the least qualified person to be commenting on this having leapfrogged from Leopard on PPC to Mountain Lion on an i7, so I can't check anything to do with Lion or SL. It is clear, though, that different OS's are handling it with slight differences.
My XProtect option is here
as it apparently is for Lion. The Help Center goes on to say:
Automatically update safe downloads list
Apple keeps an updated list of malware that may try to compromise the security of your computer. Your computer is set, by default, to automatically update this information with the latest available.ut the "Automatically install security updates" option is in Software Updates and is labeled "Install system data files and security updates".
and the Help Center says:
Automatically install system data files and security updates
Select the checkbox to have your Mac install system files and security updates automatically.
Must be every four hours of actual running time.
Did I read earlier that SL handles "StartInterval" differently than Lion & ML?
Would that go to XProtect or what? Since XProtect is already set to bring things over on a regular basis, I'm still puzzled what this thing actually does. Hard to imagine it silently installing a security update, since those have always required a restart. No one seems to have figured this out; all the hits I get for crsud are from around 3/15, when this thing first appeared.
I doubt that it's at all connected with XProtect, for as you say that's already on a 24-hour basis and is apparently always on now for SL users. In order to test it you would have to have the crsud option disabled and wait for the next XProtect update to know for certain. If it didn't happen within 24 hours (clock time or run time?), then you would need to try toggling it to see if they are connected.
In Lion and ML it's obviously controlled by different processes.