Any one using clean my mac 2 on OS X Mawerick? Is it worth?

WZZZ wrote:

Well, I suppose that's at least one good thing to be said for Mav.

The switch from cron to launch daemon for handling scheduled jobs occurred long before Mavericks was released. I think it originated in one the the Tiger updates, although it has seen much refinement since then.

These days, only very old or poorly written apps would rely directly on cron for scheduling chores.

Sure, I know about that, but system log was moved out of the periodic scripts to newsyslog beginning with 10.6. Now you make me wonder if what you say about sys log in Mav is correct. Are you sure you aren't referring to the periodic scripts (daily, weekly, monthly)? Those get run on next wake, but at least in 10.6 (through I think 10.8--but not certain about that, since I don't normally run from 10.8), sys log doesn't, and never will if the computer isn't awake at that time.

You've actually seen sys log in 10.9 get emptied out on next wake?

R C-R wrote:

So now you don't get a line by line list of all the included malware signatures output to the log every time Sophos checks for updates to them?

That's correct, I don't have anything close to that. Mostly I just see a few entries like this:

Feb 9 01:33:15 Als-iMac-i7.local SophosWebD[67]: <SMENode: 0x7f83b0c3e3b0> localNode csc:1ERROR! encountered an error while writing to outputstream| error:Error Domain=NSPOSIXErrorDomain Code=32 "The operation couldn’t be completed. Broken pipe"

which looks to be a network error and on occasions when the app itself is being updated I do see many lines which to me are unnecessary regarding it's installation. When I had issues it was a constant stream of entries which noticeably slowed processing.

WZZZ wrote:

Are you sure you aren't referring to the periodic scripts (daily, weekly, monthly)? Those get run on next wake, but at least in 10.6 (through I think 10.8--but not certain about that, since I don't normally run from 10.8), sys log doesn't, and never will if the computer isn't awake at that time.

You've actually seen sys log in 10.9 get emptied out on next wake?

I thought this would be an easy one to respond to, but now I've stumbled on some informtion I didn't know before.

First the easy answer. The process by which the system log is rolled over is controlled by a LaunchDaemon and should therefore occur at 12:30am local if the computer is awake. If asleep at that time it will occur as part of the wake up process. If the computer is shut-down at that time, the log will not be rolled over. My computer is never asleep at 12:30am and I actually have no time or interest in testing my theory, which is simply based on how LauchAgents/Daemons have always worked in the past.

Then I was going to say that the periodic maintenance scripts work the same way, but now I see that they don't in Mavericks. There are still three LauchDaemons:

com.apple.periodic-daily.plist

com.apple.periodic-monthly.plist

com.apple.periodic-weekly.plist

They no longer directly launch these events on a specific date and time, rather they launch three identical processes called "periodic-wrapper" with arguments of "daily," "weekly" or "monthly" which I can see running continuously in Activity Monitor. According to the man page:

The periodic-wrapper command handles the scheduling of the periodic(8)

command. It cannot be run directly.

but doesn't really tell you how it does that. The "periodic" process is what has been executing those scripts when called, but it used to be called directly by the LaunchDaemon.

So there is a difference between how system.logs are rolled over and how periodic maintenance scripts are run, I just don't know what that is. I can only guess it somehow overcomes the problem of not running the script if the computer was shut down at the time it was supposed to.

I use a widget called Maintidget which tells me when each script was last run and gives me the option of running them manually by entering an admin password (I have not checked the latter with Mavericks). In checking the dates/times just now I see that they were run at odd times, probably due to the fact that I had not been logged onto the Mavericks boot disk for several weeks.

WZZZ wrote:

Sure, I know about that, but system log was moved out of the periodic scripts to newsyslog beginning with 10.6. Now you make me wonder if what you say about sys log in Mav is correct. Are you sure you aren't referring to the periodic scripts (daily, weekly, monthly)?

Sorry for the confusion, which in part echos my own. My comments about daemons taking over the role of cron jobs was intended as a general comment, not specific to either the system logs or to the periodic jobs.

However, regarding newsyslog, note that its man page has not been updated since 2005 & it refers to its being scheduled to run periodically by cron. (Also note that the F option is meant to force trimming logs even when the "trim conditions" have not been met & is intended for troubleshooting.)

So to begin with, I'm not sure how to reconcile what the man page says about running it as a cron job with the newer daemon scheduling approach. The man page says it "may" be scheduled to run every hour (by cron) but I don't know if it normally is or not, or if cron still is what does that, directly or indirectly.

Beyond that, running newsyslog does not necessarily cause any logs to be rolled over. For that to happen, one of three conditions must be met when it is called. From the man page, they are:

1. It is larger than the configured size (in kilobytes).

2. A configured number of hours have elapsed since the log was last archived.

3. This is the specific configured hour for rotation of the log.

The configuration is normally set log by log with named entries in the /etc/newsyslog.conf file (as described in that file's man page here) & with additional, similarly formatted files in the /etc/newsyslog.d/ directory. There is also a provision for a named entry with the literal string name "<default>" for logs that have no explicit entry of their own.

The thing is, on my system running Mavericks the /etc/newsyslog.conf file contains only six entries (& no "<default>" one), none of which refer to the main /var/log/system.log. (Specifically, they are configurations for the ftp, hwmond, ipfw, lpr, ppp, & wtmp logs.) Only the entry for /var/log/wtmp is configured to roll over based on time (condition #3 above), & that is configured for the 5 AM hour.

Likewise, there are only a few entries in my /etc/newsyslog.d/ directory. Only two of those refer to var/log files (for the xscertd & wifi logs) & neither of those are set to roll over based on time (neither #2 nor #3 above).

So I'm not sure if manually running newsyslog in Mavericks will do much besides (maybe) rolling over the few logs mentioned above, or what mechanism or configuration files normally control rolling over any of the other ones. 😕

MadMacs0 wrote:

In checking the dates/times just now I see that they were run at odd times, probably due to the fact that I had not been logged onto the Mavericks boot disk for several weeks.

For what very little it is worth, I am constantly logged into my Mavericks system (& as likely to be at the keyboard in the middle of the night as during the day), & my daily & weekly periodic jobs do not run at any specific time of day or night.

The daily one runs once every day, but at various times that don't correlate well with sleep/wake times or anything else obvious to me. The weekly one is seemingly even more erratic: sometimes it runs only five days after the last run; at other times it could be up to eight days later.

Whatever is going on in Mavericks with all the various scheduled tasks, it no longer seems to have much if anything to do with the traditional UNIX time-of-day triggers. I don't think this is a bug or flaw or anything to be concerned about. Rather, since those triggers are not very appropriate for systems that aren't awake 24/7, Apple has moved on to something that is.

I don't know exactly what that is or how it works, but as long as it does I'm not going to worry about it. 🙂

FWIW, this is what happens to my 10.6 system log after running sudo newsyslog -F /var/log/system.log

What happens if you try that on your 10.9? (User logs are greyed out because in order to see sys log, I'm running Console with admin privileges from my std account.)

WZZZ wrote:

FWIW, this is what I see in my 10.6 system log after running sudo newsyslog -F /var/log/system.log

What happens if you try that on your 10.9?

Something I now regret doing. 😢

My system log was rolled over, but the new one has permissions set to allow no admin access (not even for reading). Additinally, the old one (now "system.log.0") is simply listed with type "document" (it is not compressed) & it plus system.log.1.gz through system.log.3.gz also had their permissions reset to allow no admin access.

My system.log.4.gz through system.log.10.gz files were untouched & still have admin read only privleges.

I suggest that others running Mavericks do not try this!

And does sys log in 10.9 get turned over like that on next wakeup if it's been sleeping at whenever ?

OK. I have manually reset permissions for the system log files so I can now view them in Console. The first line of the new system.log file says:

newsyslog[13256]: logfile turned over due to -F request using <default> rule

So somewhere I assume there is a default rule in Mavericks for this, but judging from what happened to me, it is set to assign very restrictive permissions to the files it affects. (But I still don't know why permissions for some of the already gzip compressed system logs were changed but the older ones weren't.)

Anyway, since I do not know where the configuration file with the <default> rule in it is located in Mavericks or exactly what options are included in that rule (per the config man page mentioned earlier), I strongly suggest that other users do not try running the newsyslog command, particularly with the F flag, on any log file that doesn't already have an explicit entry controlling what it does in a known config file!!!

WZZZ wrote:

And does sys log in 10.9 get turned over like that on next wakeup if it's been sleeping at whenever ?

Right now, I'm not sure what is happening to my system logs, or if whatever does tells us anything useful. 😟

But again, consider that system logs do not normally turn over at a specific time (even in recent pre-Mavericks OS versions). They should turn over based only on their size (condition one in my previous post), unless some configuration file has a "when" value that says otherwise.

In 10.6 at least, if the computer is not sleeping, sys log turns over completely at 12:30 AM.

MadMacs0 wrote:

When I had issues it was a constant stream of entries which noticeably slowed processing.

Interesting. Even when Sophos was writing out all its signature names to the system log on each update, I never saw any slowdowns. In that respect, it was no different from anything else that wrote anything to system log -- lots of lines to wade through but at most still only a few tens of KB of data, so it didn't come remotely close to taxing any system resources.

WZZZ wrote:

In 10.6 at least, if the computer is not sleeping, sys log turns over completely at 12:30 AM.

In 10.6 (at least on my older MacBook still running that OS) that is because the default version of the /etc/newsyslog.conf file has an explicit entry for var/log/system.log with an asterisk in the size field (meaning the file won't be trimmed based on its size) & "@T00" in the when field (meaning daily during the zero hour).

Like the previously mentioned man page said, minutes & seconds in the when field are ignored because the comparison is only to "within the hour." So it won't necessarily run at precisely 12:30 AM.

Anyway, as I said, in Mavericks there is no explicit entry in the /etc/newsyslog.conf file for var/log/system.log, so calling newsyslog with that file (or any other log file without an explicit entry) & the force (F) option is not advisable.

R C-R wrote:

consider that system logs do not normally turn over at a specific time (even in recent pre-Mavericks OS versions). They should turn over based only on their size (condition one in my previous post), unless some configuration file has a "when" value that says otherwise.

In checking my older system.log's I a last entry of:

Feb 2 02:26:55 Als-iMac-i7.local shutdown[30622]: SHUTDOWN_TIME: 1391336815 358924

Which is when I rebooted into Mountain Lion.

When I returned to Mavericks, the first entry in the next log is

Feb 6 18:29:30 localhost bootlog[0]: BOOT_TIME 1391740170 0

So it would seem that newsyslog found the old log to meet the criteria for roll-over and accomplished that at boot time. I would expect similar behavior had it been put to sleep over that period.

BTW, I notice that all of the other logs are cut off at midnight, even though the LaunchDaemon runs at 12:30am.