How do you find active scripts

Scripting Forums AppleScript | Mac OS X
#1

Hi - guess what - I am a noobie!

My problem - I have inherited an X-serve in my new company. My skills are very limited but I have gathered that there is some sort of script running on the machine which is backing up data from an attached raid to the OS drive (filling the OS drive and eventually crashing the server). When this function is running the launcd and rsync services are active in the Activity monitor.

The problem is the activity monitor does not seem able to give me detailed information regards what is controlling the rsync.

I am guessing it is a script written by a Backup software in the past (possibly NetVault) as it creates a folder structure on the OS drive under the Volumes directory with the following folder names:
Archive/Backup/0_Last_Version.
I have held all backup jobs and killed all services associated with NetVault and this is still happening so this script has to exist somewhere else.

I have looked in ical under the admin account (only local account to the machine) as one of your forums mentions using ical to run scheduled scripts. But there is nothing there.

I need to find what is causing this and stop it, its happening every day (every 4-5 hours).

I have looked through this forum site and can not find any advice regards how to find and deal with corrupt or pre-existing scripts. Nor a default location for them in the System folder.

Please help - this is driving me mad.

Model: X-serve
Browser: Safari 534.16
Operating System: Mac OS X (10.5)

#2

My knowledge is only from the client version of OSX, so maybe this won’t apply…

There’s a few ways to automatically run stuff on your computer. 1) ical as you mentioned, 2) something in the login items of a user’s account in the system preferences, 3) a launchd process, 4) a cron job, and 5) a login/logout script. That’s all I can think of. So check those things and google them if you’re not sure what they are.

#3

Have you taken a look at what’s in folders.

/Library/LaunchAgents

/Library/LaunchDaemons

You may have an xml that runs you script in one of these.

#4

Does the machine already have something like Cronnix on it? This is a simple UI front end for cron. If so, open it up and see if it has any entries in it.

#5

Thanks for all the tips - I am looking through them now. Its very frustrating that you cant use something like Activity monitor to track exactly what is triggering these events.

I am logged in under the administrator account, there are no other local accounts do you think if I set up a new account and this event did not run that could narrow down my search?

I also have no clue what to look for in the suggested locations, I have loads of files in there.

I will try to get more info back to you - tearing my hair out here as this problem is causing me loads of grief.

#6

LaunchAgents and Launchdaemons both empty - Bummer

#7

Does anyone know a way to search the contents of script files for a text string on a hard disk. If I could search for the text string of the directory this script is making - maybe I could find the script - does anyone understand what I mean?

#8

Did you check both the user account and the system (i.e. ~/Library and /Library)?

If you can create a 2nd user on that machine it would reveal whether this script runs from the 1st user account or not.

To find text in a script you can use ScriptLight - it will search the entire drive when you tell it to (go make tea).

And, um, tick off items in regulus’ list.

#9

I am fairly copnvinced that launchd is being used to start the rsync service

used launcdctl and listed the files using the service but could not see anything odd in there. Back to square 1

I am not sure what I should search for inside the script, I tried the grep command but just does not do what I need.

I will download and try the tool - it might be a lifesaver

#10

bummer - I can not go to the root of the filesystem with the suggested application - only from user home directory upwards!

Any tips?

#11

I tracked down the following using Launchdctl as services linked to the issue

66971 - 0x101a00.rsync
66866 - 0x10d3a0.rsync
66865 - 0x101910.rsync
66846 - 0x10c930.csh
66845 - 0x10c840.cron
42 - 0x10d900.cron
1 - 0x10d810.launchd

Can anyone help me to find out which script is starting these?

Thanks