TweetFollow Us on Twitter

MacEnterprise: Scripting Opportunities for System Administrators, Part One

Volume Number: 25
Issue Number: 06
Column Tag: MacEnterprise

MacEnterprise: Scripting Opportunities for System Administrators, Part One

When, where, why, and how you should run administrative scripts

By Greg Neagle, MacEnterprise.org

Introduction

In previous MacTech columns, I have sometimes offered up a script or two as part of a solution to a particular problem. Even if the script I presented is a perfect fit for your environment, you might still have had trouble making effective use of it in your organization, because you did not know how to make it run at the right time or in the correct context to get the job done.

This month, we'll begin a look at some of the many mechanisms available to run scripts (and other processes). Each mechanism has different uses and is suited for a unique set of tasks. Depending on what you need to accomplish, you should select the appropriate mechanism.

Why?

The first question you should ask is "Why do I want to run this script? What task do I want to accomplish?" Some of the common administrative categories that might lend themselves to scripting are:

System configuration - initial setup of the OS, networking, user accounts, etc.

System management - ongoing management of system settings; enforcing system-wide policies

User settings/preferences - configuring applications; setting up useful default preferences, enforcing user-level policies

Administrator tools - tools to make tedious or difficult tasks easier or more consistent

Hacks/fixes/workarounds - scripts to "fix" or work around problems with the OS or applications (or users!)

When?

Once you know why you are running the script, or what you want to accomplish with the script, you can consider when it should run. Some of the possibilities:

On demand - only when invoked by an admin or user

At startup

Repeating (daily/weekly/monthly, or other intervals like hourly, every 15 minutes, etc)

When a user logs in

When a user logs out

Let's look at some logical pairings of "Why?" and "When?":

Utility scripts or administrative tools that are to be run only on demand are the easiest to handle. Simply put them in a directory somewhere and run them manually as needed, or run them remotely using Apple Remote Desktop or SSH.

If your script is doing system configuration tasks like binding a machine to Active Directory or creating local users, it should almost certainly run at startup. System management tasks might run at startup, on a repeating schedule, or both.

Tasks that affect user settings or preferences should probably run at user login, or if it's a cleanup task, perhaps at user logout.

Hacks/fixes/workarounds can vary when it is appropriate to run them: they may need to run on demand; they may need to run at login to make a change to a user's environment; they may need to run at startup to clear out stale cached data.

How?

How can you run your script when you want? Let's look at some of the available mechanisms.

Running a script at startup

There are several ways to run scripts at startup, but the two most commonly used on Mac OS X are StartupItems and launchd items. Both Startup Items and launchd's LaunchDaemons run in the root context.

StartupItems

Startup items have been used on Mac OS X for a long time, and continue to work in OS X 10.5 Leopard. Administrator-provided Startup items should be placed in /Library/StartupItems. Since Apple is phasing out StartupItems, we won't spend a lot of time on these. A Startup Item consists of a directory containing an executable (typically a shell script) and a StartupParameters.plist file. Both the executable/shell script and the StartupParameters.plist have a very specific format. The startup item directory may optionally contain other items - for example, a Resources subdirectory. Apple has some good documentation on creating StartupItems here:

http://developer.apple.com/documentation/MacOSX/Conceptual/BPSystemStartup/Articles/StartupItems.html

launchd items

launchd was introduced with Mac OS X 10.4 Tiger. It was intended to replace almost every other way of launching processes, though in practice it has not yet accomplished that. Still, launchd is very capable, and Apple continues to enhance it. Launchd items are simpler to setup than StartupItems, as they generally require only a single additional file other than the actual script or executable. Administrator-provided launchd items that run a script at startup should go in /Library/LaunchDaemons.

Launchd has been covered extensively in MacTech as well as many other places, so I won't go into great depth. But let's do a quick example. Let's say we have a configuration script that we want to run at startup. It is located at /Library/Management/configuration.sh, and is marked as executable. It looks like this:

#!/bin/sh
logger -t configuration "Hello from the config script!"

This script simply writes a message to the system log. You can test it manually:

root# /Library/Management/configuration.sh
root# tail /var/log/system.log
<snip>
Apr 21 12:31:05 arcus configuration[8400]: Hello from the config script!

To get it to run at startup, you'd need a property list at /Library/LaunchDaemons/com.mactech.demo.plist that looks something like this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
   <key>Label</key>
   <string>com.mactech.demo</string>
   <key>ProgramArguments</key>
   <array>
      <string>/Library/Management/configuration.sh</string>
   </array>
   <key>RunAtLoad</key>
   <true/>
   <key>OnDemand</key>
   <true/>
</dict>
</plist>

This property list should have owner: root, group: wheel, and mode: 0644. Some explanation of the included keys:

Label is a string used by launchd to identify the job. The name of the plist file is usually the same as this label plus ".plist".

ProgramArguments is simply the full path to the executable script.

RunAtLoad is set to true so that launchd will run the job when it loads it, which is normally at startup.

OnDemand is set to true so that launchd won't attempt to restart the script once it exits - in other words, this process/script is not meant to run continuously.

We could test the launchd job by rebooting and then looking at the system log for our message, but rebooting can take a while, and if there's a problem, the fix/retest cycle is tedious. So let's do a quicker test:

root# launchctl load /Library/LaunchDaemons/com.mactech.demo.plist
root# tail /var/log/system.log
<snip>
Apr 21 12:31:05 arcus configuration[8400]: Hello from the config script!
Apr 21 12:37:13 arcus configuration[9073]: Hello from the config script!

At the end of the system log, you should see the message from the configuration script.

If you have problems, unload the job:

root# launchctl unload /Library/LaunchDaemons/com.mactech.demo.plist

Make your changes to the plist, and try loading the job again. Once the job is working, you should be able to reboot, and see the message in the system log during the startup process.

Apple documentation on creating a launchd item is available here:

http://developer.apple.com/documentation/MacOSX/Conceptual/BPSystemStartup/Articles/LaunchOnDemandDaemons.html

Repeating scripts

Some scripts are best run on repeating intervals. For example, you have a script that scans the startup disk for all installed fonts and then uploads that list of fonts to a database somewhere so you can monitor for license compliance. You should run that script periodically: maybe daily, maybe weekly, maybe monthlyit's up to your organization. There are several ways to do this.

One of the easiest ways is to piggy-back off an existing facility for running repeating scripts: the periodic command. By default, periodic is used to run scripts on a daily, weekly or monthly basis. It runs all the scripts it finds in certain directories:

/etc/periodic/daily/ - these are run every day

/etc/periodic/weekly/ - these are run once a week

/etc/periodic/monthly/ - these are run once a month

To get periodic to run your scripts, mark them as executable and put them in the appropriate directory. You can control the order in which the scripts run by naming them appropriately. The convention used is to start the script name with a three-digit number; the scripts are then run in numeric order:

root# ls -1 /etc/periodic/daily
100.clean-logs
110.clean-tmps
130.clean-msgs
430.status-rwho
500.daily
599.randomSleep
600.updateMachineName
700.updateHostInfo
900.autoradmind

There are some issues to be aware of, however. The first is exactly when these scripts will run. This is controlled by launchd in the following files in /System/Library/LaunchDaemons:

com.apple.periodic-daily.plist
com.apple.periodic-monthly.plist
com.apple.periodic-weekly.plist

Looking at com.apple.periodic-daily.plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
   <key>Label</key>
   <string>com.apple.periodic-daily</string>
   <key>ProgramArguments</key>
   <array>
      <string>/usr/sbin/periodic</string>
      <string>daily</string>
   </array>
   <key>LowPriorityIO</key>
   <true/>
   <key>Nice</key>
   <integer>1</integer>
   <key>StartCalendarInterval</key>
   <dict>
      <key>Hour</key>
      <integer>3</integer>
      <key>Minute</key>
      <integer>15</integer>
   </dict>
</dict>
</plist>

The StartCalendarInterval key tells us it will run each day at 3:15 AM local time. That time might not be a good one for your environment. Consider a few scenarios:

Desktop machines: if the desktops in your organization are left on 24/7, then the script will run shortly after 3:15 AM each day. If instead, they are asleep at 3:15 AM, they'll run shortly after they are woken up each day. If they are powered off at 3:15 AM, the scripts won't run at all. Launchd will reschedule jobs that were scheduled to run when the machine was asleep, but will not reschedule jobs that were scheduled to run when the machine was powered off.

Laptop machines: all of the same complications as with desktops, with the additional problem that if they get taken home at night or over the weekend, and run these jobs at 3:15 AM (or when woken up), and your scripts require access to network services or resources available only when the machine is connected to your organization's network, they may fail, or at the very least, fail to do anything useful.

Therefore, you might consider changing the time these jobs run to a time during the day when it's more likely the machine is on, awake, and on your network.

Another possible approach that does not require modifying Apple's provided launchd items is to run a script at startup that checks for overdue periodic jobs and runs them. Such a script is described (and available) here:

http://managingosx.wordpress.com/2008/06/18/launchd-vs-periodic/

Repeating launchd jobs

Looking at the property list for com.apple.periodic-daily.plist suggests another method for running scripts on a repeating basis: avoiding the periodic middleman and using launchd directly. Using our com.mactech.demo example as before, we can run a script at startup and once a day with a LaunchDaemon plist like this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
   <key>Label</key>
   <string>com.mactech.demo</string>
   <key>ProgramArguments</key>
   <array>
      <string>/Library/Management/configuration.sh</string>
   </array>
   <key>RunAtLoad</key>
   <true/>
   <key>OnDemand</key>
   <true/>
   <key>StartCalendarInterval</key>
   <dict>
      <key>Hour</key>
      <integer>12</integer>
      <key>Minute</key>
      <integer>15</integer>
   </dict>
</dict>
</plist>

We've added a StartCalendarInterval to the previous version of the property list that tells launchd to run the job each day at 12:15, when many of our staff will be at lunch. If we didn't want it to run at startup as well, we could remove the RunAtLoad key, or set it to false.

Good old cron

One last method to mention: the classic UNIX cron is still available in OS X, and can still be used to run repeating jobs. Type man cron at a command prompt for details. You'll probably want to create a crontab at /etc/crontab . A big disadvantage of using cron is that it's hard to manage different versions of the crontab files. For example, if you have a set of machines that need repeating jobs A and B, another set that needs repeating jobs B and C, and yet another set that needs repeating jobs A, B and C, you'll need to manage three different versions of the crontab as well as the scripts that do the actual jobs. If you use periodic or launchd, you don't have to deal with the monolithic crontab file, as the scheduling info for each job lives in a separate file (or in the case of periodic, is not needed).

To be continued...

We covered quite a bit this month. We looked at running scripts at startup and on a repeating schedule. In the future, we'll look at running scripts as part of the login and logout process, both with root privileges, and as the user logging-in. While you might guess that launchd might be useful here, we'll also look at login/logout hooks and login items. We'll also consider the special case of scripts that should run only once, either at startup or login. Finally, we'll look at some methods to simplify implementing additional scripts once you have a few working. See you next time!


Greg Neagle is a member of the steering committee of the Mac OS X Enterprise Project (macenterprise.org) and is a senior systems engineer at a large animation studio. Greg has been working with the Mac since 1984, and with OS X since its release. He can be reached at gregneagle@mac.com.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

Drama 2.0.7 - Prototyping, animation...
Drama's handy 3-in-1 functionality uniquely integrates design, animation and prototyping into a single familiar tool. No more frustrating switching between apps or learning new stuff. And by... Read more
Navicat Premium Essentials 15.0.11 - Pro...
Navicat Premium Essentials is a compact version of Navicat which provides basic and necessary features you will need to perform simple administration on a database. It supports the latest features... Read more
Delicious Library 3.9 - Import, browse a...
Delicious Library allows you to import, browse, and share all your books, movies, music, and video games with Delicious Library. Run your very own library from your home or office using our... Read more
ffWorks 2.0.1 - Convert multimedia files...
ffWorks, focused on simplicity, brings a fresh approach to the use of FFmpeg, allowing you to create ultra-high-quality movies without the need to write a single line of code on the command-line.... Read more
TeamViewer 15.3.2682 - Establish remote...
TeamViewer gives you remote control of any computer or Mac over the Internet within seconds or can be used for online meetings. Find out why more than 200 million users trust TeamViewer! Free for non... Read more
Affinity Designer 1.8.1 - Vector graphic...
Affinity Designer is an incredibly accurate vector illustrator that feels fast and at home in the hands of creative professionals. It intuitively combines rock solid and crisp vector art with... Read more
Wireshark 3.2.2 - Network protocol analy...
Wireshark is one of the world's foremost network protocol analyzers, and is the standard in many parts of the industry. It is the continuation of a project that started in 1998. Hundreds of... Read more
Affinity Photo 1.8.1 - Digital editing f...
Affinity Photo - redefines the boundaries for professional photo editing software for the Mac. With a meticulous focus on workflow it offers sophisticated tools for enhancing, editing and retouching... Read more
iShowU Instant 1.3.2 - Full-featured scr...
iShowU Instant gives you real-time screen recording like you've never seen before! It is the fastest, most feature-filled real-time screen capture tool from shinywhitebox yet. All of the features you... Read more
NeoFinder 7.5.1 - Catalog your external...
NeoFinder (formerly CDFinder) rapidly organizes your data, either on external or internal disks, or any other volumes. It catalogs and manages all your data, so you stay in control of your data... Read more

Latest Forum Discussions

See All

Amon Amarth Berserker is a side-scrollin...
Amon Amarth Berserker is the latest game from Ride & Crash and serves as a follow up to the previous title that was simply called Amon Amarth. It's available now as a premium title for both iOS and Android. [Read more] | Read more »
Team up with your guildmates to take on...
MU Origin 2's latest update is now live and brings with it two new Abyss-related events to challenge Guilds. There are also a few new features that will allow players to enhance their costumes, an increased level cap and more. [Read more] | Read more »
Build Your Own Apple Arcade, For $400
Apple Arcade has been out for a little over a month, and I’m not entirely thrilled with it. It’s definitely an interesting idea, but it leaves a lot to be desired, especially in fulfilling its commitment to letting folks “play anywhere.” Still, at... | Read more »
Creepy Little Monsters is a cute, monste...
Creepy Little Monsters is a retro throwback that sees you traversing tricky puzzle-platformer levels as a one-eyed monster. It aims to offer a fresh take on 80s and 90s classics of the genre, and it's out right now for iOS and Android. [Read more... | Read more »
Tyrant's Arena delivers intense her...
Tyrant's Arena is an intense midcore multiplayer actioner where you'll compete in tricky 3v3 matches to crush your opponents and earn neat rewards. It comes to us from developer Kroy Games, and it's now available for pre-registration on iOS and... | Read more »
Mobile Games Starter Kit
Over here at 148Apps, we regularly dive deep into the latest and greatest mobile games hitting the App Store, but that’s not always what people are looking for when searching for a new mobile game. Some folks just want to dip their toes into... | Read more »
Unresolved is a hard-hitting narrative a...
Ghofran Akil's Unresolved in an upcoming text-based adventure game that sees you playing as a mother attempting to find her disappeared husband during the Lebanese Civil War. [Read more] | Read more »
Marvel Strike Force introduces new brawl...
FoxNext's squad-based RPG Marvel Strike Force is set to receive some fresh characters from the X-Men and Iron Man series. They'll arrive as part of the game's latest update, which follows a sizable spending boycott on the title due to complaints... | Read more »
Speed Dating for Ghosts is a narrative a...
Speed Dating for Ghosts originally released on Steam back 2018, since then it has received honourable mentions for narrative during the Independent Games Festival. Now it's made its way over to iOS devices where it's available as a premium title... | Read more »
Fast-paced multiplayer title Tennis Star...
Tennis Stars: Ultimate Clash is the latest free-to-play tennis title to hit iOS and Android. It's said to be a fairly casual experience, offering easy-to-learn controls and fast-paced, mobile-friendly matches. [Read more] | Read more »

Price Scanner via MacPrices.net

Back in stock! Apple’s 4-core and 6-core 2018...
Apple has Certified Refurbished 2018 Mac minis available on their online store for $120-$170 off the cost of new models. Each mini comes with a new outer case plus a standard Apple one-year warranty... Read more
10″ 128GB iPads on sale today at Amazon for $...
Amazon has new 10.2″ 128GB WiFI iPads for $100 off Apple’s MSRP. These are the same iPads sold by Apple in their retail and online stores. Note that some sale prices may be restricted to certain... Read more
Orcam MyEye 2 Is Inspiration Apple Needs To M...
EDITORIAL: 02.28.20- It’s no secret that Apple is planning to further expand into the wearables segment, working quietly behind the scenes to create its own smart glasses — as rumors have suggested... Read more
Boost Mobile 1-day Flash Sale: $100 off all A...
Boost Mobile is offering Apple’s 2019 iPhone 11 and 11 Pro models for $100 off MSRP. Boost is also offering the same $100 discount on new previous-generation iPhone XS, XR, X, 8, and 7 models. For... Read more
13″ 1.4GHz Silver MacBook Pros on sale for $1...
B&H Photo has new 2019 13″ 1.4GHz Silver MacBook Pros on sale for $150 off Apple’s MSRP today with prices starting at $1149. Overnight shipping is free to many addresses in the US. These are the... Read more
Apple resellers offer $150-$170 discounts on...
Amazon has new 2019 13″ MacBook Airs on sale for $150-$170 off Apple’s MSRP, with prices starting at $949, each including free shipping. These are the same MacBook Airs Apple sells in their retail... Read more
B&H is again offering $100 discounts on M...
B&H Photo has 4-Core and 6-Core Mac minis on sale for $100 off Apple’s standard MSRP, with prices starting at only $699. Overnight shipping is free to many US addresses: – 3.6GHz Quad-Core mini... Read more
B&H Photo drops iMac prices, offers model...
B&H Photo has new 2019 21″ and 27″ 5K iMacs in stock today and on sale for up to $250 off Apple’s MSRP, with prices starting at only $999. These are the same iMacs sold by Apple in their retail... Read more
Flash sale! 11″ 64GB WiFi iPad Pro for $674,...
Walmart has the 11″ 64GB WiFi iPad Pro on sale on their online store today for $674. That’s $125 off Apple’s MSRP for this model and the cheapest price available from any Apple reseller. Choose free... Read more
Sale! Get the 256GB 13″ Silver MacBook Air fo...
Amazon has new 2019 13″ 1.6GHz/256GB MacBook Airs, in Silver, on sale today for only $999 shipped. Their price is $300 off Apple’s MSRP for this model, and it’s the cheapest price for a 256GB MacBook... Read more

Jobs Board

Windows/ *Apple* Technical Support Engineer...
Windows/ Apple Technical Support Engineer Key Role: Serve as a part of a dynamic corporate technical support group. Provide Tier III technical support and monthly Read more
Medical Assistant - *Apple* Valley Clinic -...
…professional, quality care to patients in the ambulatory setting at the M Health Fairview Apple Valley Clinic, located in Apple Valley, MN. Join the **M Health Read more
Medical Assistant - *Apple* Valley Clinic -...
…professional, quality care to patients in the ambulatory setting at the M Health Fairview Apple Valley Clinic, located in Apple Valley, MN. Join the **M Health Read more
Geek Squad Advanced Repair *Apple* Professi...
**764652BR** **Job Title:** Geek Squad Advanced Repair Apple Professional **Job Category:** Store Associates **Store NUmber or Department:** 000245- Apple Read more
Medical Assistant - *Apple* Valley Clinic -...
…professional, quality care to patients in the ambulatory setting at the M Health Fairview Apple Valley Clinic, located in Apple Valley, MN. Join the **M Health Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.