Mac OS X shutdown vs sleep mode

On 7/8/2009 3:03 PM, "John Baxter" wrote:
>>> Dan, this is big news for me! I always turn my Mac off at night, so
>>> the Unix maintenance routines will never run at the proper time. But
>>> now it seems I don't need to fret about this, I don't need to use a
>>> maintenance utility?
>>
...
>> So, yes there is no need to use a separate maintenance utility
>> for these scripts. And if you grap a copy of the freeware
>> program Lingon, it is simple to add other things to launchd that
>> you might have previously run under cron.
>
> Please don't assume that Dan was correct without checking. (Note: Dan
> is *almost* always correct.)

Many (including myself) might disagree ;)


> It is easy to check. After the machine has been off overnight, and
> you've given it a decent chance to catch up...

Note that this won't always happen immediately. For example, on my Desktop
Mac, which sleeps all night, my daily routine wasn't run today until
10:07am.


It's also worth clarifying that if you turn your Mac *off* at night, the
scripts may not run automatically during the day; if you want to be sure the
scripts run, put your Mac to sleep at night instead of shutting it down.
(John alluded to this in his message, but I wanted to emphasize the point.)


Finally, keep in mind that while these scripts are useful, for most users it
wouldn't be a tragedy if they *never* run:

<http://www.macworld.com/article/133684/2008/06/maintenance_intro.html>

On Jul 8, 2009, at 2:50 AM, Bill Rowe wrote:

> I had not been aware moving the daily/weekly/monthly scripts
> from cron to lauchd as done in 10.5 made it so that these
> scripts would run at the next available opportunity should my
> laptop be turned off overnight until Dan Frakes mentioned it here.

You need to be a little careful here. Dan didn't say the scripts
would run "at the next available opportunity"; he said they would "run
sometime after you wake up the computer." In fact, if you regularly
shut down your computer, the scripts may not run for days, weeks, or
ever. For instance, my mother uses her iMac for several hours every
day and shuts it down every night. On her system, daily.log shows the
daily script ran on June 8th and then on July 3rd.

The way the timing works is described here:

<http://www.thexlab.com/faqs/maintscripts.html>

Of course, if the scripts don't run often, it's not really that big of
a deal. They mostly just rotate logs and clean up temporary files.
With the spacious drives of today, it's not as critical that these
scripts be run so regularly.

On 9/07/2009 8:54 PM, "Dan Frakes" <danfrakesmac.com> spake thus:

> It's also worth clarifying that if you turn your Mac *off* at night, the
> scripts may not run automatically during the day; if you want to be sure the
> scripts run, put your Mac to sleep at night instead of shutting it down.

The same also applies to safe sleep (hibernate), as this also effectively
switches the machine off. I discovered this after switching my Power Mac
over to this using the pmset command. Normally my machine used to get woken
up in the middle of the night to run the maintenance tasks by a wake-on-LAN
request from my DNS server, but with hibernate that no longer works :(

--
Nigel Stanger

On 9/07/2009 8:54 PM, "Conrad Hirano" <tidbitshirano.fastmail.fm> spake
thus:

> Of course, if the scripts don't run often, it's not really that big of
> a deal. They mostly just rotate logs and clean up temporary files.

There's also the update of the locate database, which is kind of important
if you use the locate command a lot :) (I find it much more useful than
Spotlight in most cases.)

--
Nigel Stanger

On 7/9/09 at 1:54 AM, danfrakesmac.com (Dan Frakes) wrote:

>It's also worth clarifying that if you turn your Mac *off* at night,
>the scripts may not run automatically during the day; if you want to
>be sure the scripts run, put your Mac to sleep at night instead of
>shutting it down. (John alluded to this in his message, but I wanted
>to emphasize the point.)

Interesting. I would have not expected this to make much
difference. When I tested this, I did it during the period where
I let the battery run down to re-calibrate it per Apple's
recommendation. So, my machine would have gone into hibernate
(deep sleep) mode rather than being shut down. Inspection of the
logs after my test showed the daily script did run right after
connecting to ac power and re-starting.

Unix scripts - I checked yesterday as suggested by John Baxter, and Console did not show any daily.out, weekly.out or monthly.out logs, after six weeks of running this machine (Mac Mini, OSX 10.5.7) but switching it off overnight.

However, I left it in sleep mode last night, and this morning there's a brand new daily.out log... So it seems you musn't switch off every night, if you care about these scripts running. Various people have suggested it doesn't really matter either way, but I guess I'll let them run occasionally for the sake of clean and tidy housekeeping.

on 7/10/09 01:57, Peter Drake at peter.drakefreeuk.com wrote:

> Unix scripts - I checked yesterday as suggested by John Baxter, and Console
> did not show any daily.out, weekly.out or monthly.out logs, after six weeks of
> running this machine (Mac Mini, OSX 10.5.7) but switching it off overnight.
>
> However, I left it in sleep mode last night, and this morning there's a brand
> new daily.out log... So it seems you musn't switch off every night, if you
> care about these scripts running. Various people have suggested it doesn't
> really matter either way, but I guess I'll let them run occasionally for the
> sake of clean and tidy housekeeping.

I'm sure most of you already know this, but if you feel you must be doubly
sure that these scripts run no matter what you do with your machine at night
take a look at Anacron:

<http://members.cox.net/18james/anacron-tiger.html>

Supposedly not needed with Leopard, but won't do harm. Uses a few
milliseconds to execute every hour.

 
-Al-

--
Al Varnell
Mountain View, CA

At 7/7/2009 12:46 AM -0700, Kevin van Haaren wrote:
>I noticed this after I sent the message but to be honest I can't
>figure out how they would accomplish this. Perhaps the warranty
>doesn't cover the A/C or furnace but electrically there isn't a way
>to have a meter based surge suppressor that doesn't protect
>everything downstream.

My guess -- and it's only a guess -- is that it's simply another way
of capping their risk, especially since the A/C isn't even the most
vulnerable appliance. I agree, protection at the meter has to protect
everything downstream (and so is valuable for protecting the A/C even
if it isn't insured as part of the program). They don't say the A/C
isn't protected, only that it isn't insured. This indicates their
uncertainty about the reliability of the protection, but the
protection is there.

>Most houses have 2 phases of power, it's possible they're only
>protecting 1 phase but this doesn't make sense either, I've got
>outlets for corded appliances on both phases.

Right, protecting only one phase would basically protect less than
half the house, and they would have no way of knowing which phase had
the more expensive stuff plugged in to it. It surely protects both
legs, and also the neutral for that matter. (A normal residential
service entrance has three wires. Though it's described as
single-phase, it's really two phases derived from one phase of the
three phases in the distribution system. The three wires are for the
two phases and a neutral to carry the residual unbalanced load.
Normal 120V circuits are exposed to one phase and neutral, so
protecting the neutral from surges is just as important as protecting
the phases.)

>Actually it was probably induced in the lines outside the house and
>traveled in via the wires (another plus for the wireless and fiber networks).

You already followed up on this, but yes, I agree that it's a strong
point in favor of wireless or fiber for a LAN in lightning-prone
locations, with the advantage increasing with the distance from one
port to another. In my case, the isolation from the phone feed was
even greater than I indicated in my brief description, as the phone
line went to a modem (don't recall which it was POTS or ISDN at the
time) then to an old Mac running routing software under FreeBSD Unix
(this was before off-the-shelf routers came down to a reasonable
price), out another card to Ethernet, and the burnt out card was on
the near or far end of that cable (two occurrences).

>Current from a lighting strikes can actually travel through the
>ground for a surprising distance before completely dissipating.

Yes, in fact modern advice to hikers (or anyone caught outside in a
thunderstorm) is that ground currents are at least as much of a
danger as direct strikes. Thus the old advice to lie down in a ditch
is no longer operative; instead you are advised to crouch and
minimize your contact with the ground, and even to crouch on a
sleeping pad if available.

So I don't know exactly how the electrical field reached the
building. Possibly through the air, possibly as a result of ground
currents under the building, or even a combination.

This was in a mobile home, on piers (thus minimal ground contact) and
a metal roof, but very little metal in the walls or floor. A wire
grid in the walls, or aluminum siding, might create a partial Faraday
cage and protect from this kind of damage. (The fact that the body of
a car forms a Faraday cage is the reason that a car is a relatively
safe place to be in a thunderstorm.)

At 7/7/2009 12:54 PM -0700, David Ross wrote:
>If lightning hit 100 years away your entire house rode a wave of
>1000s of volts.

When you give voltages, you have to give the two points you are
measuring between. Voltage is relative. The voltage near the house
may have been thousands of volts relative to points half a mile away,
but the important voltage is the potential between two pieces of
equipment (where I use "equipment" in the most general sense, to
include power entrances etc as well as computers and appliances). The
farther apart two pieces of equipment are while this "wave" rolls
over, the more likely they are to have a large potential between
them. Your potential can be thousands of volts relative to something
distant, but it it's uniform on the things in question, no current
flows and no damage occurs. This is the principle of the Faraday
cage: no matter what the potential between inside and outside,
everything inside is at the same voltage and thus senses no potential.

Now of course I don't know the actual voltages present in my
incidents. I do know that lightning struck twice in nearly the same
place a couple of years apart, and that NICs on this same cable were
damaged both times, at opposite ends of the cable. And it was the
longest cable in the house by far. Nothing connected within the same
room was damaged. Nothing directly connected to phone lines or power
lines was damaged, not even the modem, which was connected to both.
Small sample with no real data, but suggestive.

>And your Ethernet card damage was most likely due to your internet
>service having a separate service entrance to your house from your
>power source. This allowed the voltage wave to enter your house at
>separate points and create a very short term very high voltage
>potential between various pieces of equipment.

As described above, the damage was on a rather isolated link, not on
anything electrically near the phone service entrance. And in any
case, my point was that voltage potentials can occur without a direct
wire link. Electrical fields exist in vacuums. Transformers work
based on electrical fields "communicating" from one winding to
another which is electrically insulated from the first. The
electrical field from the actual strike, or (as Kevin mentioned) from
ground currents, was likely the cause of this damage, and certainly
could have been. I could have had all phone line and power line
connecters unplugged and still could have suffered damage.

As Kevin said, this gives wireless and fiber networks a significant
advantage in lightning-prone areas. This is usually discussed in
terms of links that have to go outside, but it's possible to suffer
damage on purely inside links as well. In my case, if the link had
been wireless or fiber, there's a very good chance I would have had no damage.

Edward

On 11/07/2009 9:16 PM, "Al Varnell" <alvarnellmac.com> spake thus:

> [Anacron] Uses a few milliseconds to execute every hour.

True, but the jobs it executes may not. I stopped using anacron to fire off
my personal daily scripts because a couple of them put quite a load on the
machine (e.g., scanning/copying lots of files), which tended to make it
rather sluggish for a while after waking up. This annoyed me :), so I
activated "wake on LAN access" in Energy Saver. My DNS server (which is
always on) kicks it at 3AM to wake it up, it runs the daily scripts, then at
about 5AM it puts itself back to sleep. Of course, to do this you need at
least one machine that's always on.

--
Nigel Stanger

on 7/13/09 03:39, Nigel Stanger at nstangerinfoscience.otago.ac.nz wrote:

> I activated "wake on LAN access" in Energy Saver. My DNS server (which is
> always on) kicks it at 3AM to wake it up, it runs the daily scripts, then at
> about 5AM it puts itself back to sleep. Of course, to do this you need at
> least one machine that's always on.

Don't you also need a wired LAN? My experience is that this doesn't work on
WiFi LANs.
 
 
-Al-

On 14/07/2009 8:07 AM, "Al Varnell" <alvarnellmac.com> spake thus:

> Don't you also need a wired LAN? My experience is that this doesn't work on
> WiFi LANs.

No idea, actually. I've never had a wireless network (shock! horror! :) I
wouldn't be surprised, though.

--
Nigel Stanger

On Mon, 13 Jul 2009 13:07:54 -0700, Al Varnell wrote:
> on 7/13/09 03:39, Nigel Stanger at nstangerinfoscience.otago.ac.nz wrote:
>
>> I activated "wake on LAN access" in Energy Saver. Of course, to do this
you need at
>> least one machine that's always on.
>
> Don't you also need a wired LAN? My experience is that this doesn't work on
> WiFi LANs.

If you set your computer to completely shutdown then you also need a
switch that keeps its ports always on. I have several green gigabit
switches that power down ports where the computer is off. Unfortunately
this means wake-on-lan packets don't work. I have to set the computer
to go into sleep instead of power down or I can't wake them.

FYI, there is an app (of course) for the iPhone/Touch that can do wake
on lan. I actually use it more to wake up my sleeping computers than
the app on my mac or server.

Is there a log that will show nighttime activity the morning after? Will it show hacking attempts? John Massengale

On Jul 22, 2009, at 4:55 AM, John Massengale wrote:

> Is there a log that will show nighttime activity the morning after?
> Will it show hacking attempts? John Massengale

Open up Console.app and rummage through the various logs, which of
course will show nighttime activity if the machine is up during the
night (no need to worry about a shut down or sleeping machine). The
one to pay particular attention to for security is /var/log/secure.log.

Of course, if he cares to keep his entry secret a hacker is going to
clean out the logs as soon as he gains control of the machine. That's
why if you're really paranoid you duplicate log entries somewhere else.

--
Paul Schinder
schinderpobox.com

Le 09-07-22 à 13:15, Paul Schinder a écrit :

> On Jul 22, 2009, at 4:55 AM, John Massengale wrote:
>
>> Is there a log that will show nighttime activity the morning after?
>> Will it show hacking attempts? John Massengale
>
> Open up Console.app and rummage through the various logs, which of
> course will show nighttime activity if the machine is up during the
> night (no need to worry about a shut down or sleeping machine). The
> one to pay particular attention to for security is /var/log/
> secure.log.

I can not read the secure.log under «samba», as the three logs
(secure.log, secure.log.0.bz2 and secure.log.1.bz2) are grayed and a
message tells me that I do not have access to that History (in eng.,
historique in fr.).

On 23/07/2009 5:15 AM, "Paul Schinder" <schinderpobox.com> spake thus:

> Of course, if he cares to keep his entry secret a hacker is going to
> clean out the logs as soon as he gains control of the machine. That's
> why if you're really paranoid you duplicate log entries somewhere else.

Any suggestions on how to do this in a reasonably non-detectable way? The
easiest way to set this up is a cron job, but that's the sort of thing that
could be easily checked for, and poof, there go your duplicates as well.
Especially given that the duplication would have to probably have occur in
near real time to be of any actual use. Perhaps a background daemon of some
sort?

--
Nigel Stanger, Dunedin, NEW ZEALAND. http://xri.net/=nigel.stanger

On Jul 22, 2009, at 5:57 PM, Nigel Stanger wrote:

> On 23/07/2009 5:15 AM, "Paul Schinder" <schinderpobox.com> spake
> thus:
>
>> Of course, if he cares to keep his entry secret a hacker is going to
>> clean out the logs as soon as he gains control of the machine.
>> That's
>> why if you're really paranoid you duplicate log entries somewhere
>> else.
>
> Any suggestions on how to do this in a reasonably non-detectable
> way? The
> easiest way to set this up is a cron job, but that's the sort of
> thing that
> could be easily checked for, and poof, there go your duplicates as
> well.
> Especially given that the duplication would have to probably have
> occur in
> near real time to be of any actual use. Perhaps a background daemon
> of some
> sort?

Yeah, the traditional way is to use syslog's ability to log to a
remote machine. You set things up in /etc/syslog.conf to send to a
remote machine as well as local files. This at least requires the
cracker to crack two machines to hide his traces, and presumably your
loghost is kept more secure than J. Random Computer on the network.
It's easily detectable, though, since you just look in /etc/syslog.conf.

What you really want if you're paranoid is a write only file system,
where data once written can not easily be erased. I'm not sure if
such things exist (DVD's/CD's are close, but you want something that
will take continuous input without buffering). I can imagine setting
up permissions to mimic such a device, but what root can do root can
undo, and I assume a cracker will have root.

On 24Jul2009, at 05:26, Paul Schinder wrote:

> What you really want if you're paranoid is a write only file system,
> where data once written can not easily be erased.

Ahhh, for the Good Old Days when log entries were immediately printed
on a lineprinter, while the write-only media piled up in a basket (or,
more commonly, on the floor) behind the printer. Hack that!

--Ron

I remember some discussions about a log FS or lfs from the early 90's in BSD. I wonder if this could be used as a function for maintaining logfiles. I would expect this would not work, because the raw FS could still be manipulated to remove data. Here is one reference to this FS. http://www.hhhh.org/perseant/lfs.html I understand the only place this type of structure is used is in large flash memory systems, to reduce the cycle count. Jon

On Jul 24, 2009, at 10:47 AM, Ron Risley wrote:

> On 24Jul2009, at 05:26, Paul Schinder wrote:
>
>> What you really want if you're paranoid is a write only file system,
>> where data once written can not easily be erased.
>
> Ahhh, for the Good Old Days when log entries were immediately
> printed on a lineprinter, while the write-only media piled up in a
> basket (or, more commonly, on the floor) behind the printer. Hack
> that!

Wow, I had forgotten all about that! Coming in to find that the paper
had run out overnight, or that the paper had jammed and multiple
console messages had overtyped each other, or that the ribbon had
given out and maybe, if you were lucky, you could read the impressions
on the paper.

Old Days, for sure, but I'm not sure I agree about the Good.

>
> --Ron