system_profiler - gathering hardware/software configuration

Another useful command line tool, system_profiler reports detailed information about the hardware and software configuration of the Mac.

It reports the same information you can find in the Apple menu / About This Mac / More Info dialog.

One of the things that makes it so useful is that you can look at the configuration of a system you are connected to remotely, like through a secure shell connection.

There are three details levels available:

• mini - report with no personal information
• basic - basic hardware and network information
• full - all available information

You select which detail level by passing it using the -detailLevel switch. For example:

system_profiler -detailLevel mini

If no detail level is passed, the default level is full.

Because it generates so much information, you typically pass the output to the "less" utility, redirect it to a text file for browsing, or filter out what you are looking for using "grep".

Enable/disable Fast User Switching from the command line

To enable fast user switching, use the defaults command from the terminal:


defaults write /Library/Preferences/.GlobalPreferences MultipleSessionEnabled -bool YES


To disable fast user switching:


defaults write /Library/Preferences/.GlobalPreferences MultipleSessionEnabled -bool NO


Apple System Logger

Despite appearances, the system logging facility is unique on OS X 10.4 and newer. The syslogd daemon used on most Unix-like operating systems was replaced with the Apple System Logger (ASL).

Instead of using a new program name, Apple just used the traditional Unix system logger name. I think this can be a source of confusion and was not a great decision.

Binary Logs, then Text Logs

Instead of logging everything to text log files in /var/log, ASL logs all messages to a binary database file, /var/log/asl.db. From there, certain messages are written to the more familiar text based logs based on settings in /etc/syslog.conf.

In a way, Apple hacked the syslogd process, but did so in a way that maintains some level of backward compatibility with the knowledge and tools of system administrators coming from other Unix-like systems. I admit I was quite surprised to find out how this mechanism has been implemented by Apple.

The binary asl.db database is cleaned periodically, removing older messages from the database and keeping it from growing indefinately. The text based logs are still compressed and rotated as usual.

Reading log files

You can use the GUI utility, Console.app, to browse the Apple binary log database. It has a nice case insensitive search ability.

The command line interface to the Apple binary log is syslog.

Entering syslog with no parameters dumps the entire database. You can pipe the output through a grep command looking for a text string. For example,

syslog | grep Error

returned a large number of errors showing someone trying to login to my system via SSH as root:

Sat Dec 20 16:18:42 white com.apple.SecurityServer[22] : checkpw() returned -2; failed to authenticate user root (uid 0).

Yikes! Not to worry, when remote logins (SSH) are enabled, the default configuration does not allow root logins. According to the man page, you can also search for particular keys in the database using the -k option. Unfortunately, the list of valid keys is not in the man page.

Logging from a script

Finally, you can send a message to the log file using the -s parameter. Messages in the traditional syslog system are categorized by severity, or log level:

Emergency (level 0)
Alert (level 1)
Critical (level 2)
Error (level 3)
Warning (level 4)
Notice (level 5)
Info (level 6)
Debug (level 7)

To send a Warning message, use:

syslog -s -l 4 "this is a warning"

produces this in the log:

Sat Dec 20 18:42:29 white syslog[40323] : this is a warning


Disabling hardware via kernel extensions

You can disable hardware components in OS X by deleting (or renaming) the kernel extension directory that contains the driver for that piece of hardware.

Kernel extensions are stored in subdirectories in /System/Library/Extensions.

In some cases, there is more than one driver involved, so you need to delete or rename multiple directories.

Drivers for AirPort wireless:

• AppleAirPort.kext
• AppleAirPort2.kext
• AppleAirPortFW.kext

Drivers for Bluetooth wireless:

• IOBluetoothFamily.kext
• IOBluetoothHIDDriver.kext

Drivers for external mass storage (external hard disks or USB keys):

• IOUSBMassStorageClass.kext
• IOFireWireSerialBusProtocolTransport.kext

You may have delete or rename the directories again after a system update because an update may restore the drivers. After removing the drivers, reboot to make sure the hardware is disabled.

Another way to enable and disable root

I stumbled across another way to enable and disable root. There is a program called dsenableroot that can be used to both enable and disable the root account.

The full path is /usr/sbin/dsenableroot and you must be an admin level user to run it. In both cases, you will be prompted for your own user password. When root is enabled, you are prompted to set the root password.

This sequence enables root:

dsenableroot
username = keithw
user password:
root password:
verify root password:

dsenableroot:: ***Successfully enabled root user.


This sequence disables root:

dsenableroot -d
username = keithw
user password:

dsenableroot:: ***Successfully disabled root user.


I generally like to have root enabled. Here is my older post on enabling root.

Power settings from the command line

By request, I did a little digging to find out how to view and set power settings from the command line.

The command to use is pmset.

Instead of inventing the wheel again, please see this most excellent article at University of Utah.

Speeding MacBook 802.11g connections

My wife got a new MacBook a few weeks ago and was complaining of slow 802.11g wireless speeds at home. Normal troubleshooting went nowhere. Configuring the access point a little differently improved the situation.

My wife took the MacBook into an Apple store and diagnostics were run on it showing no connection or performance issues. At home, it was still slow. This was odd because I have a slightly older MacBook and an even older Linux laptop working fine on the same wireless network.

I searched the Interwebs and found a post on an Apple related forum, forget where now, that suggested Macs liked Channel 11 on 802.11g networks.

With nothing to lose, I logged into the LinkSys access point and changed it to listen on Channel 11 (2.462 Ghz) by default. After this change, the new MacBook wireless performance was much better. I have no idea if there is some affinity for Channel 11 in Apple's hardware or software stack, or if there is less interference on that frequency, or if there is some other explanation. In any case, I thought it was worth sharing.