What are useful Command-line Commands on Mac OS X?

Question

Per the Windows and Linux threads, what commands do you find most useful in Mac OS X Server (or Client)?

Answer 1

say "some text"

Famously used for getting people back into their apartments, say takes your arguments and reads them aloud through the audio output device.

Answer 2

pbpaste and pbcopy to interact with the pasteboard (aka clipboard).

Examples:

# copies the directory listing
ls -l | pbcopy

# get pasteboard lines containing foo and save them in a_file
pbpaste | grep foo > a_file

I think they default to using the macroman encoding, so if you want UTF-8 (which you do) you should check out these links:

• http://sigpipe.macromates.com/2005/10/11/clipboard-access-from-shell-utf-8/
• http://www.macosxhints.com/article.php?story=20081231012753422&query=pbpaste

Answer 3

fs_usage

Lets you monitor file system activity. Handy if you want to see what files some app creates. See http://rentzsch.com/macosx/fs_usageIntro for more explanation.

Answer 4

open .

Opens a finder window in the current working directory.

Answer 5

From the command line, I like having the ability to:

Create and burn a "universal" CD/DVD:

$ mkisofs -allow-multidot -allow-leading-dots -d -hide-rr-moved \
-l -joliet-long -R -T -v \
-V VOLUME_NAME -o output.iso root-cd-dir/
$ hdiutil burn -noverifyburn output.iso

Create an ISO image from a CD/DVD:

$ diskutil unmountDisk /dev/disk2s0
$ dd if=/dev/disk2s0 of=cdname.iso bs=32m

Being able to forget the otool command when I'm seeking ldd:

$ alias ldd='printf "Sending command to \'\''otool -L\'\'' --\n" && otool -L'

Mount a disk image from the command line:

$ hdid diskimage.dmg (or .iso)

Use preview to access a man page:

$ man -t rsync | open -f -a /Applications/Preview.app

Answer 6

The 'airport' CLI utility is my favorite. See http://osxdaily.com/2007/01/18/airport-the-little-known-command-line-wireless-utility/. It will show you details like the signal level, noise level, and the BSSID of the AP you're associated to.

Answer 7

drutil tray open

Invaluable (over ssh) when there's no keyboard connected since the eject button on Apple optical drives isn't accessible from outside the case.

Answer 8

It can't be said enough, "open" is great. You can open documents in their GUI program and you can select the GUI program with -a as well. For example,

open -a vlc movie.avi

will open VLC and tell it to load movie.avi in your current dir.

open movie.avi

would open it with whatever program is the default. If you just want to open a program, you can do that too:

open -a system\ preferences

will run System Preferences. You can open Urls too:

open vnc://myserver:5900

will open Screen Sharing and connect to myserver.

Check out

man open

to see all flags you can use.

Answer 9

ipconfig getpacket en0

Displays network configuration for the primary Ethernet interface (en0).

If you're used to Windows and think "ipconfig" is broken - it's not ;-) You just need to add a couple arguments

Answer 10

softwareupdate

Update your mac from the CLI.

Answer 11

networksetup

Configure everything you find in the Network Preference Pane in System Preferences on the command line. Makes writing scripts, or doing things remotely much easier.

Answer 12

sudo changeip -checkhostname

Checks that forward and reverse DNS resolution are healthy, and often shows you the command you can use to fix the problem. If it says "the names match, there is nothing to change" you're in good shape. Vital if you ever change your server's network configuration. Also important to use this before you promote your server to an Open Directory Master.

Answer 13

dscacheutil -flushcache

I find myself using that one heaps to flush the DNS cache, on 10.5+.

Answer 14

last

shows who has logged into a system, how long they used it, and when the system has been restarted.

Here is a sample of the output:

clinton   ttys000                   Thu May 28 22:33   still logged in
clinton   console                   Thu May 28 08:05   still logged in
reboot    ~                         Thu May 28 08:05 
shutdown  ~                         Wed May 27 20:15 
clinton   console                   Wed May 27 17:33 - 20:15  (02:42)
...

wtmp begins Thu May 14 09:26 

Answer 15

srm

Command line version for secure delete.

Answer 16

 lsof

list open files

Handy when you want to eject your USB drive and are told that it is in use and to please quit all applications and try again.

$ sudo lsof /Volumes/CLINTON
COMMAND   PID    USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
bash    55966 clinton  cwd    DIR  14,12    16384    2 /Volumes/CLINTON
lsof    56042    root  cwd    DIR  14,12    16384    2 /Volumes/CLINTON
lsof    56043    root  cwd    DIR  14,12    16384    2 /Volumes/CLINTON

In this instance, I had cded onto the drive and so bash was accessing the volume.

Note that if you see 'mds' entries, it means that spotlight is indexing the drive.

Answer 17

ping 224.0.0.1

Ping all devices on your subnet

Answer 18

The Command-Line Administration guide put out by Apple is invaluable.

Googling for "command line administration mac" gives good results.

Command-Line Administration for Mac OS X 10.5, 10.4, and 10.3.

Other useful guides are at http://www.apple.com/server/macosx/resources/.

Answer 19

osascript -e 'tell application "AppName" to quit'

Lets you quit an application from the shell.

osascript -e 'tell application "Finder" to sleep'

Useful last line of a long shell script, puts Mac to sleep when script is done. I have it aliased to iSleep.

pbpaste | script.sh |pbcopy

takes contents of pasteboard (edit->copy) and pipes it to script.sh. The results are put onto the pasteboard for you to edit->paste into a document.

Answer 20

http://www.commandlinefu.com

While not specifically a Mac resource, it is using the icon for the Terminal, and most of the list of really useful commands will work.

Answer 21

mcxquery

this will let you see what sort of MCX (Managed Client) settings are being applied to a client machine.

[The GUI equivalent is to go to System Profiler, and, under the Software section, click on "Managed Client".]

It is useful to determine if a machine is managed and to see if it is getting the settings you expect.

Answer 22

sw_vers

Displays the currently installed version and build of Mac OS X.

Answer 23

df -h

To check how many disk space I currently have on all the disk.

Answer 24

sudo opensnoop

in Leopard and newer, reports which processes open files, whether successfully or not. You can ask it to look at all files being opened across the system, by a specific process, or if any process is opening a given file, with different sorts of timestamps, and to show if errors occur.

Here are some more details:

• opensnoop (Mac file open watcher)
• Hidden Gems In Leopard: OpenSnoop

opensnoop is a dtrace script; there are many others in /usr/bin that look at things like which system calls a process is making, what processes it is creating and what I/O it is doing. Run apropos DTrace for a list, and look at man pages for details.

---

I found out about opensnoop when struggling to diagnose why a Comic Life Magiq 1.1 was crashing on OS 10.5.8 for users with network accounts.

I ran (several times, on different accounts, via ssh):

sudo opensnoop -e -n Comic > output.txt

The last file opened by network users was something like this (with a full path):

/Network/Servers/.../username/Library/Icons/WebpageIcons.db

which reminded me that Safari 5.0 was crashing for network users, and we worked around it by either managing a preference to not cache favicons or by redirecting a file. Apple apparently fixed the issue in Safari 5.0.1, and when I upgraded to Safari 5.0.2 yesterday, it fixed the crash for Comic Life Magiq users.

Answer 25

dns-sd -B _ssh
dns-sd -B _rfb
dns-sd -B _services._dns-sd._udp

List servers advertising in Bonjour. The last suggestion lists the types of service that you can list. The listing is live, hit Ctrl-C when you've seen enough.

The same command comes in recent Linuxes and in the Bonjour SDK for Windows.

Answer 26

opendiff file1 file2

Runs FileMerge (a graphical diff that comes with Apple Developer Tools) on file1 and file2.

Answer 27

system_profiler

Give you the same results as you get when you choose About This Mac -> More Info, only on the command line.

Running

system_profiler -usage

or looking at the man page will give you tips on how to use it.

A couple of examples:

system_profiler -xml > MySystem.spx
# and later,
open MySystem.spx  # or just double click on it in the Finder

this will dump the system profile to a file which can be looked at later on a different machine.

system_profiler SPUSBDataType

Tells you about all your USB devices (including their Vendor and Product IDs, which can aid in tracking down drivers).

system_profiler SPUSBDataType | grep "Product ID" -c

will tell you how many USB devices are plugged in (including internal USB devices), which is useful to see if the computer sees a device (or, if, say, Parallel's grabbed it or it is dead.) [Do note that in the System Profiler GUI App, you can choose View -> Refresh from the menu to update the list; that may just be easier.]

system_profiler SPHardwareDataType

will get you basic hardware info (useful for asset tracking), and

system_profiler SPHardwareDataType | grep Serial

will give you the machine's serial number.

Answer 28

ifconfig en0 ether 00:00:00:00:00:00

Changes (spoofs) MAC address until next reboot

Answer 29

drutil eject

will eject a CD.

Answer 30

Truly Mac only: I saw 'open .' above, but open will open any document or app you pass to it.

Generic Unix that I use the most: sudo is pretty handy for changing system config files, etc, which I actually edit in vi.

kill can't be overstated when something hangs (or when another user is still logged into my desktop in the background and I want to log them out, nasty I know but it's my desktop)

ssh/scp - I love that in OSX I can just open a terminal and connect to any of our servers. That alone made me happy to drop Windows.

ifconfig/ping/whois/nmap etc

Answer 31

lsof -i 

lists Internet ports that are open. Sample output:

COMMAND     PID    USER   FD   TYPE    DEVICE SIZE/OFF NODE NAME
SystemUIS   223 clinton   11u  IPv4 0x3e21b08      0t0  UDP *:*
ARDAgent    262 clinton   16u  IPv4 0x3e21be0      0t0  UDP *:net-assistant
ARDAgent    262 clinton   18u  IPv4 0x5f01a68      0t0  TCP *:net-assistant (LISTEN)
AppleVNCS   263 clinton    4u  IPv6 0x3e274bc      0t0  TCP *:vnc-server (LISTEN)
Opera     48365 clinton   20u  IPv4 0x5f01e64      0t0  TCP WTD-Staff-BlackmoreC:57094->stackoverflow.com:http (ESTABLISHED)
Opera     48365 clinton   23u  IPv4 0x5b12a68      0t0  TCP WTD-Staff-BlackmoreC:57095->stackoverflow.com:http (ESTABLISHED)

Use sudo if you want the ports open by all users, and the flags -n and -P will disable name resolution and port names and give you numbers instead.

Answer 32

If you want to know what sort of line endings a file has, just run

file /path/to/your-file

ex:

$ file imports/sample-students.txt 
imports/sample-students.txt: ASCII text, with CR line terminators

Answer 33

scutil --dns

Will display the order for DNS resolution. Useful for when you're creating or debugging your Network settings.

Answer 34

sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -restart -agent

Starts the Remote Desktop service (useful if you only have SSH access but want to do something using the GUI on your client Mac). For more options, see: http://support.apple.com/kb/HT2370

Answer 35

ipconfig is sometimes useful:

Getting current IP address on interface:

$ ipconfig getifaddr en1
10.110.2.25

Getting the DHCP information that was last received:

$ ipconfig getpacket en1
op = BOOTREPLY
htype = 1
flags = 0
hlen = 6
hops = 0
xid = 143857879
secs = 0
ciaddr = 0.0.0.0
yiaddr = 10.110.2.25
siaddr = 0.0.0.0
giaddr = 0.0.0.0
chaddr = 00:aa:bb:cc:dd:ee
sname = 
file = 
options:
Options count is 7
dhcp_message_type (uint8): ACK 0x5
server_identifier (ip): 1.1.1.1
lease_time (uint32): 0xe10
router (ip_mult): {10.110.0.1}
domain_name_server (ip_mult): {1.1.1.1, 1.1.1.2}
subnet_mask (ip): 255.255.252.0
end (none): 

Answer 36

This question overlaps quite a bit with this one about tools a UNIX administrator cannot live without. Many of the command-line tools for Mac OS X have UNIX roots, such as df, du, and which; however there are notable exceptions that have no obvious UNIX equivalents, such as osascript, open, pbcopy, pbpaste, and say.

Answer 37

How to enable Time Machine to backup to a NAS.

defaults write com.apple.systempreferences TMShowUnsupportedNetworkVolumes 1

Find MAC address

ifconfig en0 | grep ether | sed s/://g | sed s/ether//

Command to create sparsebundle to copy over to NAS

sudo hdiutil create -nospotlight -library SPUD -size 160g -fs "Case-sensitive Journaled HFS+" -type SPARSEBUNDLE -volname "<VOLNAME>" ./<HOSTNAME>_<MAC_ADDRESS>.sparsebundle

Works like charm backing up to my ReadyNAS.

Answer 38

I just found out that there's a nifty bash construct that you can use instead of the seq command missing in Mac OS:

echo { 18..21 }

Answer 39

Apart from the usual Unix suspects I find the following useful :-

• dsconfigad - Edits the Active Directory settings and binds a computer

• defaults - Edit preferences

• plutil - Converts plist to and from text

• softwareupdate - run Software Update from the command-line

• installer - install packages from the command-line

• networksetup - set and get various things such as the computer name

If you master those and the usual Unix stuff you have all you need for Mac administration from the command-line.

Answer 40

It is a freeware third-party tool, but

edit

is really handy. It is a command-line tool that you can optionally install the first time you run TextWrangler. [Other text editors (BBEdit, TextMate) likely provide something analogous.]

edit path/to/somefile

Opens up the file in TextWrangler, and will let you authenticate if you don't normally have permission to edit it. (You can even do it from an ssh session, and it'll open it for the logged-in graphical user).

Better still is that you can pipe things to it.

lsof -i | edit

for example, will show you your open network connections and open them up in TextWrangler, where you can search (and scroll) through them easily.

Answer 41

A bit pedestrian for this audience, no doubt, but I use:

screencapture -i -c

to grab whatever I want from the screen It's really handy and does things that Grab won't allow me to grab.

Answer 42

Gain a root shell without enabling the root user (as Apple itself requires sometimes in their docs in order to do some "geeky" stuff, ie to set system-wide language)

sudo bash

This gives you a root shell where you can do everything you want as root, without having to prepend every command with the sudo command.

This may be dangerous, but we are sysadmins, we know what we are doing, don't we? :)

Answer 43

killall -9 appname force quits an app. Pretty useful if you can't get into Activity Monitor.

Answer 44

ifconfig | grep cast

is great for getting your IP address, and

ifconfig en1 | grep eth

works well for getting a MAC address.  Using en1 will (almost always) get the Airport's MAC address, which is handy if only known devices are allowed onto your wireless network.  Conversely, if you use en0 -- the built-in ethernet port -- you can then look the machine up in your Open Directory, like so:

ldapsearch -x -h odm -b "cn=computers,dc=odm,dc=pretendoco,dc=com" "macAddress=00:0d:93:b5:82:88"

(Assuming your server was 'odm' and the realm is ODM.PRETENDCO.COM).

Answer 45

 which program

searched the path for program, and tells you which executable is invoked if you run program without specifying a full path.

It is usually most useful as a shorthand for typing a path.

$ which python
/usr/bin/python
$ ls -l `which python`
lrwxr-xr-x  1 root  wheel  72 30 Jan 22:56 /usr/bin/python -> ../../System/Library/Frameworks/Python.framework/Versions/2.5/bin/python

Answer 46

These are basic, but handy if you have amnesia:

Who am I?

id

Where am I standing?

pwd

What building am I?

hostname

What's its address?

ifconfig |grep inet

Answer 47

OS X specific things I haven't seen mentioned:

mdfind uses the Spotlight search indexes from the commandline, so you can do full-text searches without using the Search pulldown.

networksetup - will show you all the crazy syntax it supports; this is the commandline equivalent of the Network preference pane.

sudo launchctl list - shows the running launchctl jobs. remember launchctl stop X.XX.X will just 'stop' (kill) the currently running instance of a persistent process; to really make it stop running use launchctl unload /System/Library/LaunchDaemons/X.XX.X.plist.

Answer 48

What DHCP licenses does the client hold?

sudo ls -lt /private/var/db/dhcpclient/leases

List the firewall allow/denies:

sudo ipfw list

Generate a high-entropy password (double click on a promising 16 character string to copy/paste):

head -c90 /dev/random | uuencode -m pwd | hexdump -C

Answer 49

Ever wanted to know what the IP address of another Mac that you can see is in the Finder is on your LAN thanks to Bonjour?

dscacheutil -q host -a name OtherMac.local

dscacheutil is surprisingly useful and versatile. You can do a lot more with it than just flush the DNS cache (as mentioned elsewhere here), i.e. user lookups and cache stats and dumps.

Answer 50

sqlite3 foo.db

Starts an interactive SQLite session. If foo.db does not exist, it will be created.

Answer 51

du -d 1 -h

Displays disk usage statistics for the current directory in human readable form.

man [command]

One of the most used commands. Tells you how to use everything else.

Answer 52

sudo slapconfig -destroyldapserver

Force Demote an LDAP Replica to Standalone. If your Open Directory Master is misconfigured, sometimes trying to demote an Open Directory Replica using Server Admin will fail (eg: you might find your Replica server refuses to demote). You can use slapconfig to force it to demote on these occasions.

Answer 53

locate "foo"

Displays any file on your system with "foo" in its filename. I must use this almost as often as I use Spotlight.

Answer 54

 sudo reboot

reboots the computer.

Answer 55

Maybe not the most "useful" command but say is pretty fun.

For example say I love serverfault to have it read back what you type after "say."