Mysterious Time Machine control problem

Discussion in 'macOS' started by THX1139, Jan 1, 2010.

  1. THX1139 macrumors 68000

    THX1139

    Joined:
    Mar 4, 2006
    #1
    Okay, this is weird problem, so bear with me.

    Back when I first updated to Leopard and decided to give Time Machine a try, I didn't like that TM did it's backups every hour. For me, it was overkill so I went about trying to find a solution. When TM first came out there wasn't a lot of options to control it, but I did find a couple of solutions. One was to create a script in automater then control it with an iCal event. The one I wound up using was to create a crontab (I think I used Lingon) to change the backup times for Time Machine. I set it up to backup at noon, 6PM and midnight, then let it go. Over the year or so it has been doing it's job faithfully with only a couple of errors (but those are unrelated to this post).

    Last week, I bought a new hard drive to update my computer to Snow Leopard and do a fresh install of all of my programs. I zeroed out the drive and did a total fresh install of Snow Leopard. The only thing I brought over from my old drive was my files, a copy of keychain, and an exported iCal. Pretty much everything is fresh and it took me a couple of days to tweak it. Here's where the problem comes in. I'm getting time machine errors saying the backup drive can't be found. I haven't even setup Time Machine yet!! Seems that something on the root system is firing off that old cron job that I setup way back when. I checked to see if I could find where it was coming from but no luck. I even reinstalled Lingon thinking the job would show up there and I could delete or change it, but nothing shows up in the panel. Of course, Lingon has been discontinued and might not be compatible with SL, so that might be part of the problem. Anyway, I also checked Launchd plist and it shows the default of 3600 for Time Machine. The TM error shows up on my old backup times so I know it's from my old script. The error happens at noon, 6 and midnight.

    I don't understand how the script is controlling Time Machine when I did a reformat of the drive. How did an old sub-routine make it over to a newly reformated drive? That tells me that the job must be embedded somewhere or it managed to get on to the reformatted drive when I copied my files over.

    How can find this script or cron job or whatever is causing Time Machine backup to run? I could try reformatting again but I don't want to spend the time doing that, and I'm not sure it will fix it. Surely there is a command or something I can do in terminal or other piece of software that will track this down? Resetting Time Machine (it's currently turned off) is not going to make a difference. Nor is looking at the backupd.plist file because that is also at the default. I need to find the agent that is telling TM to run at those special times so that I can turn it off. My hope it to create a new launchd control with Time Machine editor and have a different backup solution.

    Thanks for reading!
     
  2. chown33 macrumors 604

    Joined:
    Aug 9, 2009
    #2
    launchctl list

    sudo launchctl list

    http://developer.apple.com/mac/library/documentation/Darwin/Reference/ManPages/man1/launchctl.1.html

    This assumes there is an actual launchd agent or daemon that's triggering your backupd. If you brought your files over, then it's possible you also brought the triggering agent/daemon.

    If it's not an agent/daemon, then maybe it's a per-user crontab. It might be one of your files, possibly with an initial "." so it wouldn't appear in Finder. You could try the 'crontab' command. See 'man crontab' or this web page:
    http://developer.apple.com/mac/library/documentation/Darwin/Reference/ManPages/man1/crontab.1.html
     
  3. THX1139 thread starter macrumors 68000

    THX1139

    Joined:
    Mar 4, 2006
    #3
    Thanks for your informative reply, but I'm afraid that I'm still confused. I don't know how to run those commands and the website you provided assume you know the basics. They give the commands and what they do, but they don't provide the correct syntax to put in terminal. My experience with terminal is limited to cut and paste commands to do certain things. I'm not brave enough to just go in there and try different things.

    I did a search on my drives with Dreamweaver (it shows invisible files/folders). I was looking for the launch daemon control so that I could see if it was calling the time machine backup. I went through my system library and my user library and I couldn't find it. I found the timemachine.plist and backdup.plist but not the actual launched control.

    I'm at the point were I have 3 choices. 1. Live with the settings and get a new drive that time machine can backup to stop the errors. 2. Spend a couple of days to reinstall the software. Spend a week or year learning Unix and Terminal. Right now, I'm considering options 1 or 2.

    If I could just find the damn launchd control, that would go along way of solving the problem. I'm almost positive that the answer.

    Thanks again
     
  4. Detrius macrumors 68000

    Joined:
    Sep 10, 2008
    Location:
    Asheville, NC
    #4
    My take on this is that the setting causing the problems is somewhere in your user directory, especially since you explicitly said that it's an automator control triggered by iCal. Figure out where it is in iCal, and you can turn it off.

    btw, this has nothing at all to do with Mac programming.
     
  5. THX1139 thread starter macrumors 68000

    THX1139

    Joined:
    Mar 4, 2006
    #5
    Right... but where else to put this message? I kind of thought that programmers would have a better idea of how to fix it than the regular mac folks in the other threads. Got your attention didn't it?

    Oh, and by the way... I'm pretty sure it's NOT an iCal even because the automator scripts was deleted a long time ago. I've since setup new calendars. I'm almost regretting bringing that up. Pretty sure it's a launchd that's running a cron job. Haven't found it yet :mad:
     
  6. chown33 macrumors 604

    Joined:
    Aug 9, 2009
    #6
    You asked for Terminal commands without describing your relevant experience level. I gave Terminal commands accordingly. When you want copy-and-paste Terminal commands suitable for someone with little experience, please state that.

    First, find out if it's a crontab. Copy and paste this into Terminal:
    Code:
    crontab -l
    
    If it says there's no crontab, then it's not due to a crontab for your user account. If it says anything else, post the output.

    Second, if it's not a crontab, it might be some other launchd task. I know of no way to learn what launchd is doing except by using launchctl.

    Copy and paste this into Terminal:
    Code:
    launchctl list
    
    Post the output.


    The launchd control is the 'launchctl' command. There is no other "launch daemon control", as you seem to think. Everything that launchd does is built into its code. This includes scanning directories for jobs defined by plists.

    There may be an app or prefpane that gives a graphical interface to launchctl. I don't know of any, but I've never looked very hard. I just use the command-line.

    The best references I know of on launchd are the Wikipedia article, the relevant man pages, and TN2083.

    http://en.wikipedia.org/wiki/Launchd

    http://developer.apple.com/mac/library/documentation/Darwin/Reference/ManPages/man8/launchd.8.html
    http://developer.apple.com/mac/libr...st.5.html#//apple_ref/doc/man/5/launchd.plist
    http://developer.apple.com/mac/libr...nchctl.1.html#//apple_ref/doc/man/1/launchctl

    http://developer.apple.com/mac/library/technotes/tn2005/tn2083.html
     
  7. THX1139 thread starter macrumors 68000

    THX1139

    Joined:
    Mar 4, 2006
    #7
    Sorry for the confusion

    When I pasted the code into terminal from my user account (it has admin privileges), nothing happened. I logged into my admin account and pasted the code there. Here's what I got:

    0 0 * * * /System/Library/CoreServices/backupd.bundle/Contents/Resources/backupd-helper
    0 18 * * * /System/Library/CoreServices/backupd.bundle/Contents/Resources/backupd-helper
    0 12 * * * /System/Library/CoreServices/backupd.bundle/Contents/Resources/backupd-helper
    45 0 * * 6 /usr/local/clamXav/bin/clamscan -r --log="/Users/Primary/Library/Logs/clamXav-scan.log" --no-mail "/Users/Primary/Desktop/index.html"

    From my user account:

    Alan-Wilsons-Mac-Pro:~ wilson$ launchctl list
    PID Status Label
    3447 - 0x1002029e0.anonymous.launchctl
    3444 - 0x100202720.anonymous.bash
    3443 - 0x100101110.anonymous.login
    3430 - [0x0-0x1b81b8].org.lingon.Lingon
    3417 - [0x0-0x1b71b7].com.apple.Terminal
    3406 - 0x100410fc0.anonymous.UserNotification
    3401 - 0x1005000f0.anonymous.WebKitPluginHost
    3396 - [0x0-0x1af1af].com.apple.Safari
    3385 - [0x0-0x1ad1ad].com.apple.iTunesHelper
    3383 - [0x0-0x1ab1ab].com.micromat.TechToolProDaemon
    - 0 0x100203500.mach_init.rcd
    - 0 org.x.startx
    - 0 org.openbsd.ssh-agent
    - 0 edu.mit.Kerberos.KerberosAgent
    3400 - com.apple.WebKit.PluginAgent
    - 0 com.apple.warmd_agent
    - 0 com.apple.VoiceOver
    3372 - com.apple.UserEventAgent-Aqua
    - 0 com.apple.unmountassistant.useragent
    - 0 com.apple.tiswitcher
    3358 - com.apple.SystemUIServer.agent
    - 0 com.apple.syncservices.uihandler
    - 0 com.apple.syncservices.SyncServer
    - 0 com.apple.SubmitDiagInfo
    - 0 com.apple.ServerScanner
    - 0 com.apple.scrod
    - 0 com.apple.ScreenSharing.server
    - 0 com.apple.ScreenReaderUIServer
    - 0 com.apple.ReportPanic
    - 0 com.apple.ReportCrash.Self
    - 0 com.apple.ReportCrash
    - 0 com.apple.RemoteUI
    - 0 com.apple.RemoteDesktop.agent
    - 0 com.apple.quicklook
    - 0 com.apple.PubSub.Agent
    - 0 com.apple.PreferenceSyncAgent
    - 0 com.apple.pictd
    - 0 com.apple.PCIESlotCheck
    - 0 com.apple.pbs
    3364 - com.apple.pboard
    - 0 com.apple.parentalcontrols.check
    - 0 com.apple.NetworkDiagnostics
    - 0 com.apple.netauth.useragent
    - 0 com.apple.midiserver
    - 0 com.apple.metadata.mdwrite.plist
    - 1 com.apple.Kerberos.renew.plist
    - 0 com.apple.isst
    - 0 com.apple.installd.user
    - 0 com.apple.imklaunchagent
    - 0 com.apple.helpd
    - 0 com.apple.FontWorker
    - 0 com.apple.ATS.FontValidatorConduit
    - 0 com.apple.ATS.FontValidator
    - 0 com.apple.FontRegistryUIAgent
    3361 - com.apple.fontd
    3359 - com.apple.Finder
    - 0 com.apple.familycontrols.useragent
    3357 - com.apple.Dock.agent
    - 0 com.apple.DictionaryPanelHelper
    - 0 com.apple.coreservices.uiagent
    - 0 com.apple.coremedia.videodecoder
    - 0 com.apple.CoreLocationAgent
    - 0 com.apple.coredata.externalrecordswriter
    - 0 com.apple.BezelUIServer
    - 0 com.apple.AOSNotification
    - 0 com.apple.alf.useragent
    3378 - com.apple.AirPortBaseStationAgent
    - 0 com.apple.AddressBook.abd
    - 0 com.adobe.CS4ServiceManager
    3318 - 0x1002039d0.anonymous.WindowServer
    26 - 0x100203230.anonymous.securityd
    3317 - 0x100402970.anonymous.loginwindow
    - 0 com.apple.launchctl.Aqua
    87 - 0x100201220.anonymous.coreservicesd
    3384 - edu.mit.Kerberos.CCacheServer
    - 0 com.apple.TrustEvaluationAgent
    - 0 com.apple.KerberosHelper.LKDCHelper
    - 0 com.apple.gssd-agent
    - 0 com.apple.FileSyncAgent
    - 0 com.apple.datadetectors.compiler
    - 0 com.apple.cvmsCompAgent_x86_64
    - 0 com.apple.cvmsCompAgent_ppc
    - 0 com.apple.cvmsCompAgent_i386
    - 0 com.apple.launchctl.Background


    I see that Lingon is on the list, but I haven't used it to modify anything on this new install. I did install it to see if I could find the crontab that might be firing off the backup in TM.

    Thanks for the references. I'll have to read up on those later when I'm not so busy. Right now, I'd just like to get this issue fixed. I really appreciate you help!
     
  8. chown33 macrumors 604

    Joined:
    Aug 9, 2009
    #8
    By "nothing happened" do you mean there was no output at all, or that the output said there was no crontab for that user? Those are two different things.

    Exactly what do you mean by your "admin account"? If your everyday user account has admin privileges, i.e. it's a member of the admin group, then why do you need an "admin account"? Do you perhaps mean "root account"?

    When you're logged into this "admin account", what does the output of this command say?

    Code:
    id
    Post that output. Also post the output of the 'id' command executed from your "user account".


    The above shows backupd-helper scheduled to run at 0:00, 18:00, 12:00 of every day, i.e. midnite, 6 pm, and noon. It also shows clamscan scheduled to run at 45 minutes past midnite on Saturdays (day 6).

    The next step here is to figure out exactly which account the above crontab belongs to. I can't tell based on your calling it your "admin account", because that could mean several different things. The output from the 'id' command should identify the user id, so until that's posted I'm not going to speculate.



    The next thing to do here is to find where that launchd task's plist is located. It might or might not be called "org.lingon.Lingon.plist". It might be located in any of these places:

    /Library/LaunchAgents/
    /Library/LaunchDaemons/
    ~/Library/LaunchAgents/

    The first 2 refer to your boot drive's Library/Launch* folders. The 3rd is your home folder's Library/LaunchAgents folder.

    Once you find the plist file, post where you found it and also post its XML content. You should be able to drag the file onto TextEdit.app to open it, then copy and paste it into a post.

    DO NOT attempt to do anything with this file once you find it. Do not move, delete, rename, or anything else. Simply post its exact path and its XML content for now.

    If you can't find the plist, then simply post that you can't find the plist.


    EDIT: Explanation.

    There are two distinct things happening. First, there is definitely a crontab that is triggering Time Machine to perform a backup. Second, there is definitely an org.lingon.Lingon launchd task (a.k.a. launchd job) that is active. I can tell it's active because it has a pid (process ID), which means it was actually running when the 'launchctl list' command was issued.

    These two things may be coupled. The Lingon launchd job may try to re-establish the crontab tasks if the crontab tasks are simply removed. This is why I asked for the XML contents of the file identified as belonging to the Lingon launchd job.

    It's obvious from your original description that Lingon and the crontab tasks were initially coupled, in that Lingon undoubtedly established the crontab tasks. The question is whether those things are still coupled, and in what way.

    WARNING: It is entirely possible that my attempts at removing things will fail. The best thing to do then would be to go back to the Leopard boot disk, remove Lingon and all its jobs or tasks, then start a clean Snow Leopard install from that new baseline. This may be the least time-consuming approach anyway, as going back and forth here is hardly rapid turn-around.
     
  9. THX1139 thread starter macrumors 68000

    THX1139

    Joined:
    Mar 4, 2006
    #9
    Nothing... no output. Terminal came up with the usual "wilson-Mac-Pro:~ wilson$"
    When I pasted the code in and hit return... it just repeated "wilson-Mac-Pro:~ wilson$"

    It didn't even ask me for a password.

    So, I logged out of my personal account and into the admin account and tried it there. That's where I got the crontabs messages that I posted.


    I keep a separate account for my everyday use. When I first setup my computer, I leave the default admin account so that I can always revert back to it (it's name Primary). Then I setup an Admin User account for my day to day use (name wilson). I can't remember where I learned that, but it was recommended that to keep the default system admin account as default, then setup user accounts for everyday use. This way if your user account gets corrupted you can delete it easily or setup another one. It's also very easy to archive and move user accounts. For the record, I have 2 accounts. The default admin account that automatically gets created when you install the software. And, I setup a personal user account that I gave Admin access to. Hope that makes sense. Now that I think about it, I probably don't need to do it this way because it's easy to restore accounts from backups nowadays.



    The Amin Account is where I got this output, not from my personal account. I just didn't copy the id header over.. just the output code. It was from my Admin account (called Primary) This is definitely the trigger because that's the times that TM is activating. Midnight, noon, and 6PM.

    Not sure what you mean by output from 'id' command. Like I said above, nothing happens in my personal user account. The only time I got any kind of output is when I logged OUT of my user account and logged into the Admin account. (the default computer account).


    In my user account I wasn't able to find any crontabs. It wasn't until I logged into the default admin account that I was able to get the output from terminal that is posted above.

    Would it be possible to just go into the default admin account and delete those 3 crontabs (along with clamXav-scan.log) since they only seem to be affecting TM? I was able to open them with cronixx and could see the 3 different times. I could easily delete those (and clamXav because it's a virus checker that I don't use).


    Easier said than done. I couldn't find much of anything in my user account other than a couple for Adobe and Apple plists that has nothing to do crontabs, so I switched into to the default admin. From the Admin account in the library of the system folder there are folders for LaunchAgents and LaunchDaemons that have hundreds of plists. Couldn't find anything about lingon.org. There were a boat-load of com.apple and some org.plists but I have no idea what they are. I would rather reinstall my software than go through all of those!

    Yeah… couldn't find it. At this point, unless you have a better idea and don't think it's advisable to delete those crontabs that I talked about above, then I'll just do a fresh reinstall of Snow Leopard. In hindsight, I could have been done now instead of chasing this down. Still, it's a good opportunity to learn so no regrets.


    Yep, and what's really strange is that I did a fresh install of Snow Leopard so I don't know how those got in there. The only things I brought over from my original system were some personal files and a keychain. I also imported some bookmarks and and an iCal schedule. Not sure how the crontabs got there from the old install. Strange. Hope it doesn't happen again if I do another reinstall!

    You've been extremely patient and an enormous help!!!! I wish I could buy you a beer or something!

    Thanks!!
     
  10. chown33 macrumors 604

    Joined:
    Aug 9, 2009
    #10
    Simplest thing at this point is a reinstall, since you're willing to do it. If the problem appears again, repost.

    It should be possible to delete just the crontab entries from your Primary account. However, I don't know if there is some other task, specifically the Lingon launchd task, that would automatically try to re-insert those crontab entries.

    If you want to try, and are willing to reinstall if things go badly, then go ahead and delete the 3 crontab entries and see what happens. Give it at least 24 hrs.

    It should also be possible to not have you look through every launchd plist manually. I don't think it will be that hard to write a shell script that does the entire search. However, since you're willing to reinstall, then it saves me the work of writing and testing that script.


    The command I asked you to execute before, whose output was nothing, was the 'crontab' command. There is a completely separate command whose name is 'id'. If you enter that command in a Terminal window, it shows user and group IDs for the current user, and the associated names. I wanted to see this output from your Primary account to make sure it wasn't the root account (user ID of 0).

    I was confused by the fact that you had two separate admin-privileged accounts. The general recommendation I've seen, and the one I suggest, is to create a non-admin account for everyday use, and only use the admin account specifically for admin purposes.

    The purpose of this is to avoid accidents. When running with admin privileges, the whole OS (including Finder and any other app, such as Terminal) lets you do some things without prior confirmation, such as trashing apps from /Applications. If this happens by accident, users may not know how to recover, or they may not even realize they have to recover until it's too late.

    If your everyday account is non-admin, however, then this can't happen without first entering the admin account-name and password, at the moment the change is requested. You can still remove things that require admin privilege, you're just prompted each time. And if you have several admin tasks to perform where you don't want to be prompted each time, you can switch to the admin account.
     
  11. THX1139 thread starter macrumors 68000

    THX1139

    Joined:
    Mar 4, 2006
    #11
    I deleted those crontabs and so far the annoying error message has gone away. I'll keep my fingers crossed because I really don't want to spend the day reinstalling my software. Especially when I have a fresh backup sitting here that I can't use. I feel pretty confident that it's going to work and so far, so good. Not sure what is going on with the lingon launchd issue. I suppose it can't hurt to leave it as long as it doesn't affect my machine performance.

    I went ahead and took your advice and turned off admin on my personal account. I remember now why I did that. A long time ago when I first set it up this way, I got tired of not having permissions every time I wanted to do something. Eventually I turned on Admin access in that account and then it's been that way ever since. Now that I stop to think about it, there is no reason to have 2 admin accounts. Especially when I can do fast switching back and forth.

    I think everything is okay now (crosses fingers). I'm going to give it another day and if nothing strange happens, I won't do a reinstall.

    I can't thank you enough! You've been very helpful and courteous, that is something that is rare to find on the web these days. Have a prosperous New Year and good luck with everything you do!
     

Share This Page