How processes get launched automatically on Leopard

A number of recent communications to MacFixIt have implicitly raised the issue of how things get launched automatically on Leopard, prompting this little tutorial explanation.

You are all familiar with the Account system preference pane and its Login Items. As you know, any application listed here will be launched automatically when the user logs in (which may be the same as starting up the computer, if you're set up for automatic login). But this is obviously insufficient to explain the presence of the numerous other processes you can see running in Activity Monitor. How did they get launched?

In Leopard, the answer to this question changed - or rather, in Tiger, the groundwork was laid for a change in the answer to this question, and Leopard that groundwork is carried to through to its logical fulfillment. The focus of this change is a process called launchd. (For how things started up before launchd existed, see this excellent description.) The launchd process is called during the boot sequence as the computer starts up, and is the "root system process", the one process responsible for launching all others. You can see this in the Activity Monitor window if you switch to viewing "All Processes, Hierarchically": there are just two top-level processes, process 0 (kernel_task) and process 1, which is launchd and is the parent of every other process. Aptly, launchd is often analogized to Tolkien's "one Ring to rule them all," and you can see this analogy being made, if you're interested in the technical side of these things, in a video lecture starring the author of launchd, Dave Zarzycki.

When launchd starts up, it looks for files in /System/Library/LaunchAgents and /System/Library/LaunchDaemons. Each of these files is a cleverly coded set of instructions describing what process to launch and when. If you simply look at the files in the Finder, you can see that their names correspond to the system processes that are shown in Activity Monitor. For example, on my machine, a process shown in Activity Monitor is autofsd; that was launched because of a file in LaunchDaemons called com.apple.autofsd.plist. The next process shown in Activity Monitor is blued; that was launched because of a file in LaunchDaemons called com.apple.blued.plist. And so on.

It's important to emphasize that the files in LaunchDaemons and LaunchAgents are not themselves the launched processes; they are just instructions for launching processes. If you'd like to read those instructions, the best way is with the freeware utility Lingon, which we've mentioned several times recently in this context. It shows, for example, that com.apple.blued.plist actually launches a process located at /usr/sbin/blued. Of course, that doesn't tell you what the process blued does; but sometimes you can find out about that in some other way. For instance, blued has a man page (type man blued in the Terminal to see it) that explains that this process is in some way responsible for Bluetooth communications.

(What's the difference between LaunchAgents and LaunchDaemons? Well, it's a bit tricky, but LaunchDaemons should be considered as tied to the machine as a whole, whereas LaunchAgents are tied to individual users. So, for example, blued is a LaunchDaemon because any Bluetooth device that comes along is going to make contact initially with this machine as a whole; but the first thing my /System/Library/LaunchAgents folder, com.apple.abd.AddressBook.plist, launches the process that apps would use to communicate with an individual user's Address Book - there is no Address Book for the machine as a whole.)

There can be LaunchAgents and LaunchDaemons in other places than the System folder. For example, there are also /Library/LaunchAgents and /Library/LaunchDaemons. These places are for items that are installed by you (or whoever is administrating your computer). For example, on my machine, as I already explained, there's the LaunchAgent at.obdev.littlesnitchd, which is installed by Little Snitch and is responsible for launching the process that intercepts outgoing communications. And then there are also ~/Library/LaunchAgents and ~/Library/LaunchDaemons in your own User folder, which might also have something in them; if you enable AppleScript "folder actions", for example, files will appear in your own LaunchAgents folder, and these are responsible for triggering the processes that handle folder actions on Leopard (the architecture here is very different than it was on Tiger).

As the video I mentioned earlier says, Leopard has 166 launchd processes built in. That doesn't mean all 166 will be running at the same time, but it does mean that there are 166 "things" in Leopard that might get launched via launchd, depending on the circumstances. Not all of them are launched at startup, either; launchd launches some things at startup, but it also launches other things just when needed. All of that, however, should mostly work okay. One of the cool features of launchd is that if one of its processes crashes, and if this is a process that is supposed to be kept running at all costs, launchd notices this and relaunches it. You might see evidence of this in the Console, and generally it should probably not be taken as a sign of trouble. Things do go wrong; when launchd relaunches something, it's just taking care of business.

Okay, now I'm going to add a level of complexity. On Tiger, it was not uncommon for processes wishing to be launched automatically at system level to take advantage of a different mechanism, namely through files installed in /Library/StartupItems. For example, on my Tiger machine, /Library/StartupItems contains three folders: KeepIdle (installed by Interarchy to make FTP communications work better), MySQLCOM (which launches the MySQL server), and RetroRun (installed by Retrospect). On Leopard, such files are still honored - they are handled by the SystemStarter process, which is one of the things launched by launchd - but they are deprecated, meaning that Apple would like to phase out StartupItems and SystemStarter altogether. (The SystemStarter mechanism goes back to the early days of Mac OS X.)

You might like to look in /Library/StartupItems right now, because you might see something that surprises you, or that explains how some funny process you don't know anything about is getting launched. For example, every once in a while, under Tiger, a user would complain to MacFixIt about an inability to shut down the computer (the computer would halt at the blue screen near the end of the shutdown process, but the power wouldn't go off); this phenomenon is often caused by a rogue process in StartupItems. On my Leopard machine, /Library/StartupItems is empty, and I intend to try to keep it that way; any application that wants to install something here is not truly Leopard-ready.

Another problem with process launching that can affect users is when process try to launch and fail. This should not happen at all, but when it does, launchd will usually just try again a minute later. The act of repeatedly trying and failing to launch a process can cause your CPU to peg out and your Console to fill up with messages, as described in this note from a MacFixIt reader:

Leopard is writing this to Console [repeatedly] and for the life of me I can't figure out what program the cron is associated with...

11/28/07 7:42:00 PM com.apple.launchd[1] (0x10a420.cron[2176]) Could not setup Mach task special port 9: (os/kern) no access

I don't know either (what process is ultimately behind this), but it is apparent that something is trying to launch and failing, perhaps because of a permissions problem ("access"). Since cron is mentioned in the Console message, the user having this problem might also want to look at his crontab file (type crontab -l in the Terminal); this file is yet another place where surprises may lurk. If you see mention of some process you don't like, and if you don't know how to edit your crontab file, you can remove it entirely with crontab -r.

Similarly, a recent thread over at TidBITS-Talk describes repeated Console messages about "Throttling Respawn" and "com.mozy.backup". The latter is something installed by Mozy Backup - which, interestingly, figures in a number of complaints to MacFixIt from users - and the solution would be to try to find it, probably by looking in the /Library folders we've already mentioned, namely StartupItems, LaunchAgents, and LaunchDaemons.

Resources