OS X's BSD/unix command-line

System Administration Commands

By Gordon Davisson

Index:

Basic Navigation (cd, pwd, ls)
Manipulating Files & Folders (cp, CpMac, ditto, mv, rm, rmdir, mkdir, chmod, chflags, chown, chgrp)
Working with Text Files (more, less, grep, pico, vi, emacs; text file formats)
Pipes and Redirects (>, >>, <, |, tee)
Miscellaneous (man, apropos, find, locate, open)
Administration (ps, top, kill, su, sudo, lsbom, lsof, ifconfig, diskutil)
Single-user mode (fsck, mount, SystemStarter, pico, nicl, bless, exit, reboot, shutdown)

Administration Commands:

ps - List the processes running on the system

Examples:

ps

List processes belonging to the current user that are attached to a terminal (not very useful under OS X)

ps -x

List processes belonging to the current user whether or not they're attached to a terminal

ps -ax

List all running processes

ps -aux

List all running processes, with additional information about their resource useage

top - List the top CPU-consuming processes running on the system, along with various other system load statistics. Note: it runs continuously, updating the stats repeatedly, until you quit it with "q".

Examples:

top

Display a list of processes, highest-process-id (i.e. most recent) first, updating once a second

top -us5

Display processes sorted by CPU useage, updating every 5 seconds

kill - Kill (or send other signals to) a process

Examples:

kill 220

Terminate process #220

kill -9 220

Terminate process #220 with extreme prejudice

kill -HUP 220

Send process #220 a hangup signal - by convention, background processes (daemons) treat this as a cue to restart, and reload their configuration information.

su - Set user. Allows you to temporarily become another user (root is the default). It'll ask for that user's password. Use the "exit" command to go back to normal.

Note:

You must be a member of the "wheel" group to su to root; under OS X 10.2, nobody is a member of "wheel" so this is effectively forbidden. Use sudo instead.

sudo - Set user and do. Execute a single command as another user (root is the default). It will ask for your password. Access is controlled by a configuration file and can be made quite complex (see the man page). By default, any administrator use sudo to perform any command as any user.

Examples:

sudo rm /private/var/db/.AppleSetupDone

Become root just long enough to delete one file.

sudo -u george ls ~george/Documents

Become george and list the files in his Documents directory.

sudo -s

Start a root shell (similar to su, except that it asks for your password, rather than the root password, and doesn't requires admin access, not wheel membership).

lsbom - List the contents of an installer's bom (bill of materials) file. This can be used to find out what files an installer will add/replace in your system before running it. It can also be used to find out what files a past install messed with.

Examples:

lsbom /Volumes/Developer\ Tools/Packages/DevTools.pkg/Contents/Resources/DevTools.bom >contents.txt

List the files that will be installed by the "DevTools" package, saving the list in a file named contents.txt.

lsbom /Library/Receipts/Essentials.pkg/Contents/Resources/Essentials.bom | more

List the files that were installed by the "Essentials" package (and pipe it through more to prevent overload).

lsof - List open files on the system. Normally, it only lists files you (or processes you own) have open; if run as root, it lists all open files.

Examples:

lsof

List all files currently open by me and my processes.

sudo lsof

List all files currently open on the entire system.

sudo lsof -i

List all open network connections on the entire system.

sudo lsof "/Volumes/FW Drive"

List all open files on the "FW Drive" volume; useful for figuring out why you can't eject/dismount a disk because something is using it.

ifconfig - Configure network interfaces (e.g. ethernet ports, AirPort cards, etc).

Notes:

In general, it's better to adjust the network settings in the Network pane of System Preferences. ifconfig sometimes allows a little more control/information, but changes made this way will almost never "stick" when the computer is rebooted, and may get reset when the network settings change (e.g. if the location changes, a port gets connected or disconnected, etc).
Changing the network settings requires root access.
ifconfig refers to network ports using rather cryptic identifiers such as:

en0

The first ethernet interface (generally, the built-in ethernet port).

en1, en2, etc

Additional ethernet interface(s) and/or AirPort wireless network card(s), firewire, etc.

lo0

The local loopback pseudo-interface, which your computer uses to talk to itself. Don't worry, this is not a sign of schizophrenia, it's just the way unix systems work...

Examples:

ifconfig -a

List the computer's network ports and their settings.

sudo ifconfig en0 media 100baseTX mediaopt full-duplex

Set the built-in ethernet interface to 100-megabit, full-duplex mode. Note that this may or may not have any effect, depending on whether the driver supports this form of configuration-forcing.

sudo ifconfig en0 alias 10.0.0.150 netmask 255.255.255.0

Attach an additional IP address (aka an alias or subinterface) to the built-in ethernet port. Note that (at least as of OS X 10.2) this is probably better done by simply adding another port configuration in the Network preference pane.

diskutil - Provides various utilities for dealing with Apple's disk format options (HFS+, journaling, RAID, etc). Many options require root access.

Examples:

diskutil

Display a list of diskutil's options.

diskutil info /

List information on the boot volume.

diskutil info /Volumes/Data

List information on a mounted (non-boot) volume named "Data".

diskutil info /dev/disk0s9

List information on partion #9 of disk #0.

sudo diskutil repairDisk /Volumes/Data

Repair the file structure on the volume "Data" (note: this unmounts the volume during repair).

sudo diskutil repairPermissions /

Repair the file permissions on the boot volume.

sudo diskutil enableJournal /

Enable HFS+ journaling on the boot volume.

sudo diskutil disableJournal /

Disable HFS+ journaling on the boot volume.