What is this automatic copy happening on the Mac OS Finder level?

July 23, 2018 10:32 AM

I've inherited a MacPro at a new job that was used by a person no longer with the company. Everyday once or twice a day the Finder attempts a copy to... somewhere of... something. It seems to be searching for a location no longer on the network so it just gets hung up on attempting to connect.

How do I determine what it is trying to copy, where it is trying to copy to, and what was used to set up this automated copy?

Mac OS X 10.13

posted by matt_od to Computers & Internet (14 answers total)

What process is running. backupd? rsync? Use Activity Monitor or top in a terminal session to see.

Is it a previous Automator action, now orphaned (because the external drive has been disconnected)? Look in ~/Library/Workflows/Applications/Calendar folder in your home directory for the action/script.

See this article for more info.
posted by sudogeek at 10:38 AM on July 23, 2018

There's a dozen ways this could be happening, does this company have IT? Get in touch with them if so, they're there to help you with stuff like this.
posted by rhizome at 10:40 AM on July 23, 2018

Are you using the previous user's account? If so you should make a fresh account and use that instead, leaving behind cruft accumulated by the previous user.
posted by w0mbat at 11:01 AM on July 23, 2018 [1 favorite]

Is it TimeMachine? Check the Preferences panel.
posted by gregvr at 12:38 PM on July 23, 2018

Response by poster: Thanks for the ideas so far. It's not time machine and I haven't been able to locate any Automator actions that could be the cause. I'll have to check Activity Monitor again the next time it goes off.
IT, unfortunately, isn't very good and doesn't have any idea.
The account on this computer isn't really user specific, it's use specific, in this case this account is what we use for the video editing... which is what I do. Not how I would have set it up and when we purchase new equipment later this year we won't be setting it up again this way.
posted by matt_od at 12:56 PM on July 23, 2018

Start Terminal (in Applications - Utilities) and type the following command:

crontab -l

It will list jobs that are scheduled via cron. If that list is not empty, that's where it is happening. You can edit the list with

crontab -e

Or, if you find vi a bit arcane:

EDITOR=nano crontab -e

Good luck!
posted by hz37 at 2:19 PM on July 23, 2018 [2 favorites]

Response by poster: thanks hz37. List came back empty... so that wasn't it.
posted by matt_od at 2:27 PM on July 23, 2018

Any of the video editing software set-up to auto-backup?
posted by Thorzdad at 2:42 PM on July 23, 2018

I'm not sure about OSX, but there might be a log of what's going on. In the meantime, try dropping to a command prompt and typing `mail` (`enter` to read, `q` to quit) to see if the process has been sending you emails of failures.
posted by rhizome at 2:55 PM on July 23, 2018

I believe that OS X still uses the /var/log system, and there might be some useful messages in one of the files in there. Unfortunately, I don't have access to a Mac, so I can't give better instructions. I'm sure you'll have to use the console. You might (?) have to use the console as the root user. These commands might be useful:

ls /var/log

less /var/log/system.log

more /var/log/system.log
posted by clawsoon at 4:46 PM on July 23, 2018

It looks like Applications > Utilities > Console.app might also be a useful place to browse log entries. If you know when the problem is happening, you could look for log messages from around that time.
posted by clawsoon at 4:49 PM on July 23, 2018

Not sure about Mac... Linux (at least Debian) also puts cron jobs in /etc/cron.{daily,hourly,monthly,weekly} so some backup software might have a cron job there and not in root/user's crontab directly.
posted by zengargoyle at 7:27 PM on July 23, 2018

Could be a launchd job? Check to see if there are any agents with calendar scheduling...

grep -i 'start.*interval' /Library/LaunchAgents/* ~/Library/LaunchAgents/*

and look for anything with a StartInterval or StartCalendarInterval key.
posted by russm at 12:16 AM on July 24, 2018 [1 favorite]

Response by poster: Finally managed to get to the system.log at the same time one of these was happening... Here's what it captured:
Jul 31 10:02:19 Edit-2-Mac-Pro SystemUIServer[520]: BUG in libdispatch client: kevent[mach_recv] monitored resource vanished before the source cancel handler was invoked
Jul 31 10:02:36 Edit-2-Mac-Pro com.apple.xpc.launchd[1] (com.apple.imfoundation.IMRemoteURLConnectionAgent): Unknown key for integer: _DirtyJetsamMemoryLimit
Jul 31 10:02:36 --- last message repeated 1 time ---
Jul 31 10:02:36 Edit-2-Mac-Pro Spotlight[601]: assertion failed: 17D47: libxpc.dylib + 72637 [F7E5F1BC-614B-39CB-B6CE-92A9C7B7EC0B]: 0x89
Jul 31 10:02:43 Edit-2-Mac-Pro parsecd[574]: BUG in libdispatch client: dispatch_mig_server: mach_msg() failed (ipc/send) msg too small - 0x10000008
Jul 31 10:03:04 Edit-2-Mac-Pro com.apple.xpc.launchd[1] (com.apple.quicklook[6596]): Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.quicklook
Jul 31 10:03:24 Edit-2-Mac-Pro syslogd[59]: ASL Sender Statistics
Jul 31 10:04:23 Edit-2-Mac-Pro com.apple.xpc.launchd[1] (com.apple.imfoundation.IMRemoteURLConnectionAgent): Unknown key for integer: _DirtyJetsamMemoryLimit
Jul 31 10:04:56 --- last message repeated 1 time ---
Jul 31 10:05:11 Edit-2-Mac-Pro diagnosticd[6622]: no EOS device present
Jul 31 10:05:11 Edit-2-Mac-Pro diagnosticd[6622]: System mode client started - Console (6621) - mode: 0xb
Jul 31 10:07:07 Edit-2-Mac-Pro com.apple.xpc.launchd[1] (com.apple.imfoundation.IMRemoteURLConnectionAgent): Unknown key for integer: _DirtyJetsamMemoryLimit
posted by matt_od at 10:09 AM on July 31, 2018