13

It's been a couple of days I am reading these errors in the system log file.

25/11/11 21:31:43,373 com.apple.launchd: (com.apple.launchd.peruser.32697[92747]) getpwuid("32697") failed
25/11/11 21:31:43,374 com.apple.launchd: (com.apple.launchd.peruser.32697[92747]) Exited with code: 1
25/11/11 21:31:43,374 com.apple.launchd: (com.apple.launchd.peruser.32697) Throttling respawn: Will start in 10 seconds

I have OSX Lion 10.7.2.
These message go over and over every few seconds, I've goggled getpwuid() and it seems to be a system call.
I have also read some superuser posts about this issue:
https://superuser.com/search?q=com.apple.launchd.peruser
but running the reported commands in the console did not gave me any hint on how to solve this problem.

I've traced back the first appearance of this error to the 20th of November, here are the previous lines of the system.log file:

Nov 20 17:22:10 MacBook-Pro com.apple.backupd[45360]: Deleted /Volumes/Time Machine/Backups.backupdb/MacBook Pro/2011-11-18-215307 (64.9 MB)
Nov 20 17:22:26 MacBook-Pro com.apple.backupd[45360]: Deleted /Volumes/Time Machine/Backups.backupdb/MacBook Pro/2011-11-18-205448 (88.3 MB)
Nov 20 17:22:26 MacBook-Pro com.apple.backupd[45360]: Post-back up thinning complete: 5 expired backups removed
Nov 20 17:22:28 MacBook-Pro com.apple.backupd[45360]: Backup completed successfully.
Nov 20 17:23:47 MacBook-Pro iCal[45376]: ServerNotifications: Setting delegate to APSD
Nov 20 17:23:47 MacBook-Pro iCal[45376]: ServerNotification: configureService called with nil password
Nov 20 17:23:55 MacBook-Pro iCal[45376]: Subscription request completed
Nov 20 17:28:47 MacBook-Pro com.apple.launchd[1] (com.apple.launchd.peruser.32697[45390]): getpwuid("32697") failed
Nov 20 17:28:47 MacBook-Pro com.apple.launchd[1] (com.apple.launchd.peruser.32697[45390]): Exited with code: 1
Nov 20 17:28:47 MacBook-Pro com.apple.launchd[1] (com.apple.launchd.peruser.32697): Throttling respawn: Will start in 10 seconds

After this there are (really) tons of messages of this kind.

Do anyone have any hint?

Community
  • 1
nick2k3
  • 255
  • 2
  • 4
  • 8
  • Did you recently delete a user account from your machine? What happens when you open terminal and enter `touch foo ; sudo chown 32697 foo ; ls -l foo`? – Daniel Beck Nov 25 '11 at 21:09
  • possible duplicate of [How do I get rid of com.apple.launchd.peruser errors in my log?](http://superuser.com/questions/194094/how-do-i-get-rid-of-com-apple-launchd-peruser-errors-in-my-log) – Daniel Beck Nov 25 '11 at 21:11
  • What is the output of `sudo launchctl bstree -j`, does it contain a line with `com.apple.launchd.peruser.32697`? What are the child elements? – Daniel Beck Nov 25 '11 at 21:14
  • the output of touch foo ; sudo chown 32697 foo ; ls -l foo is: touch: foo: Permission denied and then: -rw-r--r-- 1 32697 staff 0 26 Nov 11:55 foo – nick2k3 Nov 26 '11 at 10:56
  • OK, so that user ID doesn't exist on your system. `launchctl` would be interesting though. – Daniel Beck Nov 26 '11 at 10:57
  • @DanielBeck sudo launchctl bstree -j| grep 32697 results in no output, no occurrences of that line:( here is by the way the paste of the output of sudo launchctl bstree -j : http://pastebin.com/Lpi4KzWd – nick2k3 Nov 26 '11 at 11:00
  • What is the output of the long running command `sudo find / -nouser -ls`? This will search your entire system and all mounted disks for files that belong to an unknown user account (e.g. 32697). Finding results is *not* a problem and you should not delete those files! It just might hint to what the reason for the error message is. – Daniel Beck Nov 26 '11 at 11:08
  • ok started the command now: do you know how much does it usually take? EDIT: the command is still running but it already found something: 35355928 0 drwx------ 2 32697 wheel 68 20 Nov 17:28 /private/var/db/launchd.db/com.apple.launchd.peruser.32697 – nick2k3 Nov 26 '11 at 11:11
  • @DanielBeck here is the output to sudo find / -nouser -ls : http://dl.dropbox.com/u/624718/output.txt.zip sorry it was too large to past on paste bin:( – nick2k3 Nov 26 '11 at 11:29
  • Odd how TeamViewer is installed as a non-existing user. But I think the directory `/private/var/db/launchd.db/com.apple.launchd.peruser.32697` is interesting here. How about you have a look in there and delete it (maybe archive before, just to be sure)? – Daniel Beck Nov 26 '11 at 11:32
  • All the `502` and `503` owned files stem from a different installation from which you migrated your data, or from software installed by a different, now deleted user account on your system. You are probably UID `501`. – Daniel Beck Nov 26 '11 at 11:33
  • Yes, this is a migrated account - actually both from Leopard to Snow Leopard to Lion. The directory /private/var/db/launchd.db/com.apple.launchd.peruser.32697 is empty.. before deleting I think I will try to simply run a Repair Permissions. Is there anything else I could try to do to identify what created that launched element? I'm afraid deleting it would somehow harm the system. – nick2k3 Nov 26 '11 at 11:37
  • Run `stat /private/var/db/launchd.db/com.apple.launchd.peruser.32697` and check the last (fourth) date in it. This is the "birth date" of the file system inode. What did you do that day? :-) – Daniel Beck Nov 26 '11 at 11:45
  • MacBook-Pro:~ nick2k3$ stat /private/var/db/launchd.db/com.apple.launchd.peruser.32697 234881026 35355928 drwx------ 2 (32697) wheel 0 68 "Nov 26 12:20:20 2011" "Nov 20 17:28:47 2011" "Nov 20 17:28:47 2011" "Nov 20 17:28:47 2011" 4096 0 0 /private/var/db/launchd.db/com.apple.launchd.peruser.32697 That's exactly the very same time error have started to pop up. – nick2k3 Nov 26 '11 at 11:47
  • Something even stranger: Nov 20 I was out of home, I came back at approximately that hour, all I remember is me plugging in the Firewire HDD and stopping Transmission can it be someway related to Time Machine? – nick2k3 Nov 26 '11 at 11:54
  • No idea. But to alleviate your concerns: *It is the only file system entry on your entire system belonging to the user ID*. Whatever created it doesn't exist anymore. – Daniel Beck Nov 26 '11 at 13:05
  • ;) Solved! I deleted the file and the system is still OK . EDIT: I've noticed the error stopped popping up after a reboot BEFORE deleting the file. Thank you very much for your support:) – nick2k3 Nov 27 '11 at 09:29
  • It's not even a file, but a directory... I'll convert my comments into an answer to your question shortly. – Daniel Beck Nov 27 '11 at 09:41

1 Answers1

10

Per-user launchd job overrides (e.g. which per-user jobs are disabled for a user) are located in subdirectories of /private/var/db/launchd.db/, e.g. com.apple.launchd.peruser.501.

Open Terminal and see who owns this directory:

ls -ld /private/var/db/launchd.db/com.apple.launchd.peruser.32697

If the owner (third column) is not a user name, but a numeric ID, that user does not (any longer) exist on your system.

You can just remove that directory and be done with it. If there are special rules in the overrides.plist, it might help you understand the origin of that user and the launchd jobs.

To find out when that launchd per-user directory was created, enter

stat /private/var/db/launchd.db/com.apple.launchd.peruser.32697

It's the last (fourth) date printed.

To find all files on your system not owned by a known user, enter

find / -nouser -ls

If 32697 is not a user on your system (no user name), this might give you some information (e.g. files related to a particular application you installed could mean that application messed with your user settings)

Daniel Beck
  • 109,300
  • 14
  • 287
  • 334
  • "Per-user launchd job overrides (e.g. which per-user jobs are disabled for a user) are located in subdirectories of /private/var/db/launchd.db/, e.g. com.apple.launchd.peruser.501." can you explain this? any documentation on launched job overrides? – nick2k3 Nov 27 '11 at 20:02
  • @nick From `man launchctl`: *-w Overrides the Disabled key and sets it to false. In previous versions, this option would modify the configuration file. Now the state of the Disabled key is stored elsewhere on-disk.*. `/.../launchd.db` is "elsewhere". If you force load/unload a per-user job, it doesn't modify the file used by all accounts (would be kind of stupid to impose your preferences on others on a multi-user system). And that directory is where they're stored instead, but only if customized (e.g. running a disabled by default job or vice versa). It's not *really* a vital preference. – Daniel Beck Nov 27 '11 at 20:31
  • Ok, thank you very much for your explanation! – nick2k3 Nov 28 '11 at 09:35
  • 6
    In addition to removing the directory, you'll want to kill the job from launchd -- `sudo launchctl stop com.apple.launchd.peruser.32697`, `sudo launchctl unload com.apple.launchd.peruser.32697`, `sudo launchctl remove com.apple.launchd.peruser.32697` – Doug Harris Jan 13 '12 at 16:06
  • Thanks Doug, the last set of three commands stop that command from constantly running. – ConstantineK Feb 19 '12 at 15:29