The Library folder

Since uninstalling Mac apps consists of dragging the .app folder to the trash, there isn't a process that removes the cruft it leaves behind in the ~/Library folder.

Often when I try out an app, I want to clear all traces of it. Use the commandline to do this as follows:

  $ cd ~/Library
  $ find . -mtime -1 -maxdepth 2

This will list all files and folders that were created or changed within the last 24 hours. Have a look there to see what the app created.

If you think of it in advance, here's an alternative:

 $ cd ~/Library
 $ find . > ~/before_installation.txt

Then install and run the app, and run the following commands to see what changed:

 $ find . > ~/after_installation.txt
 $ cd
 $ diff before_installation.txt after_installation.txt

Commandline tools


To interact with the OS X clipboard from the commandline, use pbcopy:

 $ pbcopy < ~/.ssh/


The BSD userland version of Find is included with OS X, and it's somewhat different from the GNU version. To find all executable files under OS X, type:

 $ find . -perm +111 -type f

Don't forget that Spotlight also has its own command:

 $ mdfind "needle in haystack"


The defaults command can read/write plist files, where plist is short for properties list. There is a Wikipedia article about Defaults.

What's very confusing to me, is that when using the defaults command with an absolute path, the .plist extension must sometimes be omitted and sometimes not. My best guess is to try without, and retry with extension when you get an error message "Domain tld.orgname.Something.plist does not exist".


 $ defaults read /Library/Preferences/
 2012-07-05 10:12:28.187 defaults[1695:707] 
 Domain does not exist
 $ defaults read /Library/Preferences/
 (... output ...)


 $ defaults read /System/Library/LaunchDaemons/
 $ defaults read /System/Library/LaunchDaemons/
 (... output ...)

The defaults command has a "find" option (source); for example:

 $ defaults find Bluetooth

Loading/unloading drivers

Drivers are called "kernel extensions" in OS X speak. They reside in the folder /System/Library/Extensions and end with the .kext extension, for example: "AppleGraphicsPowerManagement.kext".

List all loaded kernel extensions with:

 $ sudo kextstat

They can be loaded/unloaded with the kextload and kextunload commands; for example:

 $ sudo kextunload -b com.parallels.kext.prl_usb_connect


Instead of the standard UNIX mount/umount commands, use hdiutil:

  $ sudo hdiutil unmount /Volumes/storage/


For performance tips in general, do check out Brendan Gregg's blog at

Process priority

You use the terminal to give a process a lower priority. To give a certain process a lower priority, first find the process ID (hereafter: pid), then lower its priority:

  $ top

(In top, type 'ocpu' to sort on CPU usage. The first column gives you the process ID.

 30395  aircrack-ng  192.0 03:13:26 4/2  0    34    38    6272K  240K   6436K  33M    2394M  30395 28154

Remember the process ID, then type 'q' to exit top. Now use the 'renice' command as follows:

  $ sudo renice -20 -p 30395

Note that the first parameter after renice is different from what you're used to on your Linux system. -20 means: relatively decrease to the lowest priority, while 20 means: relatively increase.

Use the ps command to see if it worked: $ ps -l UID PID PPID F CPU PRI NI SZ RSS WCHAN S ADDR TTY TIME CMD 502 28154 28153 4006 0 31 0 2435764 1836 - S 81c8a80 ttys000 0:00.30 -bash 502 30395 28154 4006 0 51 -20 2451444 6436 - R<+ 9f8aa80 ttys000 190:47.41 aircrack-ng -a 502 24840 24839 4006 0 31 0 2435764 1808 - S+ aa512a0 ttys001 0:00.10 -bash 502 28315 28314 4006 0 31 0 2435764 1840 - S 81b52a0 ttys002 0:00.37 -bash

As you'll see in the PRI column, the priority has been lowered by twenty points. The NI (nice) column reflects this relative decrease.

Disk activity

To see whatever causes disk activity, check out iotop, a wrapper around dtrace:

 $ ionice -C 5 12

User management

The Directory Services manages user accounts in OS X. The command line utility for Directory Services is dscl. In Linux, this works differently; there isn't a daemon that runs in the background (on most servers anyway), rather there's two files (/etc/group and /etc/passwd) for groups and users/passwords, plus a number of command-line utilities to access those.

 $ dscl . list /Users


The normal utilities like dig, host and hostname do work on OS X, but often you can't mutate. Under Linux for example, root can use the hostname command to change the hostname. To do this under OS X:

 $ sudo scutil --set HostName mynewhostname.local


For information on launchd, see also this weblog entry: 2012-03-08 Launchctl on OS X

Tips & Tweaks for SSD drives

You can exclude certain folders from Spotlight indexing (System Preferences -> Spotlight -> Privacy).

If you run OS X from a small SSD drive, you'll probably want to reclaim lots of space. First, reclaim 4 GB from the following link: Optimizing OS X for SSD drives

(As of July, 2012, that link gives a 404; the wayback machine has an old copy).

Then disable secure virtual memory: Disable secure virtual memory

You can also (temporarily) disable virtual memory altogether as per this link: How to disable virtual memory

If you want to place your swapfiles some place else rather than on the SSD drive, use the information on this link: [1]

Creating keyboard shortcuts

In System Preferences under Keyboard, you can create Shortcuts. The same can also be done via the commandline:

Mac OS X hint: More via your favorite search engine: