L3 Training & Consulting

So you’re wondering what’s going on with processes on a particular Mac OS X box.

You’ll want to know a couple of things about your currently logged in user like the short name and the UNIX ID (also know in Open Directory terms as the UniqueID)

We can get information about our account in the terminal by looking at the bash prompt.


Lappy:~ italisman$


Lappy is the name defined in the Sharing preference pane in System Preferences
The colon (:) following that is a separator that is followed by my current file system location
The tilde character (~) indicates I’m in my own home folder (Macintosh HD:Users:italisman)
The dollar in bash ($) tells me that the text following that will be my commands to input.

Now that we have that out of the way….

We also need to know our UniqueID value – the numeric identifier for our account. There is a good bet it’s 501 but we should run the ‘id’ command to check.

Lappy:~ italisman$ id
uid=501(italisman) gid=20(staff) groups=20(staff),98(_lpadmin),80(admin)
Lappy:~ italisman$

So now we know our uid is 501 (UniqueID is the Open Directory name for that UNIX attribute)

What about process tracking in the terminal? How about the ps command?

The ps command takes a couple of arguments. If I just type ps by itself I don’t get very useful information. If I can use a few more items following that it starts to be very useful – more useful than Activity Monitor.app perhaps.

How about:

ps -a -u 501

This gives me a list of all processes on my machine tied to uid 501:

501 111 ?? 0:05.92 /sbin/launchd
0 121 ?? 0:00.08 /usr/sbin/qmasterd
0 123 ?? 0:13.93 /Library/StartupItems/ParallelsTransporter/llipd
0 126 ?? 0:00.06 /usr/sbin/qmasterd -child
0 135 ?? 0:00.01 /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Support/VNCPrivileg
0 153 ?? 0:05.19 /Library/StartupItems/Parallels/pvsnatd
501 174 ?? 0:00.00 (Python)
501 177 ?? 0:00.40 /System/Library/CoreServices/Folder Actions Dispatcher.app/Contents/MacOS/Folder Actions Dispatc
501 179 ?? 0:00.30 /System/Library/CoreServices/AirPort Base Station Agent.app/Contents/MacOS/AirPort Base Station
501 182 ?? 0:00.17 /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/MacOS/AppleVNCServe
501 184 ?? 0:05.17 /System/Library/CoreServices/Spotlight.app/Contents/MacOS/Spotlight
501 185 ?? 0:00.50 /usr/sbin/UserEventAgent -l Aqua
501 188 ?? 0:00.01 /usr/sbin/pboard

So you want to monitor, continuously, the traffic in or out of your box on port 80. You want to monitor web traffic.

You’re going to run the following:

lsof -r -i:80


This will output something like the following:


COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
iTunes 3132 italisman 32u IPv4 0x808aa68 0t0 TCP 172.16.2.169:61644->akamai-072.sfo1.speakeasy.net:http (CLOSE_WAIT)
iTunes 3132 italisman 33u IPv4 0x7a15270 0t0 TCP 172.16.2.169:61731->akamai-071.sfo1.speakeasy.net:http (CLOSE_WAIT)
Safari 26240 italisman 9u IPv4 0x706f270 0t0 TCP 10.1.235.183:62762->95767-www1.affiliatemakeover.com:http (ESTABLISHED)
Safari 26240 italisman 12u IPv4 0x70c5a68 0t0 TCP 10.1.235.183:62759->209-20-80-227.slicehost.net:http (ESTABLISHED)
Safari 26240 italisman 13u IPv4 0x71e666c 0t0 TCP 10.1.235.183:62778->192.217.199.107:http (ESTABLISHED)
Safari 26240 italisman 16u IPv4 0x808ae64 0t0 TCP 10.1.235.183:62777->track1.mbl.vip.sp1.yahoo.com:http (ESTABLISHED)


I tripped over the behavior in the Spotlight menu the other day of being a calculator.

You can just type in numbers with the following operators:

• + (add)
• - (subtract)


• “/” (divide)


• * (multiply)

Just like so: