Workflows by profession

A sysadmin's search toolkit

Updated 2026-07-31 · 5 min read

Administering a Mac means finding the file that changed behaviour, and it is never where a normal search looks.

Config lives in scattered dotfiles and plists

ls -la ~ | grep '^\.'                    # home dotfiles
ls ~/Library/LaunchAgents               # per-user auto-start
ls /Library/LaunchAgents /Library/LaunchDaemons   # system-wide
sudo ls /Library/Managed\ Preferences   # MDM-pushed config

The launch agent/daemon folders answer "what starts on boot" and "what is this process" — the first place to look when something runs unbidden.

Logs

log show --last 1h --predicate 'eventMessage contains "error"'
log stream --predicate 'process == "somedaemon"'

The unified log replaced flat log files; log show/log stream are how you read it. Legacy flat logs still live in /var/log and ~/Library/Logs:

find /var/log ~/Library/Logs -name "*.log" -mtime -1 2>/dev/null

What changed recently, system-wide

The diagnostic that solves most "it broke today" tickets:

sudo find / -newermt "24 hours ago" -not -path "*/Caches/*" \
  -not -path "/System/Volumes/Data/private/var/folders/*" 2>/dev/null | head -80

Finding what a package installed

pkgutil --pkgs
pkgutil --files com.vendor.package
pkgutil --pkg-info com.vendor.package

The uninstall map for anything that shipped as a .pkg.

Fleet reality

Full Disk Access for your Terminal is non-negotiable, or half these commands hit TCC walls. On managed Macs, /Library/Managed Preferences shows what MDM enforces — often the answer to "why can the user not change X". For interactive whole-disk lookup that does not make you write find incantations, a maintained index that includes system and Library paths turns these hunts into typing a name.

Common questions

How do I see what starts automatically on a Mac?

Check ~/Library/LaunchAgents and /Library/LaunchAgents and /Library/LaunchDaemons for plists; each defines a start-on-load job.

How do I read logs on modern macOS?

log show and log stream with predicates — the unified log replaced most flat files in /var/log.