Mac Gems: Automatic Launch Object Detection lets you track background processes

26.09.2012
When you're using your Mac, currently running applications appear in the Dock, but there are many processes running invisibly in the background. Some of these are processes you've initiated yourself--for example, by adding them to the Login Items list in System Preferences--but others are running because the OS or some installer set them up to run in the background, either continuously or on a schedule. Specifically, many of these processes are controlled by an OS X feature called , which uses special configuration files to determine which processes should be run, and when.

Many of these processes are good, and some are even necessary. For example, some backup programs use them to make sure your scheduled backups run at the appropriate time(s). But I personally want to know when an app or an installer sets up a new background process. Partly because I like to know as much about what's going on with my Mac as possible, but also because as useful as the launchd system is, it can also be used for nefarious purposes: Someone with less-than-honorable intentions can use it to launch, or to keep running, malware or spyware.

How do you know when one of these background processes--in other words, a new launchd configuration file--is added? One solution is a clever utility called (ALOD for short), created by the Computer Incident Response Center Luxembourg (CIRCL). This utility monitors all the locations that launchd configuration files (and other types of background programs) are stored:

~/Library/LaunchAgents

/Library/LaunchAgents

/Library/LaunchDaemons