Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Per the Windows and Linux threads, what commands do you find most useful in Mac OS X Server (or Client)?


locked by Mark Henderson Jun 27 '12 at 4:44

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

there's loads of apple specific stuff on this site, people here just seem to enjoy being negative. –  Chopper3 May 12 '09 at 13:29
to be expected i suppose... we are sysadmins :-) –  username May 12 '09 at 13:32
I like your username...username :) –  Chopper3 May 12 '09 at 13:35

55 Answers 55

Ever wanted to know what the IP address of another Mac that you can see is in the Finder is on your LAN thanks to Bonjour?

dscacheutil -q host -a name OtherMac.local

dscacheutil is surprisingly useful and versatile. You can do a lot more with it than just flush the DNS cache (as mentioned elsewhere here), i.e. user lookups and cache stats and dumps.


A bit pedestrian for this audience, no doubt, but I use:

screencapture -i -c

to grab whatever I want from the screen It's really handy and does things that Grab won't allow me to grab.


What DHCP licenses does the client hold?

sudo ls -lt /private/var/db/dhcpclient/leases

List the firewall allow/denies:

sudo ipfw list

Generate a high-entropy password (double click on a promising 16 character string to copy/paste):

head -c90 /dev/random | uuencode -m pwd | hexdump -C

Maybe not the most "useful" command but say is pretty fun.

For example say I love serverfault to have it read back what you type after "say."

open .

Opens a finder window in the current working directory.


OS X specific things I haven't seen mentioned:

mdfind uses the Spotlight search indexes from the commandline, so you can do full-text searches without using the Search pulldown.

networksetup - will show you all the crazy syntax it supports; this is the commandline equivalent of the Network preference pane.

sudo launchctl list - shows the running launchctl jobs. remember launchctl stop X.XX.X will just 'stop' (kill) the currently running instance of a persistent process; to really make it stop running use launchctl unload /System/Library/LaunchDaemons/X.XX.X.plist.


These are basic, but handy if you have amnesia:

Who am I?


Where am I standing?


What building am I?


What's its address?

ifconfig |grep inet

I just found out that there's a nifty bash construct that you can use instead of the seq command missing in Mac OS:

echo { 18..21 }
sudo opensnoop

in Leopard and newer, reports which processes open files, whether successfully or not. You can ask it to look at all files being opened across the system, by a specific process, or if any process is opening a given file, with different sorts of timestamps, and to show if errors occur.

Here are some more details:

opensnoop is a dtrace script; there are many others in /usr/bin that look at things like which system calls a process is making, what processes it is creating and what I/O it is doing. Run apropos DTrace for a list, and look at man pages for details.

I found out about opensnoop when struggling to diagnose why a Comic Life Magiq 1.1 was crashing on OS 10.5.8 for users with network accounts.

I ran (several times, on different accounts, via ssh):

sudo opensnoop -e -n Comic > output.txt

The last file opened by network users was something like this (with a full path):


which reminded me that Safari 5.0 was crashing for network users, and we worked around it by either managing a preference to not cache favicons or by redirecting a file. Apple apparently fixed the issue in Safari 5.0.1, and when I upgraded to Safari 5.0.2 yesterday, it fixed the crash for Comic Life Magiq users.

sqlite3 foo.db

Starts an interactive SQLite session. If foo.db does not exist, it will be created.

osascript -e 'tell application "AppName" to quit'

Lets you quit an application from the shell.

osascript -e 'tell application "Finder" to sleep'

Useful last line of a long shell script, puts Mac to sleep when script is done. I have it aliased to iSleep.

pbpaste | |pbcopy

takes contents of pasteboard (edit->copy) and pipes it to The results are put onto the pasteboard for you to edit->paste into a document.

dscacheutil -flushcache

I find myself using that one heaps to flush the DNS cache, on 10.5+.


Displays the currently installed version and build of Mac OS X.


The Command-Line Administration guide put out by Apple is invaluable.

Googling for "command line administration mac" gives good results.

Command-Line Administration for Mac OS X 10.5, 10.4, and 10.3.

Other useful guides are at

lsof -i 

lists Internet ports that are open. Sample output:

SystemUIS   223 clinton   11u  IPv4 0x3e21b08      0t0  UDP *:*
ARDAgent    262 clinton   16u  IPv4 0x3e21be0      0t0  UDP *:net-assistant
ARDAgent    262 clinton   18u  IPv4 0x5f01a68      0t0  TCP *:net-assistant (LISTEN)
AppleVNCS   263 clinton    4u  IPv6 0x3e274bc      0t0  TCP *:vnc-server (LISTEN)
Opera     48365 clinton   20u  IPv4 0x5f01e64      0t0  TCP WTD-Staff-BlackmoreC:57094-> (ESTABLISHED)
Opera     48365 clinton   23u  IPv4 0x5b12a68      0t0  TCP WTD-Staff-BlackmoreC:57095-> (ESTABLISHED)

Use sudo if you want the ports open by all users, and the flags -n and -P will disable name resolution and port names and give you numbers instead.


Apart from the usual Unix suspects I find the following useful :-

  • dsconfigad - Edits the Active Directory settings and binds a computer

  • defaults - Edit preferences

  • plutil - Converts plist to and from text

  • softwareupdate - run Software Update from the command-line

  • installer - install packages from the command-line

  • networksetup - set and get various things such as the computer name

If you master those and the usual Unix stuff you have all you need for Mac administration from the command-line.


killall -9 appname force quits an app. Pretty useful if you can't get into Activity Monitor.


scutil --dns

Will display the order for DNS resolution. Useful for when you're creating or debugging your Network settings.

opendiff file1 file2

Runs FileMerge (a graphical diff that comes with Apple Developer Tools) on file1 and file2.


It can't be said enough, "open" is great. You can open documents in their GUI program and you can select the GUI program with -a as well. For example,

open -a vlc movie.avi

will open VLC and tell it to load movie.avi in your current dir.

open movie.avi

would open it with whatever program is the default. If you just want to open a program, you can do that too:

open -a system\ preferences

will run System Preferences. You can open Urls too:

open vnc://myserver:5900

will open Screen Sharing and connect to myserver.

Check out

man open

to see all flags you can use.


If you want to know what sort of line endings a file has, just run

file /path/to/your-file


$ file imports/sample-students.txt 
imports/sample-students.txt: ASCII text, with CR line terminators

Gain a root shell without enabling the root user (as Apple itself requires sometimes in their docs in order to do some "geeky" stuff, ie to set system-wide language)

sudo bash

This gives you a root shell where you can do everything you want as root, without having to prepend every command with the sudo command.

This may be dangerous, but we are sysadmins, we know what we are doing, don't we? :)

I prefer "sudo -s", it's shorter and I think it may do some specific processing to start the shell "properly". –  w00t Aug 18 '09 at 0:22
drutil tray open

Invaluable (over ssh) when there's no keyboard connected since the eject button on Apple optical drives isn't accessible from outside the case.

dns-sd -B _ssh
dns-sd -B _rfb
dns-sd -B _services._dns-sd._udp

List servers advertising in Bonjour. The last suggestion lists the types of service that you can list. The listing is live, hit Ctrl-C when you've seen enough.

The same command comes in recent Linuxes and in the Bonjour SDK for Windows.


It is a freeware third-party tool, but


is really handy. It is a command-line tool that you can optionally install the first time you run TextWrangler. [Other text editors (BBEdit, TextMate) likely provide something analogous.]

edit path/to/somefile

Opens up the file in TextWrangler, and will let you authenticate if you don't normally have permission to edit it. (You can even do it from an ssh session, and it'll open it for the logged-in graphical user).

Better still is that you can pipe things to it.

lsof -i | edit

for example, will show you your open network connections and open them up in TextWrangler, where you can search (and scroll) through them easily.

There is a similar Textmate version called "mate" which is installed with the editor. –  bjtitus Jul 5 '09 at 23:32

How to enable Time Machine to backup to a NAS.

defaults write TMShowUnsupportedNetworkVolumes 1

Find MAC address

ifconfig en0 | grep ether | sed s/://g | sed s/ether//

Command to create sparsebundle to copy over to NAS

sudo hdiutil create -nospotlight -library SPUD -size 160g -fs "Case-sensitive Journaled HFS+" -type SPARSEBUNDLE -volname "<VOLNAME>" ./<HOSTNAME>_<MAC_ADDRESS>.sparsebundle

Works like charm backing up to my ReadyNAS.


This question overlaps quite a bit with this one about tools a UNIX administrator cannot live without. Many of the command-line tools for Mac OS X have UNIX roots, such as df, du, and which; however there are notable exceptions that have no obvious UNIX equivalents, such as osascript, open, pbcopy, pbpaste, and say.


list open files

Handy when you want to eject your USB drive and are told that it is in use and to please quit all applications and try again.

$ sudo lsof /Volumes/CLINTON
bash    55966 clinton  cwd    DIR  14,12    16384    2 /Volumes/CLINTON
lsof    56042    root  cwd    DIR  14,12    16384    2 /Volumes/CLINTON
lsof    56043    root  cwd    DIR  14,12    16384    2 /Volumes/CLINTON

In this instance, I had cded onto the drive and so bash was accessing the volume.

Note that if you see 'mds' entries, it means that spotlight is indexing the drive.

 which program

searched the path for program, and tells you which executable is invoked if you run program without specifying a full path.

It is usually most useful as a shorthand for typing a path.

$ which python
$ ls -l `which python`
lrwxr-xr-x  1 root  wheel  72 30 Jan 22:56 /usr/bin/python -> ../../System/Library/Frameworks/Python.framework/Versions/2.5/bin/python
 sudo reboot

reboots the computer.


Not the answer you're looking for? Browse other questions tagged or ask your own question.