Crontab Not Working in MacOS Sierra

Having used Linux and Unix since 1995, I find myself pretty much locked at the hip with crontab to keep my jobs working on a given schedule.  Go figure, as soon as I update my MacOS machine to Sierra and at the same time want to get Clam antivirus configured to auto-scan, I find out it’s not working in there.  It was a bit of a rabbit hole situation, where one thing lead to another.  In the end, I found out that cron has been deprecated in OS X/MacOS, and now Launchd is default and supported.  One of those things that rubs me the wrong way, but it is what it is since it’s not designed to be a server or a Unix system really.

I found /usr/lib/cron to be symlinked to /var/at, and /var/at has a cron.allow file (/var/at/cron.allow).  ‘At’ is also disabled by default.  ‘Atrun’ controls it.  I vi’ed /System/Library/LaunchDaemon/com.apple.atrun.plist and found out that cron was deprecated.

Here’s the skinny on Launchd.  plist files handle the applications that will run within it.  It’s an XML based file which tags a string name for it, the program application that will run, arguments, when it will run, and how frquently.  A description and logs are designated in there as well.  Once one is seen, it’s relatively simple to edit and create your own for any script or application you’d like to run.  That’s what I did.

/Library/LaunchDaemons – holds plist files for global services running as root
/Library/LaunchAgents – Holds plist files only used while users are logged on. (Run as ‘root’)
$HOME/Library/LaunchAgents – Hold plist files used when users are logged on. (run as the userid)

And on to the commands to control launchd… which kinda reminds me of systemd on newer Linux systems, disturbingly.

• launchctl list – view currently registered plists
• launchctl load -w <plist file> – adds and registers plist file, starting it.
• launchctl unload -w <plist file> – remove and deregister plist file.

So, I wanted to have freshclam (clam antivirus script that updates clamav) run regularly.  I created this plist file (/Library/LaunchDaemons/net.clamav.freshclam.plist):

<?xml version=”1.0″ encoding=”UTF-8″?>
<!DOCTYPE plist PUBLIC “-//Apple Computer//DTD PLIST 1.0//EN” “http://www.apple.com/DTDs/PropertyList-1.0.dtd”&gt;
<plist version=”1.0″>
<dict>
<key>Label</key>
<string>net.clamav.freshclam.plist</string>
<key>LowPriorityIO</key>
<true/>
<key>ProgramArguments</key>
<array>
<string>/usr/local/bin/freshclam</string>
<string>–quiet</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>ServiceDescription</key>
<string>Checks for and downloads updates to the ClamAV virus database.</string>
<key>StartCalendarInterval</key>
<dict>
<key>Minute</key>
<integer>60</integer>
</dict>
<key>StandardErrorPath</key>
<string>/tmp/freshclam.err</string>

<key>StandardOutPath</key>
<string>/tmp/freshclam.out</string>
</dict>
</plist>

 

And a script I wrote that uses clam antivirus to scan my directories is run by this plist (/Library/LaunchDaemons/net.clamav.clamscan.plist):

<?xml version=”1.0″ encoding=”UTF-8″?>
<!DOCTYPE plist PUBLIC “-//Apple Computer//DTD PLIST 1.0//EN” “http://www.apple.com/DTDs/PropertyList-1.0.dtd”&gt;
<plist version=”1.0″>
<dict>
<key>Label</key>
<string>net.clamav.clamscan.plist</string>
<key>LowPriorityIO</key>
<true/>
<key>ProgramArguments</key>
<array>
<string>/usr/local/bin/clamscan.sh</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>ServiceDescription</key>
<string>Runs a clamscan on the /Users subdirectories</string>
<key>StartCalendarInterval</key>
<dict>
<key>Minute</key>
<integer>60</integer>
</dict>
<key>StandardErrorPath</key>
<string>/tmp/clamscan.err</string>

<key>StandardOutPath</key>
<string>/tmp/clamscan.out</string>
</dict>
</plist>

 

After all is said and done, Launchd runs clam antivirus to scan my /Users subdirectories on a regular basis just in case I have something on here I shouldn’t.

It’d be nicer if there would just be an integrated scheduler with the Apple clam antivirus that would translate the scheduling into something that wouldn’t require learning how to build a Launchd script from the beginning.  I can see why they didn’t since it started on Linux and it’s easier to just toss something like this into crontab:

*/60 * * * * freshclam 2>&1 > /tmp/freshclam.log