How to debug startup process

[Oepfelmoscht]

Hi
on my iMac (BigSur, M1) about 15 seconds after startup all apps in /Applications except Safari are deleted. How can I debug that and find out what is causing this?
Thanks in advance

 

[MacInWin]

Welcome to the forum.

Are you saying that for the first 15 seconds they are there, and then they disappear? But they are there again when you reboot? I ask because I am confused by your post, sorry.

 

[Raz0rEdge]

I'm with Jake, extremely confused by what is happening. Please explain the entire process, after reboots and all that.

 

[Oepfelmoscht]

Sorry for the confusion!! Yes, they are there again because i reinstall them (or rather FileWave does).

 

[Raz0rEdge]

And what is FileWave? Please don't provide information in pieces, it's impossible to help.

Is this a brand new M1? New to you? When did this begin? How often do you restart?

This behavior is not normal to macOS, so it's some app that you have installed which is causing this. You need to isolate it to that, so evaluate every app you have installed and see what it's purpose is.

 

[MacInWin]

In addition to Ashwin's questions, does FileWave (whatever that is) actually reinstall the software each time, or does it do something else? As Ashwin said, this isn't normal behavior.

 

[Oepfelmoscht]

hi, thanks for your patience and bearing with me.
What i had hoped to get as an answer was an instruction how to get information on programs starting during boot. Something like a verbose startup mode. Or some other clever way to see in detail what's going on.
Of course it's not normal behaviour and obviously it's caused by something that we had installed. This is a managed Mac, we do a lot with profiles and LaunchDaemons/Agents. But rather than go through all the scripts and find the problem, i had the idea to try and see what is running around the time that the apps disappear to make the list of possibly faulty scripts a bit shorter. Obviously the wrong approach.
But anyway, i fixed it. It was a a script with the line 'xargs -I folders rm -rf "folders"' where one of the values passed to xargs was "Application". Unfortunately the rm command did not run as expected in a users home folder but in /. Of course we should have used absolute paths like in 'rm -rf "Users/xyz/folders"' (luckily i didn't write the script).
Filewave by the way is an endpoint management solution. Kind of like JAMF.
Sorry that i didn't find the right balance between too much (unrelated) information and too little of it. But my original question was not "what is going on" but rather "what tools are there to analyse the boot process". Sorry if i didn't make this clear enough (i'm not a native english speaker).
Thanks again and best regards.
Roger

 

[Raz0rEdge]

The additional context helps, me at least since I know what you are talking about, and knowing it's a managed system changes how try to fix the problem since things can get installed as part of the overall system profile that IT has defined to install/launch by default.

You can start the system in safe mode and that should give you a terminal view of all the things that are happening and might show you the list of agents and other things starting up.

If that script is running by default on launch, I'm not sure what the purpose of that is.

Either way, glad you figured out the issue.

 

[MacInWin]

There is also a Verbose mode start up. You can just search for how to initiate it in macOS. I think it's in this article from Apple: Mac startup key combinations


A good tool to determine what is loading at startup is Etrecheck. Does a complete system report, including what is loaded at boot and login.