com.apple.launchd: com.apple.launchd.peruser error

Question

It's been a couple of days I am reading these errors in the system log file.

25/11/11 21:31:43,373 com.apple.launchd: (com.apple.launchd.peruser.32697[92747]) getpwuid("32697") failed
25/11/11 21:31:43,374 com.apple.launchd: (com.apple.launchd.peruser.32697[92747]) Exited with code: 1
25/11/11 21:31:43,374 com.apple.launchd: (com.apple.launchd.peruser.32697) Throttling respawn: Will start in 10 seconds

I have OSX Lion 10.7.2.
These message go over and over every few seconds, I've goggled getpwuid() and it seems to be a system call.
I have also read some superuser posts about this issue:
https://superuser.com/search?q=com.apple.launchd.peruser
but running the reported commands in the console did not gave me any hint on how to solve this problem.

I've traced back the first appearance of this error to the 20th of November, here are the previous lines of the system.log file:

Nov 20 17:22:10 MacBook-Pro com.apple.backupd[45360]: Deleted /Volumes/Time Machine/Backups.backupdb/MacBook Pro/2011-11-18-215307 (64.9 MB)
Nov 20 17:22:26 MacBook-Pro com.apple.backupd[45360]: Deleted /Volumes/Time Machine/Backups.backupdb/MacBook Pro/2011-11-18-205448 (88.3 MB)
Nov 20 17:22:26 MacBook-Pro com.apple.backupd[45360]: Post-back up thinning complete: 5 expired backups removed
Nov 20 17:22:28 MacBook-Pro com.apple.backupd[45360]: Backup completed successfully.
Nov 20 17:23:47 MacBook-Pro iCal[45376]: ServerNotifications: Setting delegate to APSD
Nov 20 17:23:47 MacBook-Pro iCal[45376]: ServerNotification: configureService called with nil password
Nov 20 17:23:55 MacBook-Pro iCal[45376]: Subscription request completed
Nov 20 17:28:47 MacBook-Pro com.apple.launchd[1] (com.apple.launchd.peruser.32697[45390]): getpwuid("32697") failed
Nov 20 17:28:47 MacBook-Pro com.apple.launchd[1] (com.apple.launchd.peruser.32697[45390]): Exited with code: 1
Nov 20 17:28:47 MacBook-Pro com.apple.launchd[1] (com.apple.launchd.peruser.32697): Throttling respawn: Will start in 10 seconds    

After this there are (really) tons of messages of this kind.

Do anyone have any hint?

Solution

Per-user launchd job overrides (e.g. which per-user jobs are disabled for a user) are located in subdirectories of /private/var/db/launchd.db/, e.g. com.apple.launchd.peruser.501.

Open Terminal and see who owns this directory:

ls -ld /private/var/db/launchd.db/com.apple.launchd.peruser.32697

If the owner (third column) is not a user name, but a numeric ID, that user does not (any longer) exist on your system.

You can just remove that directory and be done with it. If there are special rules in the overrides.plist, it might help you understand the origin of that user and the launchd jobs.

---

To find out when that launchd per-user directory was created, enter

stat /private/var/db/launchd.db/com.apple.launchd.peruser.32697

It's the last (fourth) date printed.

---

To find all files on your system not owned by a known user, enter

find / -nouser -ls

If 32697 is not a user on your system (no user name), this might give you some information (e.g. files related to a particular application you installed could mean that application messed with your user settings)

Comments

[HikeMike]

Did you recently delete a user account from your machine? What happens when you open terminal and enter touch foo ; sudo chown 32697 foo ; ls -l foo?

[HikeMike]

possible duplicate of How do I get rid of com.apple.launchd.peruser errors in my log?

[HikeMike]

What is the output of sudo launchctl bstree -j, does it contain a line with com.apple.launchd.peruser.32697? What are the child elements?

[nick2k3]

the output of touch foo ; sudo chown 32697 foo ; ls -l foo is: touch: foo: Permission denied and then: -rw-r--r-- 1 32697 staff 0 26 Nov 11:55 foo

[HikeMike]

OK, so that user ID doesn't exist on your system. launchctl would be interesting though.

[nick2k3]

@DanielBeck sudo launchctl bstree -j| grep 32697 results in no output, no occurrences of that line:( here is by the way the paste of the output of sudo launchctl bstree -j : pastebin.com/Lpi4KzWd

[HikeMike]

What is the output of the long running command sudo find / -nouser -ls? This will search your entire system and all mounted disks for files that belong to an unknown user account (e.g. 32697). Finding results is not a problem and you should not delete those files! It just might hint to what the reason for the error message is.

[nick2k3]

ok started the command now: do you know how much does it usually take? EDIT: the command is still running but it already found something: 35355928 0 drwx------ 2 32697 wheel 68 20 Nov 17:28 /private/var/db/launchd.db/com.apple.launchd.peruser.32697

[nick2k3]

@DanielBeck here is the output to sudo find / -nouser -ls : dl.dropbox.com/u/624718/output.txt.zip sorry it was too large to past on paste bin:(

[HikeMike]

Odd how TeamViewer is installed as a non-existing user. But I think the directory /private/var/db/launchd.db/com.apple.launchd.peruser.32697 is interesting here. How about you have a look in there and delete it (maybe archive before, just to be sure)?

[HikeMike]

All the 502 and 503 owned files stem from a different installation from which you migrated your data, or from software installed by a different, now deleted user account on your system. You are probably UID 501.

[nick2k3]

Yes, this is a migrated account - actually both from Leopard to Snow Leopard to Lion. The directory /private/var/db/launchd.db/com.apple.launchd.peruser.32697 is empty.. before deleting I think I will try to simply run a Repair Permissions. Is there anything else I could try to do to identify what created that launched element? I'm afraid deleting it would somehow harm the system.

[HikeMike]

Run stat /private/var/db/launchd.db/com.apple.launchd.peruser.32697 and check the last (fourth) date in it. This is the "birth date" of the file system inode. What did you do that day? :-)

[nick2k3]

MacBook-Pro:~ nick2k3$ stat /private/var/db/launchd.db/com.apple.launchd.peruser.32697 234881026 35355928 drwx------ 2 (32697) wheel 0 68 "Nov 26 12:20:20 2011" "Nov 20 17:28:47 2011" "Nov 20 17:28:47 2011" "Nov 20 17:28:47 2011" 4096 0 0 /private/var/db/launchd.db/com.apple.launchd.peruser.32697 That's exactly the very same time error have started to pop up.

[nick2k3]

Something even stranger: Nov 20 I was out of home, I came back at approximately that hour, all I remember is me plugging in the Firewire HDD and stopping Transmission can it be someway related to Time Machine?

[HikeMike]

No idea. But to alleviate your concerns: It is the only file system entry on your entire system belonging to the user ID. Whatever created it doesn't exist anymore.

[nick2k3]

;) Solved! I deleted the file and the system is still OK . EDIT: I've noticed the error stopped popping up after a reboot BEFORE deleting the file. Thank you very much for your support:)

[HikeMike]

It's not even a file, but a directory... I'll convert my comments into an answer to your question shortly.

[nick2k3]

Ok, thank you very much for your explanation!

[Doug Harris]

In addition to removing the directory, you'll want to kill the job from launchd -- sudo launchctl stop com.apple.launchd.peruser.32697, sudo launchctl unload com.apple.launchd.peruser.32697, sudo launchctl remove com.apple.launchd.peruser.32697

[ConstantineK]

Thanks Doug, the last set of three commands stop that command from constantly running.