Lastlog mysteries

I recently stumbled over a gigantic lastlog file in /private/var/log of about 4.5 GB . Using a small perl script (see at the bottom) I could read lastlog, but found only a few dozen lines with login info.
I deleted the file as root (now filesize 1), logged out and in again.
Now the filesize was 28868 containing only two lines of text with my last login info. I understand that this is a "sparse" file containing lots of zeroes which upon backup are ignored by tar aso. But 32K for two lines of text is 32K.
I'm puzzled by all this. What is the sense of a logfile with login info which is not readable by normal means and consumes **** of disk space ? Can anybody enligthen me ?
#!/usr/bin/perl -w
require '';
$utSize = 28;
$utTemplate = 'l A8 A16';
$utBuffer = ' ' x $utSize;
$uid = 0;
open (LASTLOG, '</private/var/log/lastlog') || die "can't open lastlog ($!)\n";
while (sysread (LASTLOG, $utBuffer, $utSize) == $utSize)
($time, $line, $host) = unpack ($utTemplate, $utBuffer);
if ($time != 0)
$user = (getpwuid ($uid))[0];
print "$user on $line ";
print $host eq '' ? "(local)" : "from $host";
print " at ", &ctime ($time);
close (LASTLOG) || die "can't close lastlog ($!)\n";
OSX Server   Mac OS X (10.4.8)  

Sir, please !!
> But it does not answer why lastlog is redundant
with wtmp
It isn't redundant. They store different data. OK,
fair enough, there is some overlap, but the
fundamental data is different.
Which fundamental data ?
> why unlike other log files its a binary
It should be binary. A text file is too easy
to edit to hide your tracks (if you're trying to hide
the fact you were there).
You need root access to edit log files. If you have hacked the root password you can do anything anywhere anyway.
> why a sparse file
No idea.
why so gigantic over time
Because it's perpetual and doesn't get cleaned up.
Right or wrong I'm not saying.
Thats the observation, not the explanation.
> why it is not rolled in /etc/weekly like other
log files
Because it's a binary file, not a text file like
other log files. In addition, because it's keeping
state, you can't just remove the old file and start a
new one without risking corruption of the file.
You cannot gzip a binary file, no ?
That's not to say there shouldn't be some
process for managing the file, but it's not as simple
as you might think.
Your estimated guess. I miss the knowledge, though.
In fact there is ample discussion about lastlog and its design flaws and the backup and insane space consumption problems a sparse file implies ( ) . Listen to this one:
"And the file is just ancient cruft anyway. It stores the last login
time, terminal device (or X server), and remote host for each user. I
found a couple of non-glibc utilities that write to the file
(dhclient, useradd), but only one that actually cares to read it
(lastlog(8), which can only be run by root). If this thing went away
tomorrow, I doubt anyone would notice. Meaningful user login auditing
is done with other tools. Note also that this is a BSD feature, and isn't part of the SUSv2 spec. In 1979 on a VAX with 16 bit UIDs, this might have been a
worthwhile use of space (I found a 3BSD header that defined the
lastlog struct as a 12 bytes; the current glibc structure is 292 bytes
long). On a modern 64 bit linux, it leads to the 1.2TB monstrosity
we're shouting about. To all the "not a bug" folks: if you were
charged with deciding on a file format for storing 2 strings and a
time for each user, would this honestly be your choice?
Finally, note that its functionality is 100% duplicated by the wtmp
file and last(1) tool anyway (except for the misfeature of not storing the
user name and thus being unable to track changes in the passwd file).
One could duplicate lastlog(8) using last(1) with a few lines of perl. This file is a silly side effect of the change to 32 bit UIDs, and needs to be fixed."
The lastlog file is a *nix dinosaur left over from ancient times. OSX should do better. Anybody from Apple listening ?

Similar Messages

  • Read linux lastlog file and convert to a String

    I am trying to read the data from the lastlog file in Linux. I think this is a binary file encoded in ASCII. How would I go about reading this file and converting the binary data into a String and then displaying the data? Each bit of data is separated by a new line to distinguish between the different values.
    Many Thanks

    "Binary file encoded in ASCII"? Well, you'd have to find out what encoding was used and then reverse is.
    As for reading files in general, check here:

  • Small Mysteries

    I created a poster in Pages, and for one Text Box used Gloucester MT Extra Condensed font. After exporting as a PDF, I imported from that PDF into Aperture 2.1.3. Two mysteries developed:
    1) the text in this font displays in Aperture with color blue, but when printed from Aperture is black as it was in Pages and the PDF;
    2) although it appeared the metadata, when viewed in Aperture, was correct as to the time this image was created, when uploaded to a SmugMug gallery that is sorted by date & time, it appeared as first image despite having a later date than any other image in the gallery.
    The second issue was worked around by opening the PDF in Photoshop CS3 and manually converting it to a TIFF image (after flattening), and then importing that into Aperture (btw, Aperture always correctly sorted the image by date in its displays). However, the color for that particular text remains blue as displayed in Aperture, but prints as black. It also displays correctly as black when viewed in the SmugMug gallery, or with Photoshop or Preview.
    Sorting is by date taken because images from three different cameras are involved, and their dates & times were synced in advance.

    I am in Safe Mode now: This is the weirdest thing: A bit from column A AND B:
    The display is perfect EXCEPT for two parallel lines of 17, 3 millimeter-long black lines that follow the pointer everywhere it goes.
    Get this: my current display is 1024x768, but when I change it to 640x480, the pointer and everything is perfect! (of course, I can only see a fraction of my desktop)
    But then again... when I zoom in and out holding down control (in 640x480) the pointer lines appear again, but less lines. They disappear when I re-reset it to 640.
    But yeah, safe mode is NEAR perfect with the except of the cursor lines. I can screen grab my cursor though to show...

  • 16-bit vs 8-bit Mysteries

    I think I've read almost every 8bit vs. 16bit debate over the past 6 years, including those by Fraser and Margulis. I still remained bit confused, so I tried to develop some tests of my own. I didn't get very far because I stumbled over some mysteries. I'm hoping some gurus with more experience can shed some light.
    Details follow, but in summary, why does the Photoshop Info Pallet show "odd" 16bit values on 8bit images? Why does Photoshop generate different 16bit values from the same 8bit values?
    Here are my initial testing steps:
    Set Up:
    Fire up Photoshop. I'm using CS5 64bit in Windows 7 64bit, but I expect these tests would be the same under any version. Select the Eyedropper Tool and change the sample size to "point sample". Go to the Info Pallet, set one of the readout values to RGB (if not already there by default.) Then set the value to 16 bit by clicking on the eyedropper next to the RGB values.
    MYSTERY 1:
    1A. Generate a new blank document, 500x500 pixels, 8bit mode. sRGB colorspace.
    2A. Bring up the Color Picker window and set all RGB values to 149. There is nothing special about 149. You can use any value. I picked it because it matches the "50% gray" value in the Swatches pallet that I use in other tests.
    3A. Fill the image with this value. Several ways to fill, I use the Paint Bucket. 
    4A. Use the "point sample" Eyedropper tool to read the 16bit RGB values in the Info Pallet. See 16bit values of 19147 for the 8bit value 149. 
    That's the mystery. Why is the 16bit value an odd amount? In 16 bits there are 128 steps between each 8 bit value. You would think that 8 bit values would be in integrals of 128. So an 8 bit value of 149 should be 148 X 128 = 19072, not 19147. 
    MYSTERY 2: 
    2A. Generate a new document, 500x500 pixels, 16 bit mode. 
    2B. Go to Swatches pallet, click on the "50%" gray swatch, top right row. 
    2C. Bring up Color Picker window, see that RGB values are all 149. 
    2D. Use Paint Bucket tool and fill the image. 
    2E. Wave the mouse around the image and see that the 16bit RGB values are all 19131. 
    2F. Bring up the Color Picker window and simply retype any one of the RGB values with the same value. Apparently this causes Photoshop to reset the values. 
    2G. Re-fill the image with the "reset" values. 
    2H. Sample around the image and see that the 16bit RGB values are now all 19147. 
    2I. Repeat often, filling the image with RGB 149 values first set by the Swatches pallet, then set with the Color Picker. Notice that the 16bit readout in the Info pallet switches back and forth between 19131 and 19147. 
    So, why does Photoshop generate different 16bit values from the same 8bit values, depending on where you get the 8bit values (Color Picker vs. Swatches)? Note: different colorspaces generate different values from the Swatches pallet, as expected, but the mystery of getting different 16bit results from identical looking 8bit values still happens, regardless of colorspace. 
    MYSTERY 3: 
    3A. Generate a new doc in 16bit mode. 
    3B. Go to Swatches pallet, click on the 50% gray swatch. 
    3C. Use the Paint Bucket tool and fill the image. 
    4D. Sample the image with the Eyedropper, verify all values are 19131. 
    5E. Use Image/Mode and convert to 8bit. 
    6F. Wave the mouse around the image and see that the 16bit values have changed. Most are 19147, but a few are 19018. Magnify the image to the max to see and sample individual pixels. There is no apparent pattern to the 19018 value pixels. They appear to be random. 
    So, why does Photoshop NOT apply the same math to every pixel during a 16bit to 8bit conversion? 
    The only explanation I can think of for these mysteries is that maybe the Info Pallet is giving bogus numbers for 16bit values. Perhaps the math performed on the actual pixels is different from the math used to calculate and display the values in the Info Pallet. In which case, what we see is not what we get?

    Photoshop 16 bit integer data is really 15 bits plus a tiny bit more.
    black = 0
    white = 32768 = 0x8000
    Yes, that seems strange, but it's the way it is.
    Plus I recall seeing (in the Plug-in SDK) some conversion math that led me to believe it was optimized for speed rather than numeric accuracy.  I'll try to find that again.
    Hopefully this might help explain some of what you're seeing.
    P.S., there was a thread a while back in the Camera Raw forum in which it was shown that color management operations were introducing dithering in 8 bit data.  It's possible the operations you're using are invoking the same quirk from the Adobe color management engine.

  • Mysteries of Java number 32,194

    Mysteries of Java number 32,194:
    Why the class URL has methods marked "protected", even though it is itself marked "final".

    Hey they are thinking about it... for 3 years now
    These things take time.

  • Why does lastlog say ive never logged in?

    So I was checking out some threads on noost forums and I came across a thread about somebody who got a message when they tried to shut down saying that they need to input the root password to log out multiple users.  This was strange becase there was only supposed to be one user logged in.
    I was trying to remember which command to input to check who has logged in.  I rememberd lastlog and I tried it on my own machine just to make sure it was the right one. To my astonishment lastlog on my machine says nobody has ever logged in, including me.
    [[email protected] ~]$ lastlog
    Username Port From Latest
    root **Never logged in**
    bin **Never logged in**
    daemon **Never logged in**
    mail **Never logged in**
    ftp **Never logged in**
    http **Never logged in**
    nobody **Never logged in**
    dbus **Never logged in**
    tj **Never logged in**
    hal **Never logged in**
    policykit **Never logged in**
    avahi **Never logged in**
    gdm **Never logged in**
    mpd **Never logged in**
    awesome **Never logged in**
    ice **Never logged in**
    tor **Never logged in**
    privoxy **Never logged in**
    [[email protected] ~]
    I was like wtf
    I also looked at var/log/user.log and its blank
    Does this mean my logs have been somehow erased?
    I dont have remote acesss or anything like that enabled afaik, how could this happen?

    maybe a syslog misconfiguration.
    here a workaround
    cat /var/log/auth.log | grep login

  • Lastlog file management

    My /var/log/lastlog files are growing like weeds. On one of my systems that's just over one year old the lastlog file is over 1.6GB. yes. Gig.
    I don't see any sign in the daily/weekly/monthly scripts that the file is getting rotated. I tried renaming the file, but a subsequent logon just recreated the file AT THE SAME SIZE.
    How do I clean up this file (or utmp/wtmp if necessary)?

    Hi MacMuse,
    I think the size of the lastlog file will be approximately 28bytes*(largest uid of users who have ever logged in).
    What is your uid on your Mac? (use the 'id' command if you don't know your uid).
    If your uid has a "normal" value (such as 501), then I have no idea why your lastlog file is so large.
    If your uid is very large, then it is unavoidable that the lastlog file becomes very large once you login.
    On most UNIX/LINUX systems the loatlog file is a "sparse file" and does not take up large disk space even if there is a user with very large uid. But HFS+ on MacOS X does not support the sparse file and so I think your lastlog file is actually using a large disk space.
    I tried renaming the file, but a subsequent logon just recreated the file AT THE SAME SIZE.
    So your last log file will be "THE SAME SIZE" if it exists and once you login.
    But I think the lastlog file will not be automatically re-created if you remane (or remove) it. After you rename the file, please try shutdown and reboot.
    PowerMac G4   Mac OS X (10.4.8)  

  • Root login is blocked from telnet ssh pam_unix_session: Can't write lastlog: uid 0: I/O error

    Root login is blocked from telnet ,ssh  error : pam_unix_session: Can't write lastlog: uid 0: I/O error
    sshd[1969]: pam_unix_session: Can't write lastlog: uid 0: I/O error
    sshd[1970]: pam_unix_session: Can't write lastlog: uid 0: I/O error
    sshd[1983]: pam_unix_session: Can't write lastlog: uid 0: I/O error
    sshd[1984]: pam_unix_session: Can't write lastlog: uid 0: I/O error
    sshd[2023]: pam_unix_session: Can't write lastlog: uid 0: I/O error
    sshd[2021]: pam_unix_session: Can't write lastlog: uid 0: I/O error
    genunix: vn_rdwr failed with error 0x6
    genunix: kobj_load_module: smp read header failed
    genunix: vn_rdwr failed with error 0x6
    genunix: kobj_load_module: ses read header failed
    sshd[2037]: pam_unix_session: Can't write lastlog: uid 0: I/O error
    sshd[2035]: pam_unix_session: Can't write lastlog: uid 0: I/O error
    please suggest for the issue , occurs frequently in solaris 10

    please verify your underlying hardware

  • Mystery of mysteries. Can't get rid of "Glossary" text on Favorites tab.

    I consider myself relatively well-versed in chm file compiling and chm related issues, but this one has me stumped...
    System Specs;
    RH 9 now (initial English help in background below was compiled using RH 7)
    Windows 7 64-bit
    First, the background -- We use RoboHelp to compile our English CHM. We then decompile the files from the CHM and ship those off for localization. When they come back from translation, we use usually use FAR HTML to recompile the help. Sometimes we use RH (if FAR HTML is being tempermental). And in rare cases, like today, we use both. So today I was working on compiling a Traditional Chinese help we got back from translation recently. I tried using FAR HTML as usual for the initial post-translation compile. I ran into various and sundry compiler errors that made no sense whatsoever, so I decided to try compiling it in RH instead. The compilation made it through, but the Contents and Index tabs weren't displaying the proper Chinese characters. So I took this Traditional Chinese chm that was compiled by RH, decompiled it, and tinkered with .hhc and .hhk file encoding and charsets and used FAR HTML again to compile. And this time compiling worked without a hitch. We got proper characters. Yay! So far so good. Well, sort of. That's just the background.
    Now, the problem -- So now, compiling back in FAR HTML from the above decompiled RH 9 files, I'm getting a psuedo Glossary tab I don't want since in our localized versions of the help. (We simply just call an htm containing the glossary info, and tie the htm to the toolbar.) I say "pseudo" because here's what the navigation pane on the compiled help looks lilke:
    Notice that the Favorites tab is actually somehow getting named as "Glossary".  We don't want this. I want the default "Favorites" text for the tab. If I unregister the hhactivex.dll and recompile, the "Glossary" string on the tab thankfully goes away, showing just "Favorites". If I register the dll again or move the compiled help onto a system with a registered hhactivex.dll, the problem reappears all by itself when the help is launched.
    How can I get my Favorites tab back to normal? I suspect this problem is contained somewhere in the HHP file, specifically my Windows definition. But I've tried recreating the hhp, and the window definition many times, but it still appears. I even at one point tried removing the Favorites tab but then the mystery "Glossary" text moves onto infesting the Search tab.
    Here's my hhp innards if it helps:
    Binary TOC=No
    Binary Index=Yes
    Compiled File=pcdlrn.chm
    Contents File=pcdlrn.hhc
    Index File=pcdlrn.hhk
    Default Window=HtmlHelp
    Default Topic=intro.htm
    Default Font=,,136
    Full-text search=Yes
    Auto Index=Yes
    Language=0x404 Chinese (Traditional/Taiwan)
    Title=PC-DMIS Help
    Create CHI file=No
    Compatibility=1.1 or later
    Error log file=_errorlog.txt
    Full text search stop list file=
    Display compile progress=Yes
    Display compile notes=Yes
    HtmlHelp="PC-DMIS Help","pcdlrn.hhc","pcdlrn.hhk","intro.htm","intro.htm","pcdlrn_glo.htm","Glossary Button",,,0x61520,244,0x4386E,[432,113,1354,863],0xB0000,,,,,,0
    ... and a bazillion other files ...
    #include Core.ali
    #include BSSCDefault.h
    Is RH somehow still doing something to it even though technically I'm not using it to compile? Is there some other setting or file somewhere that could be controlling this or is it just a compiler bug that I've never noticed?

    Thanks Cara, but I'm not sure if that's the same thing. In this problem the Favorites tab in the CHM was showing up with the word "Glossary" in it. Anyway, it's water under the bridge now for me. Things are better now that we're localizing our Engish RH project directly, instead of our old way of decompiling the English chms and sending the decompiled htms.

  • Unable to connect and other mysteries

    I am running 10.5.6 on MacbookPro - I am having the following problems
    * Safari - "Safari could not open the page “” because the server is not responding." - Firefox is working fine
    * Mail - Connection status - "Mail was able to connect to internet" BUT for every mail account I get "could not connect to server message".
    * iChat - works fine
    What is going on?

    I think I'm experiencing the same issue.
    My MacBook Pro has been running smoothly for the last year. I don't think any mail settings have been changed or altered in the past six months. This morning I retrieved email from seven mailboxes associated with the same account. But, this afternoon, every time I selected "check mail" another mailbox would fall offline and request I enter the password info.
    Despite running disk utility (verify disk permissions & repair disk permissions) and re-entering the password account info in the mail preferences, the problem is still persisting.
    Definitely, bizarre behavior.

  • ICloud is switched on but won't open on the internet and other annoying iCloud mysteries.

    Using iCloud between iPhone iPad and iMac. For some reason all my notes are not on all three devices. Spent hours the other day trying to fix that to no avail. Now using the iPad. iCloud is on in the settings menu but when I go to the internet it gives me the front page of iCloud that had only three choices. Download iCloud or find my phone or find my friends. What is going on? Why won't it open to my iCloud page?

    You can't access from a mobile device.
    First check that all your settings are correct, that notes syncing (mail and notes on a computer) is checked on all devices (system preferences > iCloud on a mac and settings > iCloud on a iPhone, iPad or iPod).
    Make sure the notes you are adding are added to your 'iCloud' account and not an 'On My Mac', 'On My Phone'  or other non iCloud account (you can do this by checking in accounts on an iOS device, or the left side panel in mail on a computer), non iCloud notes will not sync.
    If you are sure that everything is set up correctly and your notes are in the iCloud group, you might try unchecking notes syncing (mail and notes on a computer) in the iCloud settings, restarting your device and then re-enabling notes syncing.

  • How to limit /var/adm/wtmpx and /var/adm/lastlog

    As many others I have a problem too with these files growing indefinitely.
    I wanted to know if there is any system configuration or system program to limit or trim the size of these files.
    I am OK if the oldest records get purged, but I don't want these files to grow indefinitely.
    I appreaciate any suggestions and help.

    I think the easiest would be to use 'dd' to copy the file to a temporary area and then back again:
    dd if=/var/adm/wtmpx of=/tmp/ bs=372
    dd if=/tmp/ of=/var/adm/wtmpx bs=372 skip=$number_of_blocks_to_skip
    The variable $number_of_blocks_to_skip is simply an arbitrary number you're comfortable with. You can build that up by using 'wc' to find the number of lines (blocks) in the file:
    wsize=`wc -l /var/adm/wtmpx | awk ' { print $1 } '`
    number_of_blocks_to_skip= `expr $wize - 1000` (this will ensure that the skip is until 1000 blocks from the end)

  • The mysteries of JDBC, JNDI, and Tomcat 5.5.4

    Like thousands beforefore, I can't get connection pooling to work in Tomcat. I followed all the steps:
    - put jar file for MySQL JDBC driver in TOMCAT_HOME/common/lib
    - put the Jakarta Commons libs in the same location
    - put resource declaration in META-INF/context.xml, per the Tomcat 5.5 docs like so:
    <Context docbase="C:\Program Files\Apache Software Foundation\Tomcat 5.5\webapps\commutercorps"
        path="\commutercorps" >
        <Resource name="jdbc/commutercorpsds"
    </Context>- added resource ref in web.xml
            <description>DB Connection</description>
        </resource-ref>I also double checked my connection URL and found that it does work fine when do this in my Java code:
    Connection con =
        ("jdbc:mysql://localhost:3306/commuter_corps_signup", "...", "...");When I try to use Tomcat 5.5.4, JNDI like this...
                        InitialContext initialContext = new InitialContext();
                        DataSource dataSource =
                                (DataSource) initialContext.lookup
                        Connection con = dataSource.getConnection();
                        Statement stmt = con.createStatement();
                    } catch (NamingException e)
                    }...I get...
    Cannot create JDBC driver of class '' for connect URL 'null'
    Caused by: java.sql.SQLException: No suitable driver
    Any help would be greatly appreciated.

    I used to get the message
    Cannot create JDBC driver of class '' for
    connect URL 'null'
    No suitable driverError.
    I was running, jakarta-tomcat-5.0.14.exe on windows.
    I had it installed on a path without spaces
    I wanted to use Hibernate. So i used, extensiontools.What's that?
    First create a env var: HIBERNATE_HOME pointing to
    the hibernate extracted dir.No need for this.
    Modify setenv.bat to correct %CP% for
    commons-logging, commons-collection and anything
    else: the version string at the end of the jar
    changes.Wrong. You shouldn't be doing this.
    Then run ddl2hbm, straightforward, fill info in all
    tabs and hit generate. Will show some error message,
    but still creates xmls.I don't see what any of this has to do with Tomcat deployment.
    Then run hbm2java, and hand over each xml file as
    parameter. Creates some java files in generated dir.
    Modify the toString method to something simpler and
    remove the import for apache class.All great, but still has nothing to do with Tomcat deployment.
    move them over to webapp classes.You should create a WAR file or a separate context directory for your application under /webapps. If you're doing anything else, it's wrong.
    Create JNDI in sever.xml as mentioned.Nope. Shouldn't be editing server.xml. Put that stuff in an application-specific context.xml, which goes in the META-INF of your WAR file.
    Create reference in web.xml as mentioned.Good.
    Goto conf/catalina/localhost/<webappname>.xmlNo need for this. Don't know what you're doing here.
    add the line
    <ResourceLink name="jdbc/Oracle"
    type="javax.sql.DataSource" global="jdbc/Oracle"/>
    replace Oracle with your datasource name.
    and i got me workingMight be working, but it's not really correct.

  • KVM mysteries

    I have a new 23" Cinema Display that I would like to use with my standard KVM 4 port switch. I would like to be able to switch between my powerbook, a G4, G5 and a PC. I've been looking for a female DVI to male 15 pin cable to plug the Cinema Display to my KVM. Anybody have any experience with this or any suggestions on if it can even be done? I have seen a DVI KVM but the older Macs and PCs don't have DVI.

    Looking for a KVM that will perform it's duty on my system.
    I Have a 21" Apple Studio Display (CRT). Great monitor for print graphics.
    I am running a dual 2g G5:
    Machine Model: PowerMac7,2
    CPU Type: PowerPC 970 (2.2)
    Number Of CPUs: 2
    CPU Speed: 2 GHz
    L2 Cache (per CPU): 512 KB
    Memory: 2.5 GB
    Bus Speed: 1 GHz
    Boot ROM Version: 5.0.7f0
    I also have a G4 450 with scsi connectors that I use to run a very nice Epson scanner. Plenty of RAM and HD space. May be used for Back-ups as well.
    I want to use both of these Macs on my single monitor.
    I have tried the Belkin flip (regular w/remote button - no video - and the Mac Mini version - chaos! ... opening CD trays, volume up and down, auto monitor switching). I am not alone in that experience as I have found out!
    I tried the iogear 2 port USB KVM - no video. Customer support was helpful but unable to solve the problem as they just discovered that it wont support the Studio Displays. I was impressed with their efforts though.
    I am currently connecting my Studio Display to the G5 by a VGA to DVI Apple connector.
    All this said, is there a reasonably priced KVM that will handle this set-up?
    All I need is a 2 port USB KVM. It doesn't have to be pretty either!
    G5/G4   Mac OS X (10.4.7)   Apple 21" Studio Display

  • The mysteries of auto sleep

    When I purchased my iMac it came with Leopard 10.5.6 and auto sleep worked without problems, but after updating to 10.5.7 my iMac no longer went to sleep automatically and this continued after 10.5.8. Updated my iMac to Snow Leopard 10.6, everything went perfectly and to my surprise auto sleep worked absolutely perfectly, whatever I set it too. But, I updated to 10.6.1 and auto sleep has gone again. It's not a big deal, but I've been really impressed with Snow Leopard and so surprised to see this problem come back. Tried most of the suggestions that people make, without success and beyond Apple programs, have very little installed on my system. Just wondered if anyone had any brilliant ideas on this?

    This is for a Mac that won't sleep.
    Here is Apple's KB article HT1776 with their tips.
    Mine follow;
    USB devices and hubs often cause Macs to not sleep or wake quickly from sleep (notably HP printers and scanners, HP all in ones, and Cannon scanners). Disconnect all USB except for keyboard and mouse and try. If it sleeps, add one back at a time testing after each one to find the culprit.
    If you've set your Mac to receive faxes, it may not be able to sleep. It might also have a damaged preferences file.
    If you use your Mac for faxing, open System Preferences. click Print & Fax, click the Faxing tab, and uncheck the Receive Faxes On This Computer box.
    If that doesn't work or you've never faxed on your Mac, go to Finder/Hard Drive /Library/Preferences/SystemConfiguration and delete the and files (if your Mac asks, type your admin. password).
    If the latter file isn't present in the folder, go to user name(probably your name)/Library/Preferences, delete the file, and reboot your Mac.
    Hope this helps!
    P.S. One member here reported this (Michael Gleason);
    "I have had this problem with my IMac G5. It is surprisingly irritating. LaCie's Silverkeeper backup software was the cause. By default it gave itself permission to wake up the computer to check if a backup was needed. Do you have this or a similar program installed which has scheduled activities including wake-up permissions as an option?"
    Dave Hamilton provided this link,, to a member, which addresses failure of deep sleep with some users that updated and added new FireWire and USB card.
    Also, here is Apple KB article TA2469 about PCI cards and sleep.
    tomhorvat adds this; After few days of messing around I found out that I had desktop background (wallpaper) set to change every 1 minute.
    After unchecking "Change picture..." in system preferences (under Desktop/Screen saver), my powerbook went to sleep all by itself.
    Tristan Currier noticed this; "I have a Canon printer(shared) and my imac would not sleep. I opened up printer/fax in system prefs and noticed it said the printer was in use when it was off. Opened up the printer queue and noticed about 7 pending documents. Deleted them all and now it sleeps.
    Check the printer queue!"
    Allan Jones says "sometimes there is Network activity: launch System Preferences > Energy Saver > "Options" tab and uncheck "Wake for Ethernet network administrator access."
    Good Luck!  DALE

Maybe you are looking for

  • Access - How to create Mail Address only list?

    Printing envelopes from mail lists - via Microsoft Excel? Access - How to create Mail Address Only list? Bearing my "new boy" status, step by step instruction would be appreciated.

  • How to superimpose still images onto video?

    Hi there, I'm an absolute beginner with iMovie (and video editing in general), so please forgive my ignorance! OK, my question is this: Is it possible to superimpose still images on top of video in iMovie, and if so how? I'm using iMovie because it h

  • Quick albeit dumb question...

    I Use Mail. I have .Mac. what is all the "on my mac mailboxes" and why do they have different items in them from my mailboxes that display my name? Under notes i have my name but then under that i have notes that are in "on my mac" like to get rid of

  • Help with LEN VLOOKUP so close as well!

    Hi I thought I had finished my spreadsheet but when checking it I stumbled across an error.  I'm hoping that someone out there can help me solve it! Here is a screen shot I have taken.  You can see that there are two tables.  The bottom table has ath

  • Handling Database failure in Write-Behind

    Hi, In the link mentioned below it is mentioned that "The application is somewhat insulated from database failures: the Write-Behind feature can be configured in such a way that a write failure will result in the object being re-queued for write" htt