interface to launchd
Mac OS's master task invoker

launchctl [subcommand [arguments …]]

Handles configuration and requests to load, unload daemons/agents.


list  [label]
 launchctl list
PID Status  Label
-   0   ‡parentalcontrols.check (‡ is
297 0   ‡Finder
-   0   ‡PackageKit.InstallStatus
435 0   ‡mediaremoteagent
-   0   ‡FontWorker
303 0   ‡bird
-   0   ‡familycontrols.useragent
-   0   ‡universalaccessAuthWarn
389 0   ‡nsurlsessiond
-   0   ‡syncservices.uihandler
345 0   ‡iconservices.iconservicesagent
425 0   ‡ContactsAgent
-   0   ‡ManagedClientAgent.agent
-   0   ‡screensharing.agent
List non apple tasks:
sudo launchctl list |\
     sed 1d |\
     awk ' !/0x|apple|edu\.|org\./ { print $3 } '

 sudo launchctl list
{ "Label"="";
  "ProgramArguments"=( "/usr/libexec/dpd";);
  "MachServices"={ ""=mach-port-object; };
multiple lines joined for your viewing pleasure
/System/Library/LaunchDaemons > sudo launchctl list
{ "Label"="";
  "ProgramArguments"=( "/usr/sbin/syslogd"; "-d";);
      "AppleSystemLogger"=( file-descriptor-object;);
      "BSDSystemLogger"=( file-descriptor-object;);
  "MachServices"={ ""=mach-port-object; };
print target
sudo launchctl print pid/374  rearranged{
    active count=21 on-demand count=1 service count=20 active service count=0
    activity ratio=0.00
    creator euid=501
    external activation count=0
    security context={ uid=501 asid=100007 }

    bringup time=1 ms death port=0x6431b

    in-progress bootstraps=0
    pended requests=0 pending requests={ }
    subdomains={ }
    pending attachments={ }

        PATH => /usr/bin:/bin:/usr/sbin:/sbin
        SSH_AUTH_SOCK => /private/tmp/
        Apple_PubSub_Socket_Render => /private/tmp/
        HOME => /Volumes/DATA/dgerman
        TMPDIR => /var/folders/03/jm885yvs39qdz6p_3r6bvhnh0000gn/T/

( ‡ is
    0 - ‡coremedia.videodecoder                   0 - ‡security.pboxd
    0 - ‡LookupViewService                        0 - ‡coremedia.pluginformatreader
    0 - ‡appkit.xpc.openAndSavePanelService       0 - ‡audio.DriverHelper
    0 - ‡foundation.UserScriptService             0 - ‡appkit.xpc.documentPopoverViewService
    0 - ‡CGXPCServicesAgent                       0 - ‡audio.InfoHelper
    0 - ‡ColorSyncXPCAgent                        0 - ‡MTLCompilerService
    0 - ‡automator.xpc.workflowServiceRunner      0 - ‡appkit.xpc.VersionsUIHelper
    0 - ‡DataDetectors.DataDetectorsActionService 0 - ‡audio.SandboxHelper
    0 - ‡CMValidateMovieDataReferenceService      0 - ‡coremedia.videoencoder
    0 - ‡audio.ComponentHelper                    0 - ‡audio.ComponentTagHelper

    unmanaged processes={ }

 59803  A D   ‡SpeechRecognitionCore.brokerd          1e103  A A   ‡CodeSigningHelper
 5910b  A D   ‡security.XPCTimeStampingService        59703  A D   ‡iokit.IOServiceAuthorizeAgent
 59403  A D   ‡DictionaryServiceHelper                59307  A D   ‡appkit.xpc.sandboxedServiceRunner
 2290b  A A   ‡PerformanceAnalysis.animationperfd     1e003  A D   ‡iokit.ioserviceauthorized
 22103  A D   ‡internal.aupbregistrarservice          64083  M D   ‡MTLCompilerService
 1de03  A A   ‡authd                                  59503  A D   ‡hiservices-xpcservice
 59903  A D   ‡accessibility.mediaaccessibilityd      59603  A D   ‡security.XPCKeychainSandboxCheck

    externally-hosted endpoints={ }

    task-special ports={
             30103 4       bootstrap  ‡xpc.launchd.user.domain.501.100007.Aqua
             1ac03 9       access  ‡taskgated

        shutting down=0 slain=0 uncorked=1
        origin resolved=1
        deactivated=0 inactive=0
        initial on-demand=0 audit check done=0 bootcache hack=0 cocooning=0
        gui=0 gui login=0 exec hack=0
blame service target
   [-S sessiontype]
   [-D domain]
Load configuration files (example: /System/Library/LaunchDaemons/ or
directories of configuration files.
-Force the loading of the plist, i.e. Ignore Disabled

-S sessionType restrict which jobs are loaded into which session types.
      Aqua, LoginWindow, Background, StandardIO and System.

-D Look for jobs in a different location an allows

-D domain Look for plist files ending in *.plist in the domain given.
   Valid domains include
system, local, network and all., user with a session type
For example, without a session type
-D system loads from property list files from : /System/Library/LaunchDaemons.
With a session type passed, it would load from : /System/Library/LaunchAgents.

sudo launchctl
launchd% load /System/Library/LaunchDaemons/ftp.plist
bind(): Address already in use Already loaded
-w depricated: Remove disabled from plist and write the configuration files.
   [-S sessiontype]
   [-D domain]

Stop the job if it is running and
Unload the specified configuration files or directories of configuration files.
/System/Library/LaunchDaemons > sudo launchctl unload

Disables are (as of 10.6.x) stored in
as entries like:

    <key>Disabled</key> <true/>

start Labels …
stop  Labelss …
stop the specified jobs by Label.
Jobs will restart automatically if demand driven. i.e. KeepALive, watchpaths, QueueDirectories, StartOnMount, StartInterval, Sockets or StartCalendarInterval
submit  -l label
[-p executable]
[-o path]
[-e path]
-- command [args]
submit a program to run without a configuration file.
launchd will keep the program alive in the event of failure.
-p program
-o path to send program's stdout
-e path to send program's stderr
remove label from launchd
log [level loglevel]
only | mask loglevels..]
Get and set the syslog(3) log level mask.
debug, info, notice, warning, error, critical, alert and emergency.
limit resource
[soft hard]]
[both |
With no arguments, displays all the resource limits via getrlimit(2).
resource      soft          hard      
cpu         unlimited      unlimited      
filesize    unlimited      unlimited      
data        unlimited      unlimited      
stack       8388608        67104768       
core              0        unlimited      
rss         unlimited      unlimited      
memlock     unlimited      unlimited      
maxproc     266            532            
maxfiles    256            unlimited      
limit resource , displays the limits for that resource.
limit resource hhss , sets both the hard and soft limits to same value.
limit resource hh ss sets        the hard and soft limits.
This configuration file only applies to the hosts listed with this key.
Set kern.hostname name in for this feature to work reliably.
LimitLoadToSessionType see -S
EnableGlobbinguse the glob(3) mechanism to update the program arguments before invocation.
umask [newmask] Get or set the umask(2) of launchd. default 022 (i.e. files are created 755 rwxr-xr-x )
[un]setenv key value [un]Set an environmental variable inside of launchd.
getenv key Get an environmental variable inside of launchd.
export Export environmental variables of launchd for use in a shell eval statement.
launchd% export
PATH="/usr/bin:/bin:/usr/sbin:/sbin"; export PATH;
   self | children
Get the resource utilization statistics for launchd or the children of launchd.


launchd% getrusage self
0.308193   user time used
3.970984   system time used
0          max resident set size
0          shared text memory size
0          unshared data size
0          unshared stack size
0          page reclaims
0          page faults
0          swaps
 30        block input operations
  3        block output operations
353        messages sent
249        messages received
  0        signals received
621        voluntary context switches
  0        involuntary context switches
launchd% getrusage children
 220.193474   user time used
 126.145974   system time used
 68022272     max resident set size
 0            shared text memory size
 0            unshared data size
 0            unshared stack size
 1447425      page reclaims
 33518        page faults
 0            swaps
 26113        block input operations
 18913        block output operations
 81014        messages sent
 8076         messages received
 217          signals received
 63150        voluntary context switches
 900358       involuntary context switches
bslist List Mach bootstrap services and optional servers

active (A), inactive (I) and on-demand (D).

prefix is

D .launchd.peruser.4294967294
A .launchd.peruser.501
D .launchd.peruser.65
A .windowserver
D .webfilter
D .UNCUserNotification
D .taskgated
A .system.logger
D .spinreporterd
D .smbfs_load_kext
D .service_helper
A .SecurityServer
D .seatbelt.compilerd
D .iokit.scsid
D .ReportCrash.SafetyNet
D .ReportCrash
D .ReportCrash.DirectoryService
A .RemoteDesktop.PrivilegeProxy
D .ocspd
A .system.notification_center
D .netauth.sysagent
D .mio.VDCAssistant
D .mio.IIDCVideoAssistant
A .metadata.mds
D .mDNSResponderHelper
A .mDNSResponder
A .UNCUserNotification.session.256
A .O3Master
D .lockd
D .system.Kernel[UNC]Notifications
A .KernelExtensionServer
D .KerberosAutoConfig
D .java.updateSharingD
D .installdb.system
D .IIDCAssistant
A .iohideventsystem
D .system.hdiejectd
D .gssd
A .FSEvents
D .familycontrols
D .dyld
A .distributed_notifications.2
A .DiskArbitration.diskarbitrationd
D .DirectoryService.localonly
A DirectoryService::CPluginRunLoopThread.14
A .DirectoryService
A .system.DirectoryService.libinfo_v1
A .CoreServices.coreservicesd
A .network.IPConfiguration
A .network.EAPOLController
A .SystemConfiguration.PPPController
A .PowerManagement.control
A .SystemConfiguration.configd
D .bsd.dirhelper
D .BluetoothNILServer
D .backupd
D .automountd
A .audio.coreaudiod
D .FontObjectsServer
A .alf
D .airport.updateprefs
D .airportd
D .airport.wps
D .dashboard.advisoryd
D .mio.AVCAssistant

singleuserHappens instantly without confirmation!
bsexec Execute a process within a different Mach bootstrap subset
help As of Elcaptian 10.11.6

launchctl subcommand … | help [subcommand]
Many subcommands take a target specifier that refers to a domain or service within that domain. 
The available specifier forms are:


Targets the user domain or service within. 
A process running as the target user may make modifications. 

Each GUI domain is associated with a user domain, 


Only the process which owns the domain may modify it. Even root may not do so.

When using a legacy subcommand which manipulates a domain, the target domain is inferred from the current execution context. 
When run as root (whether it is via a root shell or sudo(1)), the target domain is assumed to be the system-wide domain. 
When run from a normal user's shell, the target is assumed to be the per-user domain for that current user.

    bootstrap       Bootstraps a domain or a service into a domain.
    bootout         Tears down a domain or removes a service from a domain.
    enable          Enables an existing service.
    uncache         Removes the specified service name from the service cache.
    kickstart       Forces an existing service to start.
    attach          Attach the system's debugger to a service.
    debug           Configures the next invocation of a service for debugging.
    kill            Sends a signal to the service instance.

    blame           outputs the reason a service is running.
    print           outputs a description of a domain or service.
    plist           outputs a property list embedded in a binary (targets the Info.plist by default).
    resolveport     Resolves a port name from a process to an endpoint in launchd.
    limit           Reads or modifies launchd's resource limits.
    runstats        outputs performance statistics for a service.
    examine         Runs the specified analysis tool against launchd in a non-reentrant manner.
    config          Modifies persistent configuration parameters for launchd domains.
    dumpstate       Dumps launchd state to stdout.(big)

    reboot          system 
    bootshell       from single-user mode with a console shell.

    load            Bootstraps a service or directory of services.
    unload          Unloads a service or directory of services.
    remove          Unloads the specified service name.
    list            Lists information about services.
    start           Starts the specified service.
    stop            Stops the specified service if it is running.
    setenv          Sets the specified environment variables for all services within the domain.
    unsetenv        Unsets the specified environment variables for all services within the domain.
    getenv          Gets the value of an environment variable from within launchd.
    bsexec          Execute a program in another process' bootstrap context.
    asuser          Execute a program in the bootstrap context of a given user.
    submit          Submit a basic job from the command line.
    managerpid  1     PID of the launchd controlling the session.
    manageruid  501   UID of the current launchd session.
    managername Aqua  name of the current launchd session.
    error           description of an error.
    variant     RELEASE 
    version     Darwin Bootstrapper Version 3.4.0: Sat Apr  2 20:54:16 PDT 2016; root:TempContent/launchd/RELEASE_X86_64
    help            outputs the usage for a given subcommand.


launchctl list |grep -i mozy
then                                   output edited to reduce display size and avoid line wrap
launchctl list "[0x0-0x10010].com.mozy.status"
{ "Label"="[0x0-0x10010].com.mozy.status";
  "LimitLoadToSessionType"="Aqua"; "OnDemand"=true; "LastExitStatus"=0; "TimeOut"=30;
  "/Applications/ Status";
  "MachServices"={ };
     ""=mach-port-object;          ""=mach-port-object;
     ""=mach-port-object;          "WakeUpProcessPort"     =mach-port-object; };
list      ( ‡ is
 PID Status  Label
1360 - 0x10b520.launchctl
1340 - 0x10b420.ssh
1330 - 0x10b320.bash
1329 - 0x1091c0.login
1281 - [0-0x2c02c].†AppleSpell
 972 - 0x10ab40.Backup
 317 - [0-0x18018].org.mozilla.firefox
 166 - 0x109fd0.bash
 165 - 0x109e40.login
 164 - [0-0x15015].†Terminal
 161 - [0-0x14014].†Safari
 159 - [0-0x13013].†Console
 141 - [0-0x10010].†speech.synthesis.
     - 0 0x108770.rcd
 131 - [0-0xd00d].†finder
 130 - [0-0xc00c].†systemuiserver
 126 - [0-0xb00b].†dock
     - 0 0x1071b0.BezelUIServer
     - 0 org.x.X11
 251 -   org.openbsd.ssh-agent
     - 0
     - 0 †CoreMIDIServer
 121 -   †UserEventAgent-Aqua
     - 0 †syncservices.uihandler
     - 0 †syncservices.SyncServer
 120 -   †Spotlight
     - 0 †ServerScanner
     - 0 †scrod
 118 -   †ScreenSharing.server
     - 0 †ReportPanic
     - 0 †ReportCrash.SafetyNet
     - 0 †ReportCrash
     - 0 †RemoteUI
     - 0 †RemoteDesktop.agent
     - 0 †quicklook
     - 0 †qtkitserver
     - 0 †PubSub.Agent
     - 0 †ProblemReporter
     - 0 †PreferenceSyncAgent
     - 0 †pictd
     - 0 †PCIESlotCheck
     - 0 †pbs
122  -   †pboard
     - 0 †NetworkDiagnostics
     - 0 †netauth.useragent
     - 0 †metadata.mdwrite.plist
     - 0 †java.updateSharingD_debug
     - 0 †installdb.user
     - 0 †imklaunchagent
     - 0 †helpdata
     - 0 †ATS.FontValidatorConduit
     - 0 †ATS.FontValidator
134  -   †FileSyncAgent
     - 0 †familycontrols.useragent
     - 0 †dotmacsync.uihandler
     - 0 †dotmac.notification
     - 0 †DictionaryPanelAgent
     - 0 †coreservices.uiagent
127  -   †ATSServer
     - 0 †alf.useragent
115  -   †AirPortBaseStationAgent
     - 0 †AddressBook.abd
114  -   †FolderActions.enabled
39   - 102AB0.loginwindow   ---.       
83   - 0x102940.WindowServer    |   
24   - 0x1025c0.securityd       |   
     - 0 †launchctl.Aqua        |   
166  - 0x10b220.bash            |
165  - 0x10b120.login           |
164  - 0x10b020.Terminal        |notice 
110  - 0x10af20.launchd         |multiple
     - 0 †FolderActions.folders |
76   - 0x1073c0.coreservicesd   |  
39   - 100DC0.loginwindow   ---'
     - 0
     - 0 †seatbelt.compiler
     - 0 †KerberosHelper.LKDCHelper
     - 0 †gssd-agent
     - 0 †launchctl.Background 
PS on same system
 1   0 /sbin/launchd
13  1 /usr/libexec/kextd          14  1 /usr/sbin/DirectoryService
15  1 /usr/sbin/notifyd          16  1 /usr/sbin/syslogd
17  1 /usr/sbin/configd          18  1 /usr/sbin/distnoted
19  1 /usr/sbin/mDNSResponder -launchd
24  1 /usr/sbin/securityd -i
28  1 /usr/sbin/ntpd -n -g -p /var/run/ -f /var/db/ntp.drift
29  1 /usr/sbin/cupsd -l
31  1 /usr/sbin/cron             32   1 /usr/sbin/update
33  1 /sbin/SystemStarter
37  1 /System/Library/CoreServices/RemoteManagement/AppleVNCServer.bundle/Contents/Support/RFBRegisterMDNS
38  1 /System/Library/Frameworks/CoreServices.framework/Frameworks/Metadata.framework/Support/mds
39  1 /System/Library/CoreServices/ console
40  1 /usr/sbin/KernelEventAgent
41  1 /usr/sbin/kdcmond -n -a
43  1 /usr/libexec/hidd
44  1 /System/Library/Frameworks/CoreServices.framework/
46  1 /sbin/dynamic_pager -F /private/var/vm/swapfile
48  1 /usr/sbin/diskarbitrationd
52  1 autofsd
53  1 /usr/libexec/ApplicationFirewall/socketfilterfw
76  1 /System/Library/CoreServices/coreservicesd
83  1 /System/Library/Frameworks/ApplicationServices.framework/Frameworks/CoreGraphics.framework/Resources/WindowServer -daemon


LAUNCHD_SOCKET which launchd should use to talk to


Per-user agents.
System wide daemons.
†ATSServer   all have suffix .plist

Daemons with ¬ are Disabled
finger ¬

/Library/LaunchAgents Per-user agents provided by the administrator.

~/Library/LaunchAgents Per-user agents provided by the user.
empty smacker 3/17/08
/Library/LaunchDaemons System wide daemons provided by the administrator
Causes icon to appear in menubar(?)

 <key>Label</key> <string>com.mozy.backup</string>
 <key>OnDemand</key> <false/>
 <key>RunAtLoad</key> <true/>
 <key>ServiceIPC</key> <false/>
 <key>UserName</key> <string>root</string>
 <key>GroupName</key> <string>wheel</string>
Library/SyncedPreferences > lt
  1034 Sep 17  2015
  3219 Jan 10  2016 icbaccountsd.plist
    87 Jan 25  2016
   786 Mar  5 17:36
   663 Mar 12 20:29
  1428 Apr  4 20:31
   553 May 28 21:12
  1122 May 30 12:01
  7229 Jul 27 08:07
  7353 Jul 27 08:07 suggestd.plist
   483 Jul 27 12:42
  3085 Jul 27 14:38 accountsd.plist
 30409 Jul 29 19:31
 27585 Jul 29 19:31
 93344 Jul 29 19:31
  4043        15:53
 15260        15:53
  4340        15:53
MySQLCOM (oops not invoked 3/21/16)
comapcpcpestart Compac PowerChute
nipal (not invoked 3/21/16)


launchd.plist, launchd.conf(5), launchd(8)
No longer present


 <key>Disabled</key> <true/>
    <key>Label</key> <string></string>
    <key>ProgramArguments</key> <array> <string>/usr/libexec/bootpd</string> </array>
    <key>inetdCompatibility</key> <dict> <key>Wait</key> <true/> </dict>
    <key>Sockets</key> <dict> <key>Listeners</key> <dict>
            <key>SockServiceName</key> <string>bootps</string>
            <key>SockType</key>        <string>dgram</string>
            <key>SockFamily</key>      <string>IPv4</string>


<key>ProgramArguments</key> <array> <string>/usr/libexec/bootlog</string> </array>
    <key>RunAtLoad</key>      <true/>
    <key>LaunchOnlyOnce</key> <true/>

Now binary plist > cat /System/Library/LaunchDaemons/telnet.plist <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" ""> <plist version="1.0"> <dict> <key>Disabled</key> <true/> <key>Label</key> <string></string> <key>ProgramArguments</key> <array> <string>/usr/libexec/telnetd</string> </array> <key>inetdCompatibility</key> <dict> <key>Wait</key> <false/> </dict> <key>Sockets</key> <dict> <key>Listeners</key> <dict> <key>SockServiceName</key> <string>telnet</string> <key>Bonjour</key> <true/> </dict> </dict> <key>SessionCreate</key> <true/> </dict> </plist>

telnet smacker
telnet: connect to address Connection refused

sudo launchctl load -F /System/Library/LaunchDaemons/telnet.plist   (-F force as plist says disabled)

telnet smacker
Connected to smacker.GERMANS.
Escape character is '^]'.

sudo launchctl stop

<key>Label</key> <string>com.vix.cron</string> <key>ProgramArguments</key> <array> <string>/usr/sbin/cron</string> </array> <key>KeepAlive</key> <dict> <key>PathState</key> <dict> <key>/etc/crontab </key> <true/> </dict> </dict> <key>QueueDirectories</key> <array> <string>/usr/lib/cron/tabs</string> </array>
Darwin September 30, 2004

Double Clicking on a plist in finder starts Property List Editor, See PlistBuddy

There exists lingon which is a little more sexy by Peter Borg .

There is alsp pl which converts xml to keyword=value format (VERY NiCE!) pl -input fi_xml.plisti -output fi.txt

GETRLIMIT(2) BSD System Call

getrlimit, setrlimit -- control maximum system resource consumption

     int getrlimit(int resource, struct rlimit *rlp); 
     int setrlimit(int resource, const struct rlimit *rlp);
Limits on the consumption of system resources by the current process and each process it creates may be obtained with the getrlimit() call, and set with the setrlimit() call.

resource Maximums
RLIMIT_CPU cpu seconds
RLIMIT_NOFILE number of open files
RLIMIT_FSIZE bytes of files that may be created.
RLIMIT_NPROC number of simultaneous processes
RLIMIT_MEMLOCK memory using mlock(2)
RLIMIT_RSS resident set size, i.e. physical memory
RLIMIT_DATA data segment ; how far a program may extend its break with the sbrk(2) system call.
RLIMIT_STACK stack segment
RLIMIT_CORE size of core file that may be created.

A resource limit is specified as a soft limit and a hard limit.
When a soft limit is exceeded a process may receive a signal (for example, if the cpu time or file size is exceeded), but it will be allowed to continue execution until it reaches the hard limit (or modifies its resource limit).

           struct rlimit { rlim_t  rlim_cur;       /* current (soft) limit */
                           rlim_t  rlim_max;       /* hard limit */ };
Processes may alter rlim_cur (Soft) within the range from 0 to rlim_max (Hard) or
(irreversibly) lower rlim_max. Only the super-user may raise the maximum limits.

This is a per-process limit, and affects all child processes

A break call fails if the data space limit is reached.
When the stack limit is reached, the process receives a segmentation fault (SIGSEGV).

A file I/O operation that would create a file larger that the process' soft limit will cause the write to fail and a signal SIGXFSZ to be generated; .
When the soft cpu time limit is exceeded, a signal SIGXCPU is sent .

return Values

  0 success
-1 error code is stored in the global location errno.


getrlimit() and setrlimit() system calls will fail if:
[EFAULT] address specified for rlp is invalid.
[EINVAL] resource is invalid.

The setrlimit() call will fail if:
[EINVAL] specified limit is invalid (e.g., RLIM_INFINITY or lower than rlim_cur).
[EPERM] limit specified would have raised the maximum limit value and the caller is not the super-user.

Legacy Synopsis

     #include <sys/types.h>
   #include <sys/time.h>
   #include <sys/resource.h>

As of Sierra no longer runs interactively

As of Yosemite /System/Library/LaunchDaemons/ no longer includes the invocation of

The include files <sys/types.h> and <sys/time.h> are necessary.


setrlimit() now returns with errno set to EINVAL in places that historically succeeded.
It no longer accepts "rlim_cur=RLIM_INFINITY" for RLIM_NOFILE.
Use "rlim_cur=min(OPEN_MAX, rlim_max)".

These commands can be stored in $HOME/.launchd.conf or /etc/launchd.conf to be read at the time launchd starts.(seems to be no longer used as per Mavericks)


csh(1), sh(1), quota(2), sigaction(2), sigaltstack(2), sysctl(3), compat(5)

How does apache get started on OS X?

sudo launchctl load -w /System/Library/LaunchDaemons/org.apache.httpd.plist

How does mysqld get started on OS X?

  1. Get process id:
  2. interesting non-standard (?) items

    Launchd includes explicit calls to rc.server

  , throttle-queue,  bgioq
    sudo launchctl list | sed 1d | awk '!/0x|com\.(apple|openssh|vix)|org\.(amav|apac|cups|isc|ntp|postf|x)/{print $3}'
    com.sophos.scan    (anti vrus)
    vi /Library/LaunchDaemons/com.kaspersky.safekids.plist
    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "">
      list version="1.0">
        <key>Label</key> <string>com.kaspersky.safekids</string>
            <string>/Library/Application Support/Kaspersky Lab/SafeKids/Binaries/safekids</string> <string>-r</string> <string>-bl</string>
        <key>RunAtLoad</key> <true/>
        <key>ServiceIPC</key> <false/>
        <key>StandardErrorPath</key> <string>/var/log/safekids_daemon_stderr.log</string>
        <key>StandardOutPath</key> <string>/var/log/safekids_daemon_stdout.log</string>
        <key>KeepAlive</key> <dict> <key>SuccessfulExit</key> <false/> </dict>
        <key>WatchPaths</key> <array> <string>/Library/Application Support/Kaspersky Lab/SafeKids/kickstart</string> </array>

    Following… plists include StartCalendarInterval as of 11/06/13 Mavericks:

    DiagnosticReportCleanUpDaemon 11:00
    ServerPerfLog.aslmanager      03:25 W=6 (Sunday)
    bsd.dirhelper                 03:35
    gkreport                      03:52 w=5 (Saturday)
    locate                        03:15 w=6
    loginwindow.LFVTracer         00:15   6
    logkextloadsd                 14:20   2 Tuesday
    logsyswritesd                 03:15
    newsyslog                       :30
    systemstats.daily             00:15
    var-db-dslocal-backup         03:15   6
    Since Launchd StartCalendarInterval starts tasks missed while system is sleeping/not running,
    most of the above will be run (annoyingly) on next awakining(I think)

    There is no root crontab in Mac OS, rather /System/Library/LaunchDaemons files sometimes include:

            <key>Day</key> <integer>11</integer>
            <key>Hour</key> <integer>0</integer>
            <key>Minute</key> <integer>0</integer>
            <key>Month</key> <integer>7</integer>
            <key>Weekday</key> <integer>0</integer>