Startup items

Alt-U or Command → Startup items lists everything set to start on its own: at boot, at login, on a schedule, or whenever a shell or an SSH login starts. The newest change comes first, so whatever was added or edited lately sits at the top. Like the activity monitor, it comes from the bundled System plugin. The list takes the active pane, and the other pane shows the selected item in detail.

Each row shows when its file last changed, its place, and what it runs. A wider pane adds who owns the file and whether its program is there: found, or missing when the path it names does not exist. A missing program is worth a look, since whatever puts a file there later runs with the item’s rights. The Rules column names the rules an item matched, colored by their level, and appears once any item matched one. The line above the list counts the items and how many matched a rule.

The details show the file and its line, what the item runs, the program and where Borg found it, when it runs in the file’s own words (RunAtLoad, @reboot, a calendar or a systemd target), the user it runs as, the file’s owner and the exact time of the change. Under Rules, each match says whether it was in its file or in its program, with what the rule looks for, when it matches harmless things, and where the rule comes from. An item its file turns off is dimmed, and its details say Turned off in its own file, so it does not start.

Key	Action
Enter, Alt-O	Open the folder of the item’s file beside the list
F3 / F4	View / edit the item’s file
/	Filter the rows; ↑↓ still move, Enter keeps the filter, Esc clears it
R	Read every place again
Ctrl-C	Copy what the item runs
Alt-W	Maximize the list
Esc	Close the screen, which keeps its filter

Enter or a double-click opens the folder of the item’s file in the other pane, with the cursor on the file, and the list stays as it was. Tab moves between the list and the files, and Esc in the list or Alt-U brings the details back. The filter keeps the items that contain every word you type, in the place, the name, what it runs, the file’s path, the owner, the user it runs as, when it runs, found or missing, and the names of the rules it matched. Put ! before a word to leave out what it matches: root !timer keeps root’s items other than timers. Each place also has a short name for the filter and for agents, such as launch-daemon, systemd-timer or ssh-authorized-key.

Where Borg looks

On macOS:

• User agent: ~/Library/LaunchAgents.
• Launch agent and Launch daemon: /Library/LaunchAgents and /Library/LaunchDaemons.
• System agent and System daemon: /System/Library/LaunchAgents and /System/Library/LaunchDaemons, on the sealed system volume.
• Cron job: the crontabs in /usr/lib/cron/tabs, and /etc/crontab.
• Periodic script: the daily, weekly and monthly scripts in /etc/periodic and /usr/local/etc/periodic.

On Linux:

• Service and Timer: systemd units in /etc/systemd/system, /usr/local/lib/systemd/system, /usr/lib/systemd/system and /lib/systemd/system, and the units their .wants and .requires folders link to from anywhere else.
• User service and User timer: /etc/systemd/user, /usr/local/lib/systemd/user, /usr/lib/systemd/user, ~/.config/systemd/user and ~/.local/share/systemd/user.
• Autostart: desktop entries in ~/.config/autostart and /etc/xdg/autostart.
• Cron job: /etc/crontab, /etc/cron.d, and the crontabs in /var/spool/cron/crontabs or /var/spool/cron.
• Cron script: /etc/cron.hourly, /etc/cron.daily, /etc/cron.weekly and /etc/cron.monthly.
• Anacron job: /etc/anacrontab.
• rc.local: /etc/rc.local.
• Preload: /etc/ld.so.preload, the libraries loaded into every program that starts.
• Shell startup: the scripts in /etc/profile.d, besides the files below.

On both, Shell startup covers the zsh, bash and fish startup files in your home folder, such as ~/.zshrc, ~/.bashrc, ~/.profile and ~/.config/fish/config.fish, and their system-wide versions in /etc. SSH key lists each key in ~/.ssh/authorized_keys and ~/.ssh/authorized_keys2 with its comment, and with the command it forces when it has one.

Borg reads these places as you. A place that is there but closed to you shows at the bottom of the list as Could not read with its path; run Borg as administrator to see inside. Your own crontab is the exception: when the folder of crontabs is closed to you, as it is on macOS, Borg asks crontab -l for it.

A program named with a full path or ~/ counts as missing when nothing is there. A bare name is looked up in /usr/local/sbin, /usr/local/bin, /usr/sbin, /usr/bin, /sbin and /bin, where cron and launchd look. A relative path, or a name found in none of them, shows —, since the item may set its own search path.

Rules on startup items

Borg runs its own rules and yours (see Scanning files with rules) over the first 1 MiB of each startup file and over each program up to 64 MiB. A program many items run is scanned once. Programs of System agent and System daemon items are left unscanned, because nothing can change the sealed system volume while macOS runs, and their details say so. When a rule file fails to compile, the bottom of the list says how many were left out.