OS X tries to reboot every night

No, I did not, but unfortunately that's not the problem. I didn't notice it happening until after I installed a time zone patch that was suggested here.



http://discussions.apple.com/message.jspa?messageID=5466365#5466365

target article

http://db.tidbits.com/article/9192

Is there some sort of rootkit check program I can install that will see if this has done anything malicious to my system?

Thanks,
Todd

Ok,
I've looked at my system log and I don't see anything out of the ordinary. I fired my macbook up after I got home from work at 19:08, when I came home at 21:57 from dinner, it had tried to shut down. I've included the entire console log, there's nothing between 19:16 and 21:57. Can I turn on more verbose logging?

Oct  5 19:08:13 todd kernel[0]: System SafeSleep Oct  5 19:08:13 todd kernel[0]: hibernate_page_list_setall start Oct  5 19:08:13 todd kernel[0]: hibernate_page_list_setall time: 252 ms Oct  5 19:08:13 todd kernel[0]: pages 356787, wire 51685, act 35092, inact 53149, zf 31701, could discard act 80113 inact 105047 Oct  5 19:08:13 todd kernel[0]: hibernate_page_list_setall found pageCount 356787 Oct  5 19:08:13 todd kernel[0]: IOHibernatePollerOpen, ml_get_interrupts_enabled 0 Oct  5 19:08:13 todd kernel[0]: IOHibernatePollerOpen(0) Oct  5 19:08:13 todd kernel[0]: writing 356279 pages Oct  5 19:08:13 todd kernel[0]: image1Size 91656704 Oct  5 19:08:13 todd kernel[0]: all time: 8063 ms, comp time: 1702 ms, deco time: 0 ms, Oct  5 19:08:13 todd kernel[0]: image 315595264, uncompressed 700903424 (171119), compressed 314348784 (44%), sum1 878c6d06, sum2 aefe5823 Oct  5 19:08:13 todd kernel[0]: hibernate_write_image done(0) Oct  5 19:08:13 todd kernel[0]: sleep Oct  5 19:08:13 todd kernel[0]: Enabling XMM register save/restore and SSE/SSE2 opcodes Oct  5 19:08:13 todd kernel[0]: Started CPU 01 Oct  5 19:08:13 todd kernel[0]: IOBluetoothHCIController::restartShutdownWL this is a wake from sleep Oct  5 19:08:13 todd kernel[0]: System Wake Oct  5 19:08:13 todd kernel[0]: Previous Sleep Cause: 2 Oct  5 19:08:14 todd BatteryUpdater[510]: Battery does not need the BatteryUpdate v 1.2 (0x2) Oct  5 19:08:15 todd mDNSResponder: getifaddrs ifa_netmask for vmnet8(8) Flags 8863 Family  2 172.16.93.1 has different family: 0 Oct  5 19:08:15 todd mDNSResponder: getifaddrs ifa_netmask for vmnet1(9) Flags 8863 Family  2 172.16.199.1 has different family: 0 Oct  5 19:08:15 todd BatteryUpdater[511]: Battery does not need the BatteryUpdate v 1.2 (0x2) Oct  5 19:08:29 todd kernel[0]: IOAudioStream[0x451aa00]::clipIfNecessary() - Error: attempting to clip to a position more than one buffer ahead of last clip position (25,19ec)->(27,2fe9). Oct  5 19:08:29 todd kernel[0]: IOAudioStream[0x451aa00]::clipIfNecessary() - adjusting clipped position to (27,19ec) Oct  5 19:08:49 todd kernel[0]: hibernate image path: /var/vm/sleepimage Oct  5 19:08:49 todd kernel[0]: sizeof(IOHibernateImageHeader) == 512 Oct  5 19:08:49 todd kernel[0]: Opened file /var/vm/sleepimage, size 2147483648, partition base 0xc805000, maxio 400000 Oct  5 19:08:49 todd kernel[0]: hibernate image major 14, minor 2, blocksize 512, pollers 3 Oct  5 19:08:49 todd kernel[0]: hibernate_alloc_pages flags 00000000, gobbling 0 pages Oct  5 19:14:46 todd kernel[0]: System SafeSleep Oct  5 19:14:46 todd kernel[0]: hibernate_page_list_setall start Oct  5 19:14:46 todd kernel[0]: hibernate_page_list_setall time: 245 ms Oct  5 19:14:46 todd kernel[0]: pages 327653, wire 49701, act 27891, inact 35102, zf 29268, could discard act 80467 inact 105224 Oct  5 19:14:46 todd kernel[0]: hibernate_page_list_setall found pageCount 327653 Oct  5 19:14:46 todd kernel[0]: IOHibernatePollerOpen, ml_get_interrupts_enabled 0 Oct  5 19:14:46 todd kernel[0]: IOHibernatePollerOpen(0) Oct  5 19:14:46 todd kernel[0]: writing 327132 pages Oct  5 19:14:46 todd kernel[0]: image1Size 85210112 Oct  5 19:14:46 todd kernel[0]: all time: 6638 ms, comp time: 1407 ms, deco time: 0 ms, Oct  5 19:14:46 todd kernel[0]: image 262421504, uncompressed 579342336 (141441), compressed 261273980 (45%), sum1 9319bd47, sum2 57c4a76c Oct  5 19:14:46 todd kernel[0]: hibernate_write_image done(0) Oct  5 19:14:46 todd kernel[0]: sleep Oct  5 19:14:46 todd kernel[0]: IOUSBWorkLoop::closeGate - interrupt Thread being held offEnabling XMM register save/restore and SSE/SSE2 opcodes Oct  5 19:14:46 todd kernel[0]: Started CPU 01 Oct  5 19:14:46 todd kernel[0]: IOBluetoothHCIController::restartShutdownWL this is a wake from sleep Oct  5 19:14:46 todd kernel[0]: System Wake Oct  5 19:14:48 todd mDNSResponder: getifaddrs ifa_netmask for vmnet8(8) Flags 8863 Family  2 172.16.93.1 has different family: 0 Oct  5 19:14:48 todd mDNSResponder: getifaddrs ifa_netmask for vmnet1(9) Flags 8863 Family  2 172.16.199.1 has different family: 0 Oct  5 19:14:48 todd BatteryUpdater[517]: Battery does not need the BatteryUpdate v 1.2 (0x2) Oct  5 19:15:46 todd configd[37]: Error: Failed to join most recent network "cafenet", err=88001006 (will search for any others) Oct  5 19:15:47 todd /System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport: Could not find "cafenet" on channel(s) 6 Oct  5 19:15:48 todd /System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport: No networks found on channel(s) 6 11 Oct  5 19:15:48 todd /System/Library/PrivateFrameworks/Apple80211.framework/Resources/airport: Could not find "Telecom wireless hotspot" on channel(s) 6 11 Oct  5 19:15:48 todd mDNSResponder: getifaddrs ifa_netmask for vmnet8(8) Flags 8863 Family  2 172.16.93.1 has different family: 0 Oct  5 19:15:48 todd mDNSResponder: getifaddrs ifa_netmask for vmnet1(9) Flags 8863 Family  2 172.16.199.1 has different family: 0 Oct  5 19:15:48 todd configd[37]: AppleTalk startup Oct  5 19:15:51 todd configd[37]: posting notification com.apple.system.config.network_change Oct  5 19:15:51 todd kernel[0]: vmnet: VNetUserIf_Create: created userIf at 0x4a31480. Oct  5 19:15:51 todd lookupd[525]: lookupd (version 369.6) starting - Fri Oct  5 19:15:51 2007 Oct  5 19:15:51 todd kernel[0]: vmnet: VMNetConnect: returning port 0x4a31480 Oct  5 19:15:51 todd kernel[0]: vmnet: Hub 0 does not exist, allocating memory. Oct  5 19:15:51 todd kernel[0]: vmnet: Allocated hub 0x54ec000 for hubNum 0. Oct  5 19:15:51 todd kernel[0]: vmnet: VMNET_SO_BINDTOHUB: port: paddr 00:50:56:fb:c8:3a Oct  5 19:15:51 todd kernel[0]: vmnet: Hub 0 Oct  5 19:15:51 todd kernel[0]: vmnet:      Port 0 Oct  5 19:15:51 todd kernel[0]: vmnet: bridge-en1: got dev 0x4677404 Oct  5 19:15:51 todd kernel[0]: vmnet: bridge-en1: wireless interface detected. Oct  5 19:15:51 todd kernel[0]: vmnet: bridge-en1: up Oct  5 19:15:51 todd kernel[0]: vmnet: bridge-en1: attached Oct  5 19:15:51 todd kernel[0]: vmnet: VNetUserIfFree: freeing userIf at 0x4a31480. Oct  5 19:15:53 todd configd[37]: AppleTalk startup complete Oct  5 19:15:53 todd mDNSResponder: getifaddrs ifa_netmask for vmnet8(8) Flags 8863 Family  2 172.16.93.1 has different family: 0 Oct  5 19:15:53 todd mDNSResponder: getifaddrs ifa_netmask for vmnet1(9) Flags 8863 Family  2 172.16.199.1 has different family: 0 Oct  5 19:15:56 todd mDNSResponder: NOTE: Wide-Area Service Discovery disabled to avoid crashing defective DNS relay 10.1.1.1. Oct  5 19:16:35 todd kernel[0]: CiscoVPN : shutting down VPN driver. Oct  5 19:16:35 todd kernel[0]: CiscoVPN : waking up VPN driver. Oct  5 19:16:47 todd lookupd[531]: lookupd (version 369.6) starting - Fri Oct  5 19:16:47 2007 Oct  5 19:16:47 todd configd[37]: posting notification com.apple.system.config.network_change Oct  5 19:16:47 todd lookupd[532]: lookupd (version 369.6) starting - Fri Oct  5 19:16:47 2007 Oct  5 19:16:49 todd mDNSResponder: getifaddrs ifa_netmask for vmnet8(8) Flags 8863 Family  2 172.16.93.1 has different family: 0 Oct  5 19:16:49 todd mDNSResponder: getifaddrs ifa_netmask for vmnet1(9) Flags 8863 Family  2 172.16.199.1 has different family: 0 Oct  5 21:57:42 todd mDNSResponder: getifaddrs ifa_netmask for vmnet8(8) Flags 8863 Family  2 172.16.93.1 has different family: 0 Oct  5 21:57:42 todd mDNSResponder: getifaddrs ifa_netmask for vmnet1(9) Flags 8863 Family  2 172.16.199.1 has different family: 0 Oct  5 21:57:51 todd mDNSResponder: getifaddrs ifa_netmask for vmnet8(8) Flags 8863 Family  2 172.16.93.1 has different family: 0 Oct  5 21:57:51 todd mDNSResponder: getifaddrs ifa_netmask for vmnet1(9) Flags 8863 Family  2 172.16.199.1 has different family: 0

Sorry, I mis spoke. I used the console application to view my system.log. I have also looked at the rolled logs, there is nothing out of the ordinary for them either. This is really starting to irk me, I'll have several windows open with info for my development and I'll loose it due to rebooting.

I've included the log below. As far as evidence, if I'm running a program that doesn't exit automatically (IE without a prompt for confirmation), such as bittorrent, I have the prompt that the logout failed due to some applications not responding. If I leave Eclipse and Firefox open both of which exit without a confirmation, I'll wake up to the login screen. Once I log in, everything is initializing, spotlight is restarting, my Google notifiers aren't launched, my wireless isn't connected. The log below does not show an actual shutdown during the period I suspected, so perhaps I'm only being forced to log out.

reboot    ~                         Sat Oct  6 10:29 shutdown  ~                         Sat Oct  6 10:23 reboot    ~                         Fri Oct  5 08:45 shutdown  ~                         Fri Oct  5 08:45 reboot    ~                         Fri Oct  5 08:28 shutdown  ~                         Fri Oct  5 08:27 reboot    ~                         Thu Oct  4 21:35 shutdown  ~                         Thu Oct  4 21:34 reboot    ~                         Thu Oct  4 17:00 shutdown  ~                         Thu Oct  4 08:27 reboot    ~                         Thu Oct  4 07:28 shutdown  ~                         Thu Oct  4 07:28 reboot    ~                         Thu Oct  4 06:30 shutdown  ~                         Thu Oct  4 06:30 reboot    ~                         Thu Oct  4 05:53 reboot    ~                         Wed Oct  3 17:00 shutdown  ~                         Wed Oct  3 08:18 reboot    ~                         Tue Oct  2 19:29 shutdown  ~                         Tue Oct  2 19:28 reboot    ~                         Tue Oct  2 16:52 shutdown  ~                         Tue Oct  2 12:45 reboot    ~                         Tue Oct  2 12:40 shutdown  ~                         Tue Oct  2 08:54 reboot    ~                         Tue Oct  2 08:50 shutdown  ~                         Tue Oct  2 08:19 reboot    ~                         Tue Oct  2 06:13 shutdown  ~                         Tue Oct  2 05:51 reboot    ~                         Mon Oct  1 11:22

Correct, I'm currently in NZ. I applied the patch, and my time has worked correctly. The symbolic link from the first command seems correct.

todd:~ toddnine$ ls -l /private/etc/localtime
lrwxr-xr-x 1 root wheel 36 Sep 30 14:44 /private/etc/localtime -> /usr/share/zoneinfo/Pacific/Auckland


The second command gives me this

todd:~ toddnine$ ls -l $( ls -l /private/etc/localtime | awk ' { print $NF } ')
-rw-r--r-- 2 root wheel 882 Jul 18 11:54 /usr/share/zoneinfo/Pacific/Auckland

And the third gives me this
todd:~ toddnine$ zdump -v /etc/localtime | grep 2007
/etc/localtime Sat Mar 17 13:59:59 2007 UTC = Sun Mar 18 02:59:59 2007 NZDT isdst=1
/etc/localtime Sat Mar 17 14:00:00 2007 UTC = Sun Mar 18 02:00:00 2007 NZST isdst=0
/etc/localtime Sat Sep 29 13:59:59 2007 UTC = Sun Sep 30 01:59:59 2007 NZST isdst=0
/etc/localtime Sat Sep 29 14:00:00 2007 UTC = Sun Sep 30 03:00:00 2007 NZDT isdst=1

Since I'm paranoid, I've also downloaded and installed ClamXav. It hasn't found anything yet, but its only 1/2 way through a full system scan.

Message was edited by: tnine

Well, somehow a security option got checked. I don't remember changing it, I'm wondering if it was changed as a side effect of me changing settings with onyx. Here's how to fix it, open up system preferences, then go to security. Uncheck "Log out after X minutes of inactivity". I can't believe I didn't find this earlier! Oh well, just another thing I've learned about my mac

Just a follow up. I don't want to imply that was definitely onyx that caused the problem. Its a solid product, I just don't remember clicking that option!