15" Retina MacBook Pro late 2013 11,3. Shutting down overnight

Question

Level 1

13 points

15" Retina MacBook Pro late 2013 11,3. Shutting down overnight

I'm dealing with an ongoing issue where my MBP is shutting down overnight when left open but idle. It's an inelegant shutdown and any Office applications that are open have to go through document recovery.

It's an older model but fairly well-resourced with the following specs:

Processor Name: Intel Core i7

Processor Speed: 2.3 GHz

Number of Processors: 1

Total Number of Cores: 4

L2 Cache (per Core): 256 KB

L3 Cache: 6 MB

Hyper-Threading Technology: Enabled

Memory: 16 GB

Boot ROM Version: 153.0.0.0.0

SMC Version (system): 2.19f12

Storage: 1 TB SSD

I run Parallels Desktop Version 14.1.3 (45485) all day, every day to support a Windows 10 guest OS. Other than that I'm a pretty normal user.

I've already done the following:

1) Thermal monitoring: no cores hitting 100 C., fans have been verified as functioning and clean, heat sink is intact.

2) NoCrashMBP installed and running as a login item (this moel is known to have a flaw in one core of its CPU)

3) Manually removed ThunderboltNHI.kext (addressed bizarre driver issue that also impacts this model)

I have logs documenting what was happening right before the shutdown but I'm unsure how to interpret them.

I noticed the issue when I upgraded to Mojave from Sierra.

TIA,

Adam

MacBook Pro 15", macOS 10.14

Posted on Jun 12, 2019 12:00 PM

Reply

Answer 1

Top-ranking reply

Old Toad

Level 10

210,509 points

Jun 12, 2019 2:25 PM in response to abro

Download and run Etrecheck. Etrecheck is a diagnostic tool that was developed by one of the most respected users here in the ASC and recommended by Apple Support to provide a snapshot of the system and help identify the more obvious culprits that can adversely affect a Mac's performance.

Copy the report

and use the Add Text button to include the report in your reply. How to use the Add Text Feature When Posting Large Amounts of Text, i.e. an Etrecheck Report

Before running Etrecheck assign Full Disk Access to Etrecheck so that it can get additional information from the Console and log files for the report:

Then we can examine the report and see if we can determine the culprit.

Oh, I forgot - uninstall Avast. It's totally unnecessary and only compromises your Mac's performance and lightens you bank account.

Reply

Answer 2

Jun 13, 2019 11:16 AM in response to abro

****** Antivirus apps: Avast, Trusteer, and MalwareBytes

Uninstall Trusteer and Avast, and only run MalwareBytes manually, disable the background tasks.

The correct number of antivirus is... zero.

MalwareBytes is a reputable program, and not really an antivirus.

The other two are ****.

***** Major Issues:

Anything that appears on this list needs immediate attention.

Kernel panics - This system has experienced kernel panics that could be related to 3rd party software.

More than one antivirus app - This machine has multiple antivirus apps installed.

*****

/System/Library/Extensions

[Not Loaded] speedit.kext (0.32)

[Not Loaded] MissingSyncBlackBerry.kext (2.0.2)

[Not Loaded] NovatelWireless3G.kext (2.1)

[Not Loaded] NovatelWirelessFilter.kext (1.0.1)

[Not Loaded] HotSync Classic Seize.kext (3.2.1)

[Loaded] RIMBBUSB.kext (0.0.67)

[Not Loaded] RIMBBVSP.kext (0.0.67)

[Not Loaded] SierraSupport.kext (1.4.0)

[Not Loaded] SierraSupportKicker.kext (1.4.0)

[Not Loaded] SMSIWirelessModem.kext (3.2.6)

[Loaded] ZoomAudioDevice.kext (1.2 - SDK 10.9)

/System/Library/Extensions/NovatelWireless3G.kext/Contents/Plugins

[Not Loaded] NovatelWireless3GData.kext (2.1)

/System/Library/Extensions/SMSIWirelessModem.kext/Contents/PlugIns

[Not Loaded] SMSIWirelessCDC.kext (3.2.6)

[Not Loaded] SMSIWirelessSerial.kext (3.2.6)

All this stuff is very old. One or more of these may not be compatible.

Installing kexts in /System/Library/Extensions has been disallowed for YEARS.

**** Startup Items:

ParallelsTransporter Path: /Library/StartupItems/ParallelsTransporter

Startup Items have been disabled since Yosemite...

All in all you have a bunch of old stuff, and stuff that should have no place in a healthy mac.

What version of Paragon NTFS?

Reply

Answer 3

abro Author

Level 1

13 points

Jun 13, 2019 9:38 AM in response to Old Toad

Thank you for the detailed instructions. I've installed the Pro version with Full Disk access as suggested. Here is the report that I generated. I'm going to spend some time getting to know Etrecheck this weekend to better understand its capabilities. In the meantime, if you have any quick tips based on this data, please fire away!

Best,

Adam

EtreCheck report

Reply

Answer 4

abro Author

Level 1

13 points

Jun 12, 2019 12:03 PM in response to abro

LOGS TO SHARE:

---------------

SAMPLE #1:

Jun 11 17:48:06 Istanbul com.avast.proxy[311]: mime: Error parsing mail file: parse error!

Jun 11 17:48:06 Istanbul com.avast.proxy[311]: mime: :

Jun 11 17:48:06 Istanbul com.avast.proxy[311]: handler: Error deleting scan file: unlink(): No such file or directory

Jun 11 17:48:13 Istanbul com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.user.504): Service "com.apple.xpc.launchd.unmanaged.loginwindow.121" tried to register for endpoint "com.apple.tsm.uiserver" already registered by owner: com.apple.SystemUIServer.agent

Jun 11 17:48:43 --- last message repeated 1 time ---

Jun 11 17:53:16 Istanbul syslogd[61]: ASL Sender Statistics

Jun 11 17:55:25 Istanbul com.apple.xpc.launchd[1] (com.apple.sandboxd[1234]): Service exited due to SIGALRM | sent by kernel_task[0]

Jun 11 17:55:43 Istanbul com.avast.proxy[311]: Defective HTTP request!

Jun 11 17:55:43 Istanbul com.avast.proxy[311]: )Û

chrome-74.0.3729.169mcs.android.com5429787620370228124"5429787620370228124*44336040029953628872android-4b5a7b128dfb239cB

new_vc1`

Jun 11 17:55:43 Istanbul timed[103]: settimeofday({0x5d00235f,0xd1394}) == 0

Jun 11 17:55:43 Istanbul com.avast.proxy[311]: Protocol switch to: websocket

Jun 12 08:12:59 localhost bootlog[0]: BOOT_TIME 1560341579 0

Jun 12 08:13:25 localhost syslogd[61]: Configuration Notice:

ASL Module "com.apple.cdscheduler" claims selected messages.

Those messages may not appear in standard system log files or in the ASL database.

Jun 12 08:13:25 localhost syslogd[61]: Configuration Notice:

ASL Module "com.apple.install" claims selected messages.

----------------

Reply

Answer 5

abro Author

Level 1

13 points

Jun 12, 2019 12:04 PM in response to abro

SAMPLE #2:

Jun 8 15:42:17 Istanbul com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.user.loginwindow.37807.4294967295): com.apple.tiswitcher (lint): The HideUntilCheckIn property is an architectural performance issue. Please transition away from it.

Jun 8 15:42:17 Istanbul com.apple.xpc.launchd[1] (com.apple.coreservices.useractivityd): Unknown key for Boolean: DrainMessagesAfterFailedInit

Jun 8 15:42:18 Istanbul ctkahp[37819]: objc[37819]: Class TKTokenRefImpl is implemented in both /System/Library/Frameworks/Security.framework/Versions/A/Security (0x7fff980d0078) and /System/Library/Frameworks/CryptoTokenKit.framework/ctkahp.bundle/Contents/MacOS/ctkahp (0x107d3e738). One of the two will be used. Which one is undefined.

Jun 8 15:42:18 Istanbul ctkahp[37819]: objc[37819]: Class TKTokenRefCtkd is implemented in both /System/Library/Frameworks/Security.framework/Versions/A/Security (0x7fff980d00a0) and /System/Library/Frameworks/CryptoTokenKit.framework/ctkahp.bundle/Contents/MacOS/ctkahp (0x107d3e760). One of the two will be used. Which one is undefined.

Jun 8 15:42:19 Istanbul SecurityAgent[37817]: objc[37817]: Class TKTokenRefImpl is implemented in both /System/Library/Frameworks/Security.framework/Versions/A/Security (0x7fff980d0078) and /System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent (0x1065a8ce8). One of the two will be used. Which one is undefined.

Jun 8 15:42:19 Istanbul SecurityAgent[37817]: objc[37817]: Class TKTokenRefCtkd is implemented in both /System/Library/Frameworks/Security.framework/Versions/A/Security (0x7fff980d00a0) and /System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent (0x1065a8d10). One of the two will be used. Which one is undefined.

Jun 8 15:42:19 Istanbul com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.pid.SecurityAgent.37817): Path not allowed in target domain: type = uid, path = /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle

Jun 8 15:42:19 Istanbul com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.pid.SecurityAgent.37817): Path not allowed in target domain: type = uid, path = /System/Library/PrivateFrameworks/FamilyControls.framework/Versions/A/XPCServices/com.apple.FCiCloudPrefUpdater.xpc/Contents/MacOS/com.apple.FCiCloudPrefUpdater error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle

Jun 8 15:42:20 Istanbul com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.pid.SecurityAgent.37817): Path not allowed in target domain: type = uid, path = /System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd error = 1: Operation not permitted, origin = /System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle

Jun 8 15:42:21 Istanbul com.apple.xpc.launchd[1] (com.avast.account[37829]): Service could not initialize: 18F132: xpcproxy + 11313 [1534][4B9BCB98-E149-313D-9D22-31C7185BB628]: 0x2

Jun 8 15:42:21 Istanbul com.apple.xpc.launchd[1] (com.avast.account[37829]): Service exited with abnormal code: 78

Jun 8 15:42:29 Istanbul shutdown[37835]: SHUTDOWN_TIME: 1560022949 674116

Jun 10 09:25:22 localhost bootlog[0]: BOOT_TIME 1560173122 0

---

Jun 10 09:25:47 localhost syslogd[61]: Configuration Notice:

Reply

Answer 6

abro Author

Level 1

13 points

Jun 13, 2019 2:41 PM in response to Luis Sequeira1

Very helpful, I'll get started by cleaning up the older extensions you flagged and then see how my machine does overnight. My work requires me to utilize Avast if I want to work from home, so I don't have a choice there. Trusteer came from my bank but I have discretion over it and can ditch it.

Paragon NTFS driver is current (15.5.41)

Thanks for this, will advise as to whether this resolved the issue after some testing.

Adam

Reply

Answer 7

Jun 12, 2019 12:47 PM in response to abro

You should uninstall avast. It's ****

Check if your machine is scheduled to shut down in the wee hours: System Preferences->Energy Saver, click on "Schedule..."

Reply

Answer 8

abro Author

Level 1

13 points

Jun 13, 2019 8:09 AM in response to Luis Sequeira1

Thanks for your suggestion, I appreciate you taking the time to offer it. I verified that there is no scheduled shutdown configured in the Energy Saver settings.

Reply

15" Retina MacBook Pro late 2013 11,3. Shutting down overnight

Similar questions