Help Analyzing Crash Report?

spindump is sort of the crash recovery process. If it is crashing, then it likely wasn't able to dump the crash of the actual program that did crash.

Does it generate kernel panic logs? Look in /Library/Logs/DiagnosticReports. The name will start with "Kernel."

If there are any, please post them, too.

EtreCheck has a feature to generate a text version of the report that you can paste in the Additional Text area. There is a Share Report button the you can Copy the report and then paste it in.

Anyway, it indicated some things it couldn't identify, connectwise and a canon printer utility. All that means is his database doesn't recognize them. Are you sure they are valid programs that you use?

It also detected profiles in use. They are often installed if the Mac is managed by a company IT department. But, they are sometimes installed by adware. Are the profiles in your System Preferences valid?

You have several kernel extensions which often cause problems, usually a kernel panic. EtreCheck did not detect that you have had a panic, though.

   /Applications/Canon Utilities/Disk Drill.app

        [Not Loaded] SecureDisk.kext (Justin Johnson, 1.0 - SDK 10.12)

    /Applications/Splashtop Streamer.app

        [Loaded] Soundflower.kext (Splashtop Inc., 1.6.7 - SDK 10.9)

        [Not Loaded] SplashtopSoundDriver.kext (Splashtop Inc., 1.0.0d1 - SDK 10.14)

        [Not Loaded] SRXDisplayCard.kext (Splashtop Inc., 1.6 - SDK 10.9)

        [Not Loaded] SRXFrameBufferConnector.kext (Splashtop Inc., 1.6 - SDK 10.9)

    /Library/Extensions

        [Not Loaded] FTDIKext.kext (Wacom Technology Corp., 1.0 - SDK 10.14)

        [Loaded] Dropbox.kext (Dropbox, Inc., 1.11.0 - SDK 10.14)

If the problems you encounter are frequent enough, you might try booting into Safe Mode to see if they occur in Safe Mode. It will take a while to boot, and it will not run smoothly. Some things just don't work. But, it prevents any system modifications from loading, so if one or more is causing your problem, it should not occur in Safe Mode.

2020-05-05 14:25:42 Last Shutdown Cause: -11 - Unknown

I've never seen a -11 on any Mac. Apple does not publicly document the exact meaning of those numeric codes, however, unless they coincide with a known, anticipated event (a firmware update to cite one example) negative shutdown codes are generally accepted to indicate a hardware fault.

Drawing a definitive conclusion from that single event is premature at best though.

Other causes are quite possible, as Barney-15E indicated. Safe Mode would be instructive, but I'm sure you appreciate the difficulty of diagnosing problems through this very limited communications medium. Diagnosing your client's Mac through yet another intermediary (you) adds a degree of complexity that makes it a practical impossibility. Anyway, try Safe Mode, try removing some of those extremely old system modifications (Soundflower for example) and determine if you can make any progress.

Post the entire report. The EtreCheck report would be useful too.

Interesting date stamp of 1969 on a couple of those files. They aren't loaded either. Were they files that did not get completely installed, leaving them with a bad timestamp and not loaded? Maybe the OP should double-check where those users are getting their installers from.

I took the liberty of posting your EtreCheck report below. All you need to do is click the "additional text" icon, then paste it into where it says "add a note, error log, etc…"

Notice the date is not recent. You might want to capture and post a newer EtreCheck report.

Often, EtreCheck identifies one or more obvious culprits, unfortunately this is not one of those cases. There are a lot of system modifications including some old, outdated or questionable ones, but I sincerely doubt any of them would be responsible for a multitude of apps simply crashing or hanging for reasons unknown.

Lacking any additional detail or anything else that would advance troubleshooting I'm still leaning in favor of a hardware fault due to the abnormal shutdown events.

I like the developer part. It is the consumer market that I’ve struggled to figure out. It is easier when you are doing work for one just customer. But then, finding and landing those customers requires sales expertise, which I don’t have. Live and learn.

You must love being a developer.

Beachballing could be a sign of the drive failing. Are the files that he is working on stored on the Mac or on a network?

However, there are so many system modifications installed, it could be possible any one of those could be the cause.

I have no idea what most of them are, so I don't have a guess as to what they might affect.

Everything listed in the Extensions, LaunchAgents, and LaunchDaemons could be causal. If there is anything that could be uninstalled, you could give that a try. Use the developer's instructions or uninstaller.

While it can point out some problems, EtreCheck doesn't necessarily identify them; it primarily shows what is installed and running on the Mac.

John Galt wrote:

I've never seen a -11 on any Mac. Apple does not publicly document the exact meaning of those numeric codes, however, unless they coincide with a known, anticipated event (a firmware update to cite one example) negative shutdown codes are generally accepted to indicate a hardware fault.

That's strange. I thought I had removed that. I just double-checked. I did remove it. And the " Abnormal shutdown - Your machine shut down abnormally." issue was removed too.

And I had also recently changed the download link from "Download EtreCheck from [yada, yada, yada]" to "Download EtreCheckPro from [yada, yada, yada]".

And this report has an old version of the virtual memory display. Yet the header says EtreCheckPro 6.2.6. How curious.

In any event, the last shutdown code is bogus. It is exactly what it says - the last "shutdown" code. So if you last performed a true "shutdown" in August, 2018 and have only restarted ever since, that will still be the last "shutdown" code. That's why I removed it from the report.

I think I know what is going on with the content of that report. I recently relaxed the signature checking to avoid getting signature errors on Safari. However, that same signature checking is part of EtreCheck's own DRM logic. With this setting relaxed, it is possible to modify certain internal files and get content from the paid Power User package without paying for it.

I anticipate that Apple is going to announce the ARM switch next month. That will be the end of EtreCheck when it is released. I have one major new feature to deliver to help people prepare for the future. I guess I need to tighten up my DRM logic too.

Always a joy.