Panic Kernel Help

Circusj wrote:

I don't have anything plugged in as a USB other than internally- how would I test that?

That should be easy to verify. If nothing is plugged in, then nothing is plugged in. While USB is the most common culprit, it could be any external hardware device.

This is primarily an issue with respect to diagnosing the problem. For kernel panics, we suggest this sequence:

1) Remove any 3rd party kernel extensions. See if panics stop. If panics continue, go to step 2.

2) Remove any 3rd party external hardware. See if panics stop. If panics continue, go to step 3.

3) Take computer to Apple Store or Authorized Apple Service provider for additional diagnostics and repair.

Steps 1 and 2 are important because they are a big source of kernel panics and because they are something you can do at home, from an Internet forum like this one.

I used the Sophos uninstaller from the company and don't show any remaining files on my computer.

That's unfortunate. Not unexpected, but unfortunate. In theory, this should not be the cause of kernel panics. But eventually, you will want to get rid of those system extensions. Orphan system extensions can be very difficult to remove. You may need to disable SIP and then use the Terminal to run the "systemextensionsctl" tool to remove them.

Antivirus vendors are particularly bad at this specific problem. I guess they spend all their time looking for zero-day threats from state-sponsored hackers that they can't be bothered to read any Apple documentation issued in the past two and half years.

It seems to be related to the Highpoint drivers for the hard drive which I see have been a problem with other OS updates.

As I said, this could be a limitation in EtreCheck. Those Highpoint drivers may not be installed anymore. They may never have been related to the panics either. That is just a prompt to try #1 above before going through the trouble for #3.

You can run Console.app to access the kernel panic reports themselves. Go to "Diagnostic Reports" in the sidebar on the left-hand side. It looks like you may have already done that. Your first post contains a kernel panic. It doesn't seem to have a date listed other than the kernel build date.

If your most recent kernel panic reports don't list those drivers, then they are not a problem.

Please don't attempt to look at any system error messages in console. Please don't. Sometimes people turn on those streaming error messages and completely lose touch with reality. They think they are in some kind of "Matrix" sequel. I'm not kidding here.

I guess I can just restore via TimeMachine for now.

That may be more difficult than you think. If you use Time Machine to restore the system, the default settings will re-install any files that might potentially be contributing. What you would have to do is completely erase the hard drive and reinstall the operating system. Then, you could restore, but only restore your user accounts and user documents. Do not restore applications or "other files". It's not very fun.

After several very painful days and unsuccessful attempts, I was able to import my time machine data after a fresh install of the OS- I was getting the errors and crashes but uninstalled Box, Dropbox, Chrome, and Sophos using the recommended methods which sometimes included using Terminal to uninstall. I also uninstalled all of the associated Chrome files and switched to Safari- so far so good for several days- no crashes or errors

How did you remove Sophos? It looks like you will need to reinstall it and then use the official uninstaller or uninstallation instructions provided directly from the vendor.

The current version of EtreCheck may be displaying out-of-date information for your kernel panics. It tries to group similar diagnostic events together so it can show that you have had 16 kernel panics. Otherwise, it would list 16 separate panics with identical information. But this can sometimes cause it to print out-of-date panic information. The next version will do better with this.

Also, when it comes to blaming 3rd party kernel extensions, this is strictly guilt by association. The idea is to remove those 3rd party kernel extensions and see if the panics continue. If they do, the cause is likely a hardware failure. It appears that you have removed these specific kernel extensions and you are still experiencing the panics. My guess is that Barney-15E is correct and you have some USB hardware device that is causing the panics. Try unplugging it and see if the panics stop.

etresoft wrote:

You can run Console.app to access the kernel panic reports themselves. Go to "Diagnostic Reports" in the sidebar on the left-hand side. It looks like you may have already done that. Your first post contains a kernel panic. It doesn't seem to have a date listed other than the kernel build date.

If your most recent kernel panic reports don't list those drivers, then they are not a problem.

It is better to manually locate any Kernel Panic logs using the Finder especially with more recent versions of macOS. Recently I have found that the Console app will not display all the logs available. If any Kernel Panic logs exist they can be found in "/Library/Logs/DiagnosticReports" where the file names will begin with "kernel" and end in ".panic" with the date & time of the panic found in between.

HWTech wrote:

It is better to manually locate any Kernel Panic logs using the Finder especially with more recent versions of macOS. Recently I have found that the Console app will not display all the logs available. If any Kernel Panic logs exist they can be found in "/Library/Logs/DiagnosticReports" where the file names will begin with "kernel" and end in ".panic" with the date & time of the panic found in between.

Or just release the update to EtreCheckPro. It should differentiate between different sets of similar kernel panics, as well as do a better job of parsing them. It seems like each new OS update brings a couple of new panic and/or crash log formats.

It seems to be related to the Highpoint drivers for the hard drive which I see have been a problem with other OS updates. This has been very frustrating - I guess I can just restore via TimeMachine for now.

Do you have a HighPoint device? Is it connected to Thunderbolt?

Your EtreCheck shows Sophos is still running. Did you run that before or after removing Sophos?

There is nothing in the panic log showing any third-party kernel extensions loaded at the time of the panic, so the panic would likely be hardware. The last loaded kext was DriverKit.Serial, so maybe something connected to USB.

Circusj wrote:

thanks so much for your explanation and help- these are the only files I have listed under extensions- do you think any of them would be dangerous to remove?

AppleMobileDevice.kext

HighPointIOP.kext

HighPointRR.kext

hp_io_enabler_compound.kext

SoftRAID.kext

You don't need to remove any of them as they weren't loaded at the time of the panic so they are not the cause. Removing them will not result in any improvement of your problem.

If you remove them, you would not be able to use any of those devices/services.

I don't know where AppleMobileDevice came from. It should be in the System Library, not in /Library/Extensions.

So frustrating- I deleted the third party extensions involved in the panic alerts and reinstalled the OS- I then was getting panic alerts associated with Chrome so I removed that application and all associated files. Now I'm getting the following alerts and continue to experience frequent crashes. Any thoughts?

Most likely a hardware problem. Something in the memory infrastructure. Take it to an Apple Store or Authorized Repair Center for evaluation.

There is a very high probability that one of them is the cause.

I was the person that wrote that and it has absolutely nothing to do with your problem. The HighPoint and SoftRAID kernel extensions were not loaded in your panic log. Just because they are sitting on your Mac's SSD doesn't automatically load them all the time.

Here is the EtreCheck Report- I do use TimeMachine to backup so am not sure why the report claims that is missing

It says in the report you didn't allow Full Drive Access, so it cannot report on Time Machine status.