How to Deal With Frequent Kernal Panics: 2017 iMac Retina 4K 21.5 Inch

Well, it wasn't because of the Samsung SSD connected to the USB-C/Thunderbolt port. After I switched to a USB-A port I had another kernel panic.

However, an although I can't be certain, I may have figured out the cause of the kernel panics on my 2017 iMac running Monterey.

After I'd spent nearly a month trying different things and had mostly given up, I recalled that LaunchBar had been behaving oddly. For example, almost every time the machine booted up, LauncBar complained that it was unable to process the Applications indexing rule. I figured that this was a bogus error message as I was able to launch applications with LaunchBar as usual. Then I recalled that if I manually rebooted the machine, it always took a very long time for LaunchBar to quit. It was always the last app to quit.

So, I had a look at LaunchBar's Index. It turns out that there were two indexing rules called "Applications"; one in the General section and one in the Files & Folders section. I had a look at the unusual one and saw that it contained a real mishmash of locations and "Search for". None of it seemed like anything I would set up, so I deleted the rule.

Since doing so I have had not one single kernel panic. It's been nine days. I have written to Objective Development about the issue, but have yet to hear back.

I won't feel comfortable until a few weeks have passed, but this may be it.

Although it may be too early to tell, it now appears that the kernel panics were caused by connecting a Samsung SSD to the iMac via a USB-C/Thunderbolt port. It was suggested that I swap the C-C cable for a C-A cable and connect the drive to one of the USB-A ports. I did that last Friday and haven't had a panic since then. It's still early days (96 hours), but I'm full of hope.

Allan Jones wrote:

Before resorting to reinstalling the OS, get rid of the malware which is likely adware. Some may indicate that you overrode system warnings to install them.

EtreCheck identified several suspects and gives the file paths to find and evict them. Those have to go before making any judgements about further action. If you do not want to manually find and evict the malware, you can use the only removal tools most of the greybeards around here trust, MalwareBytes.

Most malware like you have comes from dicey download hosting sites so get MWB ONLY from its developer's site:

https://www.malwarebytes.com/mac

The free version use run manually. The paid version runs in the background to stop Malware at the door.

Can you please be specific about what "Malware" I have? There are some unsigned apps, including a bunch of my own, but I've already checked all of them and found them to be legit. Please help me identify other stuff that needs removing.

I've verified that no third party kexts are running:

MrMuscle:~ mnewman$ /usr/bin/kmutil showloaded | grep -v com.apple
No variant specified, falling back to release
Index Refs Address            Size       Wired      Name (Version) UUID <Linked Against>
MrMuscle:~ mnewman$

If there's a better way to do that, please let me know.

I have now run an extended memory test using MemTest86 V9.4. No errors at all:

MemTest86 V9.4 Free (Build: 1000) Result summary
PassMark Software
www.passmark.com
Test Start Time: 2022-06-02 00:00:27
Elapsed Time: 3:22:42
CPUs Active: 4
CPU Temperature Min/Max/Ave: 67C/81C/72C
RAM Temperature Min/Max/Ave: 100C/142C/125C
# Tests Passed: 48/48 (100%)
Lowest Error Address: N/A
Highest Error Address: N/A
Bits in Error Mask: 0000000000000000
Bits in Error: Total: 0 Min: 0 Max: 0 Avg: 0
Max Contiguous Errors: 0

With the steps that have been completed, we would recommend reaching out to Apple Support to look into possible service options. You can do that here: Apple Support

I'm not sure I want to do that. I ran an extensive RAM check which found no errors. DU and SMART Reporter both say the internal SSD is fine. That pretty much leaves replacing the motherboard.

Is it really worth it to do such a thing on a five year old iMac? I think not.

I still don't understand EtreCheck's heavy IO usage note. Here's top after the machine has been up without a crash for about 12 hours:

Processes: 580 total, 2 running, 578 sleeping, 2146 threads            08:45:23
Load Avg: 2.00, 1.70, 1.55  CPU usage: 4.28% user, 6.86% sys, 88.84% idle
MemRegions: 73934 total, 2879M resident, 0B private, 1944M shared.
PhysMem: 14G used (2270M wired), 1567M unused.
VM: 20T vsize, 0B framework vsize, 0(0) swapins, 0(0) swapouts.
Networks: packets: 1765422/1969M in, 881284/543M out.
Disks: 8464388/151G read, 401988/5989M written.

There's very little processor load and absolutely no swapins/outs. I don't see how that constitutes heavy IO.

How will we know? Sometimes this machine goes two or three days without a panic; sometimes it has a few one right after the other.

In other words; how long do you wait before you know a problem is solved?