Windowserver/ Kernel crashes on 2020 iMac Sonoma 14.5

It could be related to something connected via Thunderbolt—maybe the cable or a Hub.

Try disconnecting anything like that and test.

I don’t know why photoanalysisd is running so hard if you don’t have anything in Photos. It may catalog all images on the drive, but I don’t know.

You have so many system modifications running it’s amazing it even runs.

Photos has not finished scanning your Photo Library to identify content. That may be what sent it over the top. When it finishes, check how it performs.

If you get a kernel Panic, post the full log as you did for the Etrecheck report.

I spent hours and days over the course of a month trying to pinpoint the cause of these random crashes and restarts on my 2020 iMac to no avail (I purchased it used in early 2023). Like you have experienced, they seemed to come in waves. What I quickly learned was my experiences were not unique and they even occurred when I had zero peripherals connected to the machine but for the bluetooth mouse and keyboard. I even reformatted the disk and installed 3rd party software one at a time with pauses. It was very frustrating and I can't tell you how many reports I sent to Apple when that dialogue box appeared explaining what I was doing at the time. Eventually I just sent them Steven Wright jokes in the verbiage field. Then I gave up caring altogether and enjoyed the lulls. I haven't had any crashes in many months now although I am experiencing some random freezes forcing a hard shutdown on my part. But I'm not going down another rabbit hole although I suspect these freezes are caused by either of the two TB docks I have connected.

Anyway my friend, here is a Terminal command that might help indicate your root shutdown cause (Change 24 to any duration required). It takes a while to spit out the code(s).

log show --predicate 'eventMessage contains "Previous shutdown cause"' --last 24h

Then search "george garside previous shutdown causes explained" for a dynamic list of what some of these codes mean (my first post was rejected because I included the direct link).

Good luck.

What brand external monitor are you using? Was it connected directly to your Mac? Have you tried connecting it via a dock?

I am not sure what "Tim" has to say about reformatting as I can't find any of his posts but with all the time and effort you spent troubleshooting, a disk wipe and reinstall will be a cake walk. Tedious yes, but I would be doing that before throwing money at a major parts swap either of which may or may not address the issue. I do this act every couple of years and even though it didn't resolve my previous unexplained period of crashes, it's always good to start with a clean slate. But don't be hasty and put all your confidence in a cloud service because you likely have files parked in folders that are not synched. This is where your Time Machine, clone copies and manual saves to external drives will save the day.

tvdon1 wrote:

Would it be possible to go into a little more detail as to how you diagnosed this to be my logic board or external hard drive? Did you see something in the logs?

Nothing specific. It’s just an educated guess. It’s a process of elimination combined with other people’s recent experiences and limited opportunities to affect change. In the past, kernel extensions were very popular and were common causes of panics. They were easy to remove at home and test. But they are rare now. Certain 3rd party hardware devices can cause panics and those are easy to remove and test. Beyond that, there simply isn’t anything you can do.

Sometimes people swear that a software update caused the panics. Whether that’s true or not, it’s relatively easy to test.

You can run that command line anytime and put 240 hours, for example. It will take longer to process but will show you the shutdowns experienced over 10 days. For what it's worth, it was nice to know what triggered a shutdown but sometimes I didn't get a code report and in the end, I was never able to pinpoint any specific cause.

Ah yes, the T2 security chip! This was a common theme seen in my quest for answers. I recall others zoning in on that as well, but I didn't always get that specific code after a crash/restart. I also recall feeling as you did when I was able to point the finger at something, anything. In the end, I just accepted it and it went away lol. Thanks for the memory jog and kindly post back if you have other eureka moments.

Are you running TGPro system fan monitor? This 3rd party utility kept alerting me to a faulty fan but other tests did not concur. I ended up removing it. I only mention this because there was some coincidence in the timing of my issue and this subsequent software removal. I can’t say for certain though if it was the sole cause or even part of it.

The benefit of reformatting in this regard is you can troubleshoot after each different software install. It is a tedious chore.

There is also a way to disable the T2 chip, albeit temporarily. I recall doing that act but I also recall something sketchy about it.

I feel your frustration. This crash/restart/repeat is random and not a one-off thing. My system often crashed several times a day or once every few days. There was no rhyme or reason. But like I previously mentioned, I gave up with this all-consuming task and just suffered through the events. Eventually the issue went away. Hopefully you’ll get your own reprieve soon.