You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

After years of no problems, laptop keeps crashing repeatedly, and EtreCheck and DriveDx's apparently conflicting reports

Hello,

Essential background first.

I have been on Catalina final 10.15.7 on MB Air 2017 for a long time and have been using my laptop in exactly the same way – many apps open with several-to-many windows in some of the apps, as I work-work, personal-work, read, research, play, in an interleaving way.

I seldom had any problems.

(To head off advice, I should mention that: (a) I keep a good eye on ActivityMonitor's dock icon set to CPU history, and (b) I don't abuse my laptop – while I work, etc. on it, sports streams are on the iPad and Spotify is on the smartphone.)

In early October my SSD failed and I got a slightly-used one in good health. All went well without any change for about 50 days.

Then I got three system crashes in a single day – one panic, one hang/freeze, and then a restart. The crash report window didn't stick around (or got obscured by the automatically opening apps and windows – I tried to find it, to no avail) and I could not find anything in Console.(?) The only possibly relevant message I found, I snapshotted and am attaching.

Then my laptop restarted overnight when it was sleeping with the lid closed – when I opened it, it was on the login screen.

So that's four crashes in 24 hours. I just left it at the login screen. An hour or two later I thought I heard its fan – and it was! Touched the metal around [esc] and it was hot as ****! (Why?) So I shut it down.

By this time the battery was done for, having earlier been on the skids. CoconutBattery had showed the health at 70-something percent, quickly degrading into the 60s, then down to 47 percent.

I had to replace the battery anyway but it wasn't easy to find one though managed to get a slightly-used battery. The technician said that the crashes were surely due to the battery.

CoconutBattery shows the replacement battery's health at 87 percent.

Logged into my account at the shop and brought the laptop home. Left it with lid shut (had to go out again). When I opened it at night, it had restarted – showed the login screen. So the crashes have a cause other than the battery.

So then I logged into the first-created guest account (and am still logged into that without any crash for 24-plus hours). I am not using it remotely like I normally use my laptop (so yes, work, play, everything is suspended or offloaded to the iPad and smartphone).

Did some research and then got and ran Avast, EtreCheck, and DriveDx.  

No virus found. I've attached EtreCheck and DriveDx reports, and looking forward to your input.  

Re EtreCheck's recommendation, I am loth to allow anything to auto-update, having been bitten by it and not trusting Apple after the passing of Jobs, and the Lion fiasco (and all this craziness of auto-syncing everything, the O.S. and apps trying to second-guess you and essentially 'taking over,' etc.).  

The biggest point of confusion for me is that DriveDx says that my SSD is in very good health while EtreCheck, giving a 'Performance: Poor' grade, apparently says that the SSD is done for, as reads/writes are taking too long(?)

So all I can surmise is:–

1. Some app, daemon, or file in my user-account is infected and causes these crashes.

2. The SSD is not as good as DriveDx indicates and it is unable to deal with my heavy usage of the laptop (disk mediation, and VM swap-ins/swap-outs).

Would appreciate experts' feedback.

Thanks,

Kersie


MacBook Air (2018 – 2020)

Posted on Nov 30, 2024 11:10 AM

Reply
Question marked as Top-ranking reply

Posted on Nov 30, 2024 6:31 PM

So, a few things things:

  1. Without running Etrecheck with administrator privileges, you can't access the Diagnostic Report system and get the details of any Panic Reports - which is probably the critical piece that someone needs to see.
  2. Etrecheck and DriveDX aren't checking the same things. There could have very different outcomes. The analogy isn't perfect, but DriveDX is assessing disk health (is the disk going to have a heart attack and die) while Etrecheck is assessing fitness (can the disk run 100m sprints without having to stop and throw up).
  3. Given the other things you have mentioned, you might have multiple hardware issues - possible after SSD and battery, the motherboard is also dying...
47 replies
Question marked as Top-ranking reply

Nov 30, 2024 6:31 PM in response to Kersie

So, a few things things:

  1. Without running Etrecheck with administrator privileges, you can't access the Diagnostic Report system and get the details of any Panic Reports - which is probably the critical piece that someone needs to see.
  2. Etrecheck and DriveDX aren't checking the same things. There could have very different outcomes. The analogy isn't perfect, but DriveDX is assessing disk health (is the disk going to have a heart attack and die) while Etrecheck is assessing fitness (can the disk run 100m sprints without having to stop and throw up).
  3. Given the other things you have mentioned, you might have multiple hardware issues - possible after SSD and battery, the motherboard is also dying...

Nov 30, 2024 7:00 PM in response to g_wolfman

g_wolfman is spot on.

  • Your drive performance is dismal.
  • Valuable diagnostic reports not available without running as Administrator. The diagnosticd process is working overtime logging issues, but we cannot see them.
  • Even though Avast was just recently installed, you should use the uninstaller to remove it. Drive performance suffers with any AntiVirus and there is no benefit to using it. Run EtreCheck again after removal to see if the poor drive performance improves. If not, the drive is likely the culprit. The only other thing you can do is Factory Reset and compare the drive results again in EtreCheck.

Dec 1, 2024 7:55 AM in response to Kersie

If you can't boot in Safe Mode (or you can boot but still can't do anything useful) - you might consider getting a full diagnostic done at an Apple Store. It's entirely possible that you just lucked into a bad SSD. But there could be other issues and you have already replaced a battery and a SSD very close to each other.


Bluntly, if your logic board is failing, then a 2017 model MacBook Air is well beyond economical repair and you should be thinking about a replacement.

Dec 2, 2024 12:49 PM in response to Kersie

Kersie wrote (original post):

Logged into my account at the shop and brought the laptop home. Left it with lid shut (had to go out again). When I opened it at night, it had restarted – showed the login screen. So the crashes have a cause other than the battery.

So then I logged into the first-created guest account (and am still logged into that without any crash for 24-plus hours). I am not using it remotely like I normally use my laptop (so yes, work, play, everything is suspended or offloaded to the iPad and smartphone).

This tells me you have an issue with your main user account.


If Safe Mode works while logged into your main user account, then it is most likely a login item or possibly an app you allow to launch automatically when logging back in (separate from login items....such as an app you were using before a crash, logout, restart).



If your main macOS user account also has issues while booted into Safe Mode, then find out what is different between the two macOS user accounts. Is it accessing your AppleID/iCloud? Or other cloud based service? Or some app you used in the main account that you never used in the test account? Or are your device connections different? Browser extensions? Etc.


Having the diagnostic log summaries for the EtreCheck report would really help to figure what items have crashed.


As for the SSD performance, the overall read/write performance is Ok. You may want to check the file system for issues by running Disk Utility First Aid on the hidden Container. Within Disk Utility you may need to click "View" and select "Show All Devices" before the hidden Container appears on the left pane of Disk Utility. Even if the First Aid summary says everything is "Ok", click "Show Details" and scroll back through the report to see if any unfixed errors are listed. If there are errors, then run First Aid again until the errors are gone. If after several scans the errors remain, then run First Aid while booted into Recovery Mode.


Dec 3, 2024 8:38 PM in response to Kersie

The Kernel Panics are pointing to the same drive problems:

Could not recover SATA HDD after 5 attempts. Terminating.

AppleAHCIDiskQueueManager::setPowerState(0xffffff802d212000 : 0xffffff7f9cdca5d2, 3 -> 0) timed out


This corresponds with the same poor Read/Write speeds that are reported on the drive:

 Write speed: 561 MB/s

  Read speed: 751 MB/s


As before I would recommend uninstalling Avast first to rule out a Software problem, since that does not cost you anything and if the problem remains, the drive will need replaced.

Dec 4, 2024 6:51 AM in response to Kersie

As @Mac Jim ID mentions, all of the Kernel Panics are related to issues with the SSD. Usually when I see those types of Kernel Panics it indicates a hardware issue with the SSD's own controller (on the SSD itself). With all things being equal, the SSD is usually the weakest link as long as there is no liquid damage to the system. Unfortunately issues with the SSD's own controller are not monitored which is why the DriveDx report is not showing any problems. Most SSD failures I have encountered involve faulty SSD controllers.


I don't believe software is causing the Kernel Panics in this case, although I do agree that you should not be using any anti-virus apps, cleaning/optimizer apps, or third party security software since they are not needed on macOS because they usually cause more problems than they solve as they interfere with the normal operation of macOS at a very low level.

Dec 5, 2024 9:47 AM in response to Kersie

Kersie wrote:

First, it crashed soon after being woken from sleep; it was in Safe Mode. It booted up in Normal Mode. Then after 10-to-15 minutes at the login screen it crashed and began to restart (I was right there and was able to boot it in Safe Mode).

Exactly like I said these SSDs show their failures. Plus the latest Kernel Panic report once again is related to the SSD. I have no doubts the SSD is bad, or possibly the Logic Board's SSD support circuitry.


1. Thanks for the very helpful reply.
I realize I need to get a new laptop but when the (replacement) SSD is the only problem on this one, I certainly want to keep it.
I am getting in touch with OWC - MacSales to get one. I trust it is a reliable vendor.

They've been providing products and accessories specifically for Apple products for decades. They actually test their products work in the Macs for which they offer them. No one else does any product specific testing for Mac compatibility.


Please let me know if there are any online channels for OEM SSDs ('Vintage' leftover parts sellers, I suppose!).
If you have any tips on it, please let me know.

There are lot of places selling used parts. Some are good, some not. The good vendors are expensive and also provide clear product information & compatibility.


As it will be my first time, I may as well ask:–
Is there some clear guide, such as on iFixit, which spells out how I may DIY the replacement?

OWC provide installation videos on their product pages. The replacement/upgrade on this 2017 MBAir is very easy as far as repairs/upgrades go for SSDs.


2. Once done, is there some way to boot up so that it asks for WiFi login specs, choice of OS, and proceed to download it?

You can attempt to boot into Internet Recovery Mode using Command + Option + R to attempt to access the online macOS Monterey installer. Unfortunately some Macs may only boot to the online OS for the version of macOS which originally shipped on the computer from the factory which would be macOS 10.12 Sierra which is too old to work with an NVMe based internal SSD.


If you cannot access the Monterey installer through Internet Recovery Mode, then you will need to create a bootable macOS USB installer using the instructions in the following Apple article:

Create a bootable installer for macOS - Apple Support


It does require access to a working Mac generally from Late-2009 to mid-2022 since you can only create the installer on a Mac that is compatible with that same OS (that Mac can currently be running any version of macOS). Generally you need:

  • macOS 12.x -- a Mac from 2014 to mid-2022 (can be an M-series Mac)
  • macOS 10.15 -- a Mac from 2012 to mid-2020
  • macOS 10.13 -- a Mac from Late-2009 to mid-2018


You can use the information in the following article to confirm hardware & macOS compatibility:

https://eshop.macsales.com/guides/Mac_OS_X_Compatibility


FYI, if you never previously installed macOS 12.x Monterey, then you may not be able to install it now since the first time installing Monterey on a device the installer requires a working Apple OEM internal SSD to be installed in order to update the system firmware (even when installing to an external drive). Once Monterey has been installed one time, then subsequent re-installations do not require the Apple OEM SSD to be installed internally.

Dec 6, 2024 12:18 PM in response to Kersie

As you've already been told your disk speed is abysmal:

Write speed: 625 MB/s

Read speed: 764 MB/s

They should be about 3x of what you're getting. The reason may be the 3rd party software you've installed: Bitdefender and Avast. There is no reason to ever install or run any 3rd party "cleaning", "optimizing", "speed-up", anti-virus, VPN or security apps on your Mac.  This documents describe what you need to know and do in order to protect your Mac: Effective defenses against malware and other threats - Apple Community and Recognize and avoid phishing messages, phony support calls, and other scams - Apple Support.  


There are no known viruses, i.e. self propagating, for Macs.  There are, however, adware and malware which require the user to install although unwittingly most of the time thru sneaky links, etc.   


Anti Virus developers try to group all types as viruses into their ad campaigns of fear.  They do a poor job of the detecting and isolating the adware and malware.  Since there are no viruses these apps use up a lot of system resources searching for what is non-existent and adversely affect system and app performance.


There is one app, Malwarebytes, which was developed by a long time contributor to these forums and a highly respected member of the computer security community, that is designed solely to seek out adware and known malware and isolate/remove it.  The free version is more than adequate for most users.  


I recommend you uninstall Bitdefender and Avast according to the developer's instructions.


You can check to see if you've removed all of the supporting files by downloading and running the shareware app Find Any File to search for any files with the application's or the developer's name in the file name.  For the software mentioned you'd do the following search(es): 


1 - Name contains bitdefender

2 - Name contains avast


Any files that are found can be dragged from the search results window to the Desktop or Trash bin in the Dock for deletion.


FAF can search areas that Spotlight can't like invisible folders, system folders and packages.  


If you get warnings that the file can't be deleted because it is in use or used by another app boot into Safe Mode according to How to use safe mode on your Mac and delete from there.


Note:  if you have a wireless keyboard with rechargeable batteries connect it with its charging cable before booting into Safe Mode.  This makes it act as a wired keyboard as will assure a successful boot into Safe Mode.


Dec 4, 2024 3:26 PM in response to Kersie

There are no viruses that affect macOS so just forget that idea. I'm not sure if you had intended to remove "Avast" or not, but that report clearly indicated its continued presence. If you experience another KP please post a new crash report.


I suspect a faulty SSD, but I also happen to know certain non-Apple "anti-virus" products are capable of causing kernel panics. Its presence will only add complexity to troubleshooting, especially over this very limited communications method.


The idiomatic expression "does more harm than good" is completely understandable, but applying it to non-Apple "anti-virus" products is inappropriate. Such products can only inflict harm. They are capable of nothing beneficial. Mathematically expressed the "harm" to "good" ratio = infinity.


Rule 1 of Macs is don't install junk. 

Dec 4, 2024 6:14 PM in response to Kersie

Kersie wrote:

Thanks. Somehow I had missed this.
I've uninstalled Avast.
However, these problems began and became chronic before I'd installed Avast. I installed Avast only to scan for viruses in case that may have been causing the crashes/restarts.

Not surprising if you have a hardware issue. All but two of the Kernel Panics listed in the EtreCheck report are related to the SSD.....that is also very telling.


Diagnostics Information (past 60 days):
    
    2024-11-29 17:21:17 Kernel Panic
        Details:
            panic(cpu 1 caller 0xffffff80136c0742): initproc exited -- exit reaso
            n namespace 2 subcode 0xa description: none
            Could not recover SATA HDD after 5 attempts. Terminating.


    2024-11-28 08:44:41 Kernel Panic (2 times)
        First occurrence: 2024-11-27 15:10:30
        Details:
            panic(cpu 2 caller 0xffffff7f91971a8d): watchdog timeout: no checkins
            from watchdogd in 97 seconds (124 total checkins since monitoring last
             enabled)
            Could not recover SATA HDD after 5 attempts. Terminating.


    2024-11-28 04:22:14 Kernel Panic
        Details:
            panic(cpu 0 caller 0xffffff801a613767): "AppleAHCIDiskQueueManager::se
            tPowerState(0xffffff802d212000 : 0xffffff7f9cdca5d2, 3 -> 0) timed out
             after 102195 ms"@\/AppleInternal\/BuildRoot\/Library\/Caches\/com.app
            le.xbs\/Sources\/xnu\/xnu-6153.141.66\/iokit\/Kernel\/IOServicePM.cpp:
            5296


    2024-11-27 23:09:04 Kernel Panic (2 times)
        First occurrence: 2024-11-27 14:04:06
        Details:
            panic(cpu 0 caller 0xffffff8019c47cba): Kernel trap at 0xffffff801a13a
            6c0, type 14=page fault, registers:
            Could not recover SATA HDD after 5 attempts. Terminating.


Both "SATA HDD" and "AppleAHCI" indicate the internal drive (aka the SSD in your case).


Look at the sections of the Kernel Panic logs which I highlighted. They all mention trouble communicating with the SSD and one even specifically mentioned "set Power State .... timed out", so the SSD was not able to go ready after power was supplied to the SSD. I have seen these types of Kernel Panics many times with my organization's Macs and they have always been due to a bad SSD. Most times these failures occur when waking the computer from sleep, or when powering on the computer. There is a slim chance that the Logic Board could be faulty if the SSD support circuitry on the MLB is bad or damaged, but in my own personal experience the SSD is the weakest link.


FYI, you do need to be careful even when you replace the SSD with another Apple OEM SSD since macOS may not work properly if macOS detects that the SSD does not belong to that computer model. I had several Apple OEM SSDs which I tried to use in another Mac, but macOS refused to even boot with one of them while the other had some odd issues. Both SSDs booted & worked 100% when I installed & booted Linux from them. I knew the SSDs were healthy since I removed them from a system that had other non-SSD related issues. It is very difficult to be 100% certain an Apple OEM SSD will be fully compatible with macOS since getting one with the correct connector is not a guarantee of compatibility, so be careful.


Assuming the Logic Board is not the problem here, you may want to replace it with a third party SSD from OWC which is a drop in replacement that is much faster than the original Apple OEM SSD (it is an NVMe based SSD that runs 2x-3x as fast). However, with NVMe based SSDs you can only use macOS 10.13+ on them since older versions of macOS did not have an NVMe driver. Assuming you are comfortable spending money on an older computer that can only run macOS 12.x Monterey. Even the lowest end M-series Mac will run circles around an Intel MBAir since those airs were very low specced systems.

Dec 4, 2024 6:24 PM in response to Mac Jim ID

Mac Jim ID wrote:

This corresponds with the same poor Read/Write speeds that are reported on the drive:
 Write speed: 561 MB/s
  Read speed: 751 MB/s

FYI, this is the maximum transfer rate of a SATA III controller and SSD. Apple never shipped an NVMe based SSD in any of their non-USB-C laptops. Only USB-C model laptops from 2016+ included an NVMe based SSD from the factory. The OP has a 2017 MacBook Air which did not have USB-C. The MBAirs only got USB-C and NVMe SSDs starting with the 2018 model (2 years after the Pros had them).


Only with the release of macOS 10.13 did Apple update the system firmware to allow the use of an internal NVMe based SSD and include NVMe drivers.

Dec 6, 2024 6:10 PM in response to Kersie

Kersie wrote:

I've asked OWC a couple of questions, if you know:
1.What do the stars (*) before some of the products indicate.

I don't see any on the page you linked. Usually somewhere further down the page either at the end of a section or perhaps at the bottom of the page there should be a footnote with "*".


2. Why do the SSDs (from the same manufacturer) have such wildly disparate warranty periods – two years through five years.

They are usually two different tiers of drives. One is either low end or average, while the other one is a higher end drive.

Dec 6, 2024 6:44 PM in response to Kersie

2. Why do the SSDs (from the same manufacturer) have such wildly disparate warranty periods – two years through five years.


If you're asking about OWC's three vs. five year warranty, of course it would be best to ask them but I have always assumed the longer warranty / more expensive ones use NAND memory with a greater write / erase cycle limit. That life cycle limit means all SSDs wear out — eventually — but I have never had one of theirs fail despite extensive daily use. I only buy their "five year" varieties. I believe the oldest one I have is now about fifteen years old and still works as well as it did when it was new.


You don't always get what you pay for in this business but OWC has earned their stellar reputation.

After years of no problems, laptop keeps crashing repeatedly, and EtreCheck and DriveDx's apparently conflicting reports

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.