Previous 1 2 Next 16 Replies Latest reply: Sep 7, 2011 3:06 AM by James Wilde
James Wilde Level 1 Level 1 (0 points)

Since the upgrade to Lion I've been having very many panic shutdowns and rather than wait for Apple to fix all the bugs in Lion, I've decided to see if I can minimise downtime myself.

 

I've found a very useful document, TN2123, a technical note on understanding crashes.  However, this report seems to deal more with application crash reports.  Is there a similar technical note for the panic reports my machine sends after every shutdown?  These do not appear to be in the same format.  And btw, is TN2123 the latest note on crashes?  It goes up to version 6, and I've no idea what version of the crash reporter is in Lion.

 

TIA

 

//James


Mac mini, Mac OS X (10.7)
  • thomas_r. Level 7 Level 7 (29,950 points)

    Kernel panics are usually caused by either hardware issues or bad/incompatible kernel extensions.  (The latter are usually installed by third-party software.)  Since you say the problems just started after installing Lion, I'd say incompatible third-party software is likely to blame.  If you post a kernel panic log, we can help you figure out some likely culprits.  See the folloiwng link for info on where to find the log:

     

    http://support.apple.com/kb/ht2546

  • James Wilde Level 1 Level 1 (0 points)

    Details of the machine (MacMini4.1) etc appear in the report itself.  In short it has a 2.4 GHz Intel Core 2 Duo processor and 2 GB of 1067 MHz DDR3 memory.  The boot hard disk is the internal 320 GB disk.  I have just seen that the graphics card is NVIDIA, and I have seen a number of reports about panics with that type of card.  The only external devices are a 250 GB LaCie disk which I use for Time Machine backups and a Brother HL-5340D laser printer.  Oh, and there is an external dvd drive which I occasionally use for burning (but not since upgrading to Lion).

     

     

    The problem most often occurs when I am on the internet, either with Safari or, as in the last three cases, with the App app.  I have been trying to download Lion again in order to be able to create a Lion bootable installation disk.  Each time the panic has occurred in less than 10-15 minutes.

     

     

    I'm very grateful if you can interpret the log - I have several others I can send if necessary - and help me to a solution.

     

     

    Here is the panic log:

     

     

    Tue Sep  6 14:32:31 2011

    panic(cpu 0 caller 0xffffff80002c268d): Kernel trap at 0xffffff8000557714, type 14=page fault, registers:

    CR0: 0x000000008001003b, CR2: 0x0000000000000008, CR3: 0x0000000000100000, CR4: 0x0000000000000660

    RAX: 0x0000000000000000, RBX: 0x0000000000000008, RCX: 0x0000000000000020, RDX: 0xffffff8003247790

    RSP: 0xffffff803a7b2f10, RBP: 0xffffff803a7b2f10, RSI: 0xffffff80077a47c0, RDI: 0x0000000000000008

    R8:  0xffffff803a7b2ee8, R9:  0xffffff80008d8d40, R10: 0x0000000000000000, R11: 0xffffff7f80cfe10c

    R12: 0x0000000000000042, R13: 0xffffff803b520b7a, R14: 0x0000000000000001, R15: 0xffffff803a7b3020

    RFL: 0x0000000000010282, RIP: 0xffffff8000557714, CS:  0x0000000000000008, SS:  0x0000000000000010

    CR2: 0x0000000000000008, Error code: 0x0000000000000000, Faulting CPU: 0x0

     

     

    Backtrace (CPU 0), Frame : Return Address

    0xffffff803a7b2bd0 : 0xffffff8000220702

    0xffffff803a7b2c50 : 0xffffff80002c268d

    0xffffff803a7b2df0 : 0xffffff80002d7a3d

    0xffffff803a7b2e10 : 0xffffff8000557714

    0xffffff803a7b2f10 : 0xffffff7f8186e42b

    0xffffff803a7b2f60 : 0xffffff8000344d9a

    0xffffff803a7b3070 : 0xffffff80003c333d

    0xffffff803a7b32e0 : 0xffffff80003caee9

    0xffffff803a7b3380 : 0xffffff80003cb3de

    0xffffff803a7b3570 : 0xffffff80003c8607

    0xffffff803a7b3bc0 : 0xffffff80003bda2e

    0xffffff803a7b3c10 : 0xffffff80003bf575

    0xffffff803a7b3db0 : 0xffffff80003bf6ed

    0xffffff803a7b3dd0 : 0xffffff8000361f80

    0xffffff803a7b3e00 : 0xffffff8000346850

    0xffffff803a7b3e90 : 0xffffff8000341211

    0xffffff803a7b3ec0 : 0xffffff8000345b76

    0xffffff803a7b3f60 : 0xffffff8000340e69

    0xffffff803a7b3fb0 : 0xffffff8000820057

          Kernel Extensions in backtrace:

             com.eltima.ElmediaPlayer.kext(1.0)[B9CBA7AD-5027-7325-7145-E860E49C0C58]@0xffff ff7f8186d000->0xffffff7f8186ffff

     

     

    BSD process name corresponding to current thread: kernel_task

     

     

    Mac OS version:

    11B26

     

     

    Kernel version:

    Darwin Kernel Version 11.1.0: Tue Jul 26 16:07:11 PDT 2011; root:xnu-1699.22.81~1/RELEASE_X86_64

    Kernel UUID: D52AAB80-B2BC-3C6E-BBEA-78BD28064998

    System model name: Macmini4,1 (Mac-F2208EC8)

     

     

    System uptime in nanoseconds: 1825908346812

    last loaded kext at 129354893933: com.apple.filesystems.smbfs          1.7.0 (addr 0xffffff7f807d1000, size 241664)

    last unloaded kext at 156594232809: com.apple.driver.AppleMCP89RootPortPM          1.11 (addr 0xffffff7f81d3b000, size 24576)

    loaded kexts:

    com.sophos.kext.sav          7.3.0

    com.eltima.ElmediaPlayer.kext          1.0

    org.virtualbox.kext.VBoxNetAdp          4.0.12

    org.virtualbox.kext.VBoxNetFlt          4.0.12

    org.virtualbox.kext.VBoxUSB          4.0.12

    org.virtualbox.kext.VBoxDrv          4.0.12

    com.apple.filesystems.smbfs          1.7.0

    com.apple.driver.AppleIntelProfile          81

    com.apple.driver.AppleHWSensor          1.9.4d0

    com.apple.filesystems.autofs          3.0

    com.apple.driver.AppleMikeyHIDDriver          122

    com.apple.driver.AppleUpstreamUserClient          3.5.9

    com.apple.driver.AppleMCCSControl          1.0.24

    com.apple.driver.ApplePlatformEnabler          2.0.2d1

    com.apple.driver.AppleMikeyDriver          2.1.1f12

    com.apple.driver.AudioAUUC          1.59

    com.apple.driver.AppleHDA          2.1.1f12

    com.apple.driver.AGPM          100.12.40

    com.apple.driver.AppleLPC          1.5.1

    com.apple.GeForce          7.0.4

    com.apple.iokit.IOUserEthernet          1.0.0d1

    com.apple.Dont_Steal_Mac_OS_X          7.0.0

    com.apple.driver.AudioIPCDriver          1.2.0

    com.apple.driver.ACPI_SMC_PlatformPlugin          4.7.0b2

    com.apple.driver.AppleIRController          309

    com.apple.AppleFSCompression.AppleFSCompressionTypeDataless          1.0.0d1

    com.apple.AppleFSCompression.AppleFSCompressionTypeZlib          1.0.0d1

    com.apple.BootCache          32

    com.apple.iokit.SCSITaskUserClient          3.0.0

    com.apple.iokit.IOAHCIBlockStorage          2.0.0

    com.apple.driver.AppleSDXC          1.1.0

    com.apple.iokit.AppleBCM5701Ethernet          3.0.6b9

    com.apple.driver.AirPort.Brcm4331          511.20.10

    com.apple.driver.AppleFWOHCI          4.8.6

    com.apple.driver.AppleEFINVRAM          1.5.0

    com.apple.driver.AppleUSBHub          4.4.0

    com.apple.driver.AppleAHCIPort          2.1.8

    com.apple.driver.AppleRTC          1.4

    com.apple.driver.AppleUSBEHCI          4.4.0

    com.apple.driver.AppleUSBOHCI          4.4.0

    com.apple.driver.AppleHPET          1.6

    com.apple.driver.AppleACPIButtons          1.4

    com.apple.driver.AppleSMBIOS          1.7

    com.apple.driver.AppleACPIEC          1.4

    com.apple.driver.AppleAPIC          1.5

    com.apple.driver.AppleIntelCPUPowerManagementClient          166.0.0

    com.apple.nke.applicationfirewall          3.0.30

    com.apple.security.quarantine          1

    com.apple.driver.AppleIntelCPUPowerManagement          166.0.0

    com.apple.driver.AppleProfileTimestampAction          81

    com.apple.driver.AppleProfileThreadInfoAction          81

    com.apple.driver.AppleProfileRegisterStateAction          81

    com.apple.driver.AppleProfileReadCounterAction          81

    com.apple.driver.AppleProfileKEventAction          81

    com.apple.driver.AppleProfileCallstackAction          81

    com.apple.iokit.AppleProfileFamily          81

    com.apple.kext.triggers          1.0

    com.apple.driver.AppleAVBAudio          1.0.0d11

    com.apple.driver.DspFuncLib          2.1.1f12

    com.apple.driver.AppleSMBusController          1.0.10d0

    com.apple.nvidia.nv50hal          7.0.4

    com.apple.NVDAResman          7.0.4

    com.apple.iokit.IONDRVSupport          2.3

    com.apple.iokit.IOFireWireIP          2.2.3

    com.apple.iokit.IOSurface          80.0

    com.apple.iokit.IOBluetoothSerialManager          2.5f17

    com.apple.iokit.IOSerialFamily          10.0.5

    com.apple.iokit.IOAVBFamily          1.0.0d22

    com.apple.driver.AppleUSBAudio          2.7.9f6

    com.apple.iokit.IOAudioFamily          1.8.3fc11

    com.apple.kext.OSvKernDSPLib          1.3

    com.apple.driver.AppleHDAController          2.1.1f12

    com.apple.iokit.IOGraphicsFamily          2.3

    com.apple.iokit.IOHDAFamily          2.1.1f12

    com.apple.driver.AppleSMC          3.1.1d2

    com.apple.driver.IOPlatformPluginFamily          4.7.0b2

    com.apple.driver.AppleSMBusPCI          1.0.10d0

    com.apple.driver.BroadcomUSBBluetoothHCIController          2.5f17

    com.apple.driver.AppleUSBBluetoothHCIController          2.5f17

    com.apple.iokit.IOBluetoothFamily          2.5f17

    com.apple.iokit.IOUSBHIDDriver          4.4.0

    com.apple.driver.AppleUSBComposite          3.9.0

    com.apple.iokit.IOSCSIMultimediaCommandsDevice          3.0.0

    com.apple.iokit.IOBDStorageFamily          1.6

    com.apple.iokit.IODVDStorageFamily          1.6

    com.apple.iokit.IOCDStorageFamily          1.7

    com.apple.driver.XsanFilter          403

    com.apple.iokit.IOAHCISerialATAPI          2.0.0

    com.apple.iokit.IOSCSIArchitectureModelFamily          3.0.0

    com.apple.iokit.IOEthernetAVBController          1.0.0d5

    com.apple.iokit.IO80211Family          400.40

    com.apple.iokit.IONetworkingFamily          2.0

    com.apple.iokit.IOFireWireFamily          4.4.3

    com.apple.iokit.IOUSBUserClient          4.4.0

    com.apple.iokit.IOAHCIFamily          2.0.6

    com.apple.driver.NVSMU          2.2.9

    com.apple.driver.AppleEFIRuntime          1.5.0

    com.apple.iokit.IOUSBFamily          4.4.0

    com.apple.iokit.IOHIDFamily          1.7.0

    com.apple.iokit.IOSMBusFamily          1.1

    com.apple.security.sandbox          165

    com.apple.kext.AppleMatch          1.0.0d1

    com.apple.security.TMSafetyNet          7

    com.apple.driver.DiskImages          326

    com.apple.iokit.IOStorageFamily          1.7

    com.apple.driver.AppleKeyStore          28.18

    com.apple.driver.AppleACPIPlatform          1.4

    com.apple.iokit.IOPCIFamily          2.6.5

    com.apple.iokit.IOACPIFamily          1.4

  • thomas_r. Level 7 Level 7 (29,950 points)

    If you look at all the loaded kexts (kernel extensions), you'll see the following third-party items at the top of the list:

     

    loaded kexts:

    com.sophos.kext.sav          7.3.0

    com.eltima.ElmediaPlayer.kext          1.0

    org.virtualbox.kext.VBoxNetAdp          4.0.12

    org.virtualbox.kext.VBoxNetFlt          4.0.12

    org.virtualbox.kext.VBoxUSB          4.0.12

    org.virtualbox.kext.VBoxDrv          4.0.12

     

    I don't know anything about the VirtualBox itesm, but I have seen both the Sophos AV and Elmedia Player kexts implicated in another kernel panic recently, so my suspicions would lie with those.  I don't know which was the culprit in that case.  I'd say you definitely want to get rid of Sophos... if you want AV software, switch to ClamXav, which won't cause you any problems.  (And read my Mac Virus Guide*, as education is important and over-reliance on AV software is dangerous.)  If uninstalling Sophos doesn't solve the problem, try those others.

     

    * Disclaimer: links to my pages may give me compensation, and should not be taken as endorsement of my services by Apple.

  • Thomas Brierley Level 3 Level 3 (540 points)

    I can confirm the VirtualBox kexts can cause kernel panics, but only while a virtual machine is in use... for me it's only ever happened during the boot or resume process (of the virtual machine).

     

    I'm against the windows AV ports anyway... but the idea of having one with a kernel extension just makes me shudder. Reminds me of Norton AV which liked to delete system files. Leave AV for other OS on the other OS.

  • James Wilde Level 1 Level 1 (0 points)

    Thanks, Thomas.  Installing Sophos was more of a belt and braces thing than anything else - perhaps it would catch something that I missed or was careless about.  I've removed it.  I have no idea where Elmedia Player came from.  I cannot find any reference to it in my applications folder, and it's not something I know that I've installed.

     

    Question is how to get rid of it and what might happen when I do.  I'll take a look around the machine in the usual places for the various bits of it and move them to a safe place, and see if that makes a difference.  However, I'm a firm believer in doing one thing at a time.  Now I've got rid of Sophos I'll wait a day or so and see what happens.

     

    Same with Virtual Box.  I don't use it very often - have been using it more than normal recently, although not today, when I have had five panics already.  I can check to see whether vmware has a Mac version. 

     

    I'm going to reboot the machine after removing Sophos and then start that download of Lion again and see what happens.  That's been my safest bet so far for reproducing the problem.

     

    I'll take a look at your Mac Safety site as well.

  • James Wilde Level 1 Level 1 (0 points)

    Thanks, Baltwo, for that list of documents.  I'll wade through them in the next few days.  I've been very lazy about checking log files for potential problems - something I did regularly when it was my job.

  • Linc Davis Level 10 Level 10 (154,570 points)

    Your panic, like many others, was caused by "Elmedia Player." Uninstall it, and never install any of that developer's products again. You also have Sophos installed. Although it didn't contribute to this panic, it's useless crapware that causes many problems, and you should uninstall it too.

  • James Wilde Level 1 Level 1 (0 points)

    Thanks Thomas (B) for the note on Virtual Box.  Since you're answering in here, I assume you're using Lion.  I've had VB on my Snow Leopard for a couple of years without problems, and that is one program that I do use and appreciate, so it'll be the last one I remove if the problems continue.  As I say, it's a few days since I fired up VB so it must be less likely to be responsible for today's problems.  I don't remember any of the panics that I have experienced occurring whilst I was in VB or even had it running, but I can't be sure about the latter, and I never had a panic under Snow Leopard.

  • James Wilde Level 1 Level 1 (0 points)

    Thanks, Linc.  Was it this part of the panic report that tipped you off?

     

    Kernel Extensions in backtrace:

             com.eltima.ElmediaPlayer.kext(1.0)[B9CBA7AD-5027-7325-7145-E860E49C0C58]@0xffff ff7f8186d000->0xffffff7f8186ffff

     

     

    BSD process name corresponding to current thread: kernel_task

     

    Here are the equivalent part of four other panic reports from today:

     

          Kernel Extensions in backtrace:

             com.eltima.ElmediaPlayer.kext(1.0)[B9CBA7AD-5027-7325-7145-E860E49C0C58]@0xffff ff7f8186d000->0xffffff7f8186ffff

     

     

    BSD process name corresponding to current thread: storeagent

     

          Kernel Extensions in backtrace:

             com.eltima.ElmediaPlayer.kext(1.0)[B9CBA7AD-5027-7325-7145-E860E49C0C58]@0xffff ff7f8186d000->0xffffff7f8186ffff

     

     

    BSD process name corresponding to current thread: Safari Webpage P

     

          Kernel Extensions in backtrace:

             com.eltima.ElmediaPlayer.kext(1.0)[B9CBA7AD-5027-7325-7145-E860E49C0C58]@0xffff ff7f8186d000->0xffffff7f8186ffff

     

     

    BSD process name corresponding to current thread: kernel_task

     

          Kernel Extensions in backtrace:

             com.eltima.ElmediaPlayer.kext(1.0)[B9CBA7AD-5027-7325-7145-E860E49C0C58]@0xffff ff7f8186d000->0xffffff7f8186ffff

     

     

    BSD process name corresponding to current thread: kernel_task

     

    In each case ElmediaPlayer is named, and none of the others.  I'll have to try and find where it came from, how many places it occupies, and get rid of it.  I have been to the website, and I have absolutely no recollection of ever having been there before, or of downloading media players of any kind - other than VLC.

  • Linc Davis Level 10 Level 10 (154,570 points)

    Was it this part of the panic report that tipped you off?

     

    Yes.

     

    I'll have to try and find where it came from, how many places it occupies, and get rid of it.

     

    It comes with an uninstaller. The last time I checked, the uninstaller seemed to be valid. You may have to download it again.

     

    To avoid this kind of problem in the future, be very cautious about installing any third-party software that's packaged as an installer or prompts for a password. I'd estimate that more than half of all the Mac problems reported on this site are caused by such things. Where Lion is involved, much more than half.

  • James Wilde Level 1 Level 1 (0 points)

    Well, I'll break my own rule, and disable two items at once.  I can't see that this product is installed, but I've searched the usual places and removed all traces I can find, and now I'll reboot and see if the console message log is clean for these two items.

     

    Thanks, Linc.

  • Thomas Brierley Level 3 Level 3 (540 points)

    I'd place my bets on the cause being sophos. I don't have anything against security software for Macs... as long as it's for Macs, sophos comes from a windows backgrounds and carries windows definitions. It also falls under the catagory of bloated resource hogging security software (a monitor everything all the time approach). So yeah i'd recommend having a look at Reed's AV suggestions and or reading up on Mac security, understanding the differences between viruses, malware / trojans, and user exploitability will protect you far more than any AV package on Mac OS and any other OS. The most important thing to remember is trusting the source of the software you install and or letting it have root access (think before you type that password).

     

    Looks like "Elmedia Player" is exactly what it sounds like: a Media Player. You may have deleted the application but this one leaves behind more than plists and support files. Meaning you must have given it access too, that's the other thing... when installing stuff, if it needs that kind of access it's because it wants to put stuff or modify stuff in your root library or system directory (i.e. add kexts) so you should also consider the stability of your system when installing software that requires kexts.

     

    They've included an uninstaller handily: http://www.eltima.com/download/elmedia_player_uninstaller.zip

     

    I have never heard of eltima software before and cannot say if they are trustworthy or not, but i had a look in the uninstaller script and it appears to be honorable enough, it's better to run the uninstaller or script rather than remove the items yourself because the daemon and kext needs to be stopped, see script below, you can just copy and paste this into your terminal and it will do the same as the uninstaller (it will ask for admin password):

     

    #!/bin/bash

     

     

    killall -TERM Elmedia\ Player

     

     

    /bin/launchctl unload /Library/LaunchDaemons/com.eltima.ElmediaPlayer.daemon.plist

     

     

    /sbin/kextunload /System/Library/Extensions/ElmediaPlayer.kext

     

     

    sudo /bin/rm -f /Library/LaunchDaemons/com.eltima.ElmediaPlayer.daemon.plist

     

     

    sudo /bin/rm -f -R /Library/Application\ Support/ElmediaPlayer/empdaemon

     

     

    sudo /bin/rm -f -R /System/Library/Extensions/ElmediaPlayer.kext

     

     

    sudo /bin/rm -f -R /Applications/Elmedia\ Player.app

  • Thomas Brierley Level 3 Level 3 (540 points)

    I like it too, it seems much more light weight than the other capable mac virtual machine software out there.

     

    Actually no i'm only talking from experience using it on 10.6.x

     

    I have had multiple kernel panics with it, however this was only ever during the boot process of the virtual machine... and i was really putting it through it's paces, as i was configuring / rebooting / configuring / rebooting a freeBSD VM in quick succession in order to test certain settings. It's also happened on two occasions while attempting to restore a saved state (which has never worked for me).

     

    However once beyond the initial boot process it has never caused a kp for me. So i think you are pretty safe... although they are loaded and included in the report i doubt those kexts are used at all unless VirtualBox is running.

Previous 1 2 Next