What all is plugged in at home that wasn't while it was at Apple?
External Drive(s), Ethernet, Printers, cables?
Open console in Applications>Utilities, check the system log for the date/time of the last problem & the Startup right after that for clues.
One way to test is to Safe Boot from the HD, (holding Shift key down at bootup), run Disk Utility in Applications>Utilities, then highlight your drive, click on Repair Permissions, Test for problem in Safe Mode...
PS. Safe boot may stay on the gray radian for a long time, let it go, it's trying to repair the Hard Drive
Reboot, test again.
If it only does it in Regular Boot, then it could be some hardware problem like Video card, (Quartz is turned off in Safe Mode), or Airport, or some USB or Firewire device, or 3rd party add-on, Check System Preferences>Accounts (Users & Groups in later OSX versions)>Login Items window to see if it or something relevant is listed.
Check the System Preferences>Other Row, for 3rd party Pref Panes.
Also look in these if they exist, some are invisible...
After you force your Mac to restart, does it present a dialog box like the following:
If it does, click the Report button, then copy and paste the text in a reply.
In addition to BDAqua's excellent suggestions, a report of system modifications that may be contributing to the problem can be easily determined by running the following free utility:
Apple Support Communities contributor etresoft wrote a very useful app to quickly gather certain system information that may help point to a cause of this problem. Go to his website, download and run EtreCheck:
Etrecheck will be in your Downloads folder. Open it from there. You may see the following dialog box:
Click Open - etresoft contributes to this forum frequently and can be considered a trustworthy developer.
It will take a moment to run as it collects its data.
Copy and paste its output in a reply.
Do not be concerned about anything that says "Problem" or "failed".
EtreCheck was designed to remove any personal information (such as your computer's name and serial numbers) but if you see anything that looks like an email address or any other personal information that should not be divulged to others, please delete or obscure that information when you post the reply.
When you are finished with EtreCheck, quit the program. It occupies very little space, and you can keep it or drag it to the Trash as you wish.
The symptoms you describe seem to implicate a memory problem. The memory test performed by Apple Hardware Test is fairly cursory. You can also perform an extensive test of system memory by using the donationware utility Rember.
Sometimes it comes up with the problem dialog box, but not always, and it didn't last night. Next time the box comes up I will paste the contents here, but I'm not sure when that will be as they happen randomly.
This is what Etresoft said:
iMac - model: iMac10,1
1 3.06 GHz Intel Core 2 Duo CPU: 2 cores
8 GB RAM
ATI Radeon HD 4670 - VRAM: 256 MB
OS X 10.8.3 (12D78) - Uptime: 0 days 1:30
ST31000528AS disk0 : (1 TB)
disk0s1 (disk0s1) <not mounted>: 209.7 MB
Macintosh HD (disk0s2) /: 999.35 GB (951.31 GB free)
Recovery HD (disk0s3) <not mounted>: 650 MB
OPTIARC DVD RW AD-5680H
SanDisk Cruzer 4.01 GB
NO NAME (disk1s1) /Volumes/NO NAME: 4.01 GB (4 GB free)
Apple Inc. Built-in iSight
Apple Internal Memory Card Reader
Apple Inc. iPod 15.8 GB
disk2s1 (disk2s1) <not mounted>: 254 KB
Luke O' Sullivan’s iPod (disk2s2) /Volumes/Luke O' Sullivan’s iPod: 15.8 GB (12.65 GB free)
Toshiba External USB 3.0 1 TB
disk3s1 (disk3s1) <not mounted>: 209.7 MB
BACK-UP (disk3s2) /Volumes/BACK-UP: 999.86 GB (955.72 GB free)
Apple Computer, Inc. IR Receiver
Apple Inc. BRCM2046 Hub
Apple Inc. Bluetooth USB Host Controller
Problem System Launch Daemons:
Problem System Launch Agents:
[not loaded] com.adobe.AAM.Updater-1.0.plist
User Launch Agents:
User Login Items:
3rd Party Preference Panes:
User Internet Plug-ins:
Top Processes by CPU:
Top Processes by Memory:
188 MB WebProcess
82 MB iTunes
74 MB Safari
66 MB mds
57 MB WindowServer
49 MB Dock
41 MB Console
25 MB CalendarAgent
16 MB com.apple.dock.extra
16 MB PopClip
I found the time where I had to force restart my computer, and have pasted the 10 minutes previous (there's lots of things that say 'failed':
26/04/2013 21:23:48.563 WindowServer: CGXRegisterWindowWithSystemStatusBar: window b already registered
26/04/2013 21:24:58.623 com.apple.quicklook.satellite: bootstrap_look_up2 failed with 0x44c
26/04/2013 21:24:59.000 kernel: Sandbox: sandboxd(1290) deny mach-lookup com.apple.coresymbolicationd
26/04/2013 21:25:06.114 WindowServer: CGXRegisterWindowWithSystemStatusBar: window b already registered
26/04/2013 21:25:07.021 sandboxd: () QuickLookSatelli(1289) deny mach-lookup com.apple.PowerManagement.control
26/04/2013 21:26:15.649 WindowServer: CGXRegisterWindowWithSystemStatusBar: window b already registered
26/04/2013 21:26:28.713 WindowServer: CGXRegisterWindowWithSystemStatusBar: window b already registered
26/04/2013 21:26:30.777 WindowServer: CGXRegisterWindowWithSystemStatusBar: window b already registered
26/04/2013 21:26:49.120 com.apple.usbmuxd: _heartbeat_failed heartbeat detected detach for device 0x26-192.168.1.64:0!
26/04/2013 21:28:36.000 kernel: (default pager): [KERNEL]: ps_allocate_cluster - send HI_WAT_ALERT
26/04/2013 21:28:36.000 kernel: macx_swapon SUCCESS
26/04/2013 21:29:24.890 mDNSResponder: 72: Could not write data to clientPID[-1]() because of error - aborting connection
26/04/2013 21:29:24.894 mDNSResponder: 72: DNSServiceGetAddrInfo v4v6 a1505.dspl.akamai.net. PID[-1]()
26/04/2013 21:29:24.895 mDNSResponder: 73: Could not write data to clientPID[-1]() because of error - aborting connection
26/04/2013 21:29:24.898 mDNSResponder: 73: DNSServiceGetAddrInfo v4v6 a1505.dspl.akamai.net. PID[-1]()
26/04/2013 21:29:24.898 mDNSResponder: 74: Could not write data to clientPID[-1]() because of error - aborting connection
26/04/2013 21:29:24.903 mDNSResponder: 74: DNSServiceGetAddrInfo v4v6 a1505.dspl.akamai.net. PID[-1]()
26/04/2013 21:30:20.293 com.apple.usbmuxd: _heartbeat_failed heartbeat detected detach for device 0x28-192.168.1.90:0!
26/04/2013 21:30:21.000 kernel: Sandbox: sandboxd(1310) deny mach-lookup com.apple.coresymbolicationd
26/04/2013 21:30:22.759 sandboxd: () WebProcess(191) deny file-read-data /Users/Luke/Library/Preferences/com.apple.ServicesMenu.Services.plist
26/04/2013 21:30:22.773 sandboxd: () WebProcess(191) deny mach-lookup com.apple.pbs.fetch_services
26/04/2013 21:30:35.457 AddressBookSourceSync: *** -[IADomainCache init]: IA domains cache couldn't be read.
26/04/2013 21:30:42.121 com.apple.backupd: Starting automatic backup
26/04/2013 21:30:42.187 com.apple.backupd: Backing up to: /Volumes/BACK-UP/Backups.backupdb
26/04/2013 21:30:45.709 com.apple.backupd: Using file event preflight for Macintosh HD
26/04/2013 21:30:46.124 com.apple.backupd: Will copy (14.6 MB) from Macintosh HD
26/04/2013 21:30:46.133 com.apple.backupd: Found 487 files (27.7 MB) needing backup
26/04/2013 21:30:46.138 com.apple.backupd: 620.8 MB required (including padding), 955.88 GB available
26/04/2013 21:31:01.379 com.apple.backupd: Copied 1769 files (30.4 MB) from volume Macintosh HD.
26/04/2013 21:31:01.393 com.apple.backupd: Using file event preflight for Macintosh HD
26/04/2013 21:31:01.402 com.apple.backupd: Will copy (17 KB) from Macintosh HD
26/04/2013 21:31:01.403 com.apple.backupd: Found 26 files (17 KB) needing backup
26/04/2013 21:31:01.404 com.apple.backupd: 587.6 MB required (including padding), 955.85 GB available
26/04/2013 21:31:03.903 com.apple.backupd: Copied 428 files (17 KB) from volume Macintosh HD.
26/04/2013 21:31:03.968 com.apple.backupd: Created new backup: 2013-04-26-213103
26/04/2013 21:31:04.826 com.apple.backupd: Starting post-backup thinning
26/04/2013 21:31:06.225 com.apple.backupd: Deleted /Volumes/BACK-UP/Backups.backupdb/Luke’s iMac/2013-04-25-205656 (12.9 MB)
26/04/2013 21:31:06.227 com.apple.backupd: Post-back up thinning complete: 1 expired backups removed
26/04/2013 21:31:06.264 com.apple.backupd: Backup completed successfully.
26/04/2013 21:33:07.844 Dock: no information back from LS about running process
26/04/2013 21:33:12.100 WindowServer: CGXRegisterWindowWithSystemStatusBar: window b already registered
26/04/2013 21:33:40.643 WindowServer: CGXRegisterWindowWithSystemStatusBar: window b already registered
This is where it froze, I kept the computer on to see whether the music would keep playing past the current song, which it didn't, so I turned it off. It then goes on to boot:
26/04/2013 21:40:15.000 bootlog: BOOT_TIME 1367008815 0
I can paste the rest of startup as well if it helps?
I will repair disk permissions but it may be worth pointing out that I usually do this every month anyway - even in the months leading up to the hard-drive failure.
It might also be worth pointing out that I haven't ever had a backup drive plugged in at the time of a crash before.
Shut down your Mac and disconnect the SanDisk Cruzer and iPod. Start your iMac normally, then using Disk Utility, repair the backup volume on your Toshiba drive. You will be using the "Repair Disk" button - not "Repair Disk Permissions".
It is normal for the repair to take a long time.
If Disk Utility finds any errors indicated in red, copy the text exactly as it appears and report it.
None of this explains why the Mac simply freezes. That should never happen outside of a hardware fault, but that includes faulty USB-connected hardware. See if the problem remains after those external devices are disconnected.
No errors were found when repairing the disk. I also didn't have the backup drive plugged in ever before when the computer crashed. I wouldn't have thought the SanDisk Cruzer memory stick would have caused the crash, but that is the only thing that was plugged in that could potentially have been plugged in every time the computer has crashed.
I used Rember to test the RAM and it reported no errors.
... I also didn't have the backup drive plugged in ever before when the computer crashed.
Thanks; I had interpreted the opposite.
BDAqua's suggestions still remain - Safe Boot, and add to the list creating a temporary account to isolate user-specific problems: Isolating an issue by using another user account
CandyBar should be considered suspicious as well - read: http://www.panic.com/blog/2012/08/candybar-mountain-lion-and-beyond/
I don't know how it does what it does. It's obviously a system modification and as such, has unknown potential effects. Such system hacks often do not survive a simple OS X update and it's clear the developer is aware that it could cause problems. When in doubt, remove such things.
Okay, I've reset everything CandyBar changed and uninstalled it (I found a more reliable way to change the ugly Finder icon without messing with any code). I'll call that solved unless it pops up again, since this is the only explanation I can think of (I didn't know CandyBar was unsupported and unstable).
Thanks for your help!!!
Don't think it could have anything to do with a hard drive since in the last 2 days, my Macbook Air has crashed completely a half a dozen times. That is more then it has ever crashed in total prior to that (If it ever did). My Macbook Air has not hard drive, only solid state. These crashes have occured when I am watching a video. The screen will freeze, maybe run jerky for a fraction of a second, and the next thing I see is the gray screen announcing a total crash. Reboot is very rapid, faster then a normal reboot, like it is loading back the state it was just in and most programs open seem to come back nearly to where they were before the crash. What is going on? It has NEVER been this unstable ever. Did something change on the OS? I work through an Airport Extreme Router which has hard drives attached to it, but that is not new. The router periodically loses touch with the drives and I find the Airport Extreme not a very reilable device because of that. It seemed to get a little better with the last firmware upgrade, but over all, I am thinking of getting a dedicated server for my extra drives and simply taking the task of management away from the Airport Extreme. Maybe if I demote it to be just a simple router, this will get better. I had hoped to stay with All-Apple devices. I thought they should play well together, but this crashing is for the birds......
Bad news... it crashed again. And it didn't give me an error message or anything to identify the problem.
uTorrent, Photoshop, QuickTime, iTunes, Mail and many Safari tabs were open - but the computer was running fast with no signs of a lack of memory. I was in Safari at the time of the crash: the following is taken from Console, and shows the last actions before the crash:
16/05/2013 22:39:56.630 Safari: Top Hit URL autocompleted in combined field
16/05/2013 22:39:56.632 Safari: URL entered in combined field
16/05/2013 22:39:58.023 Safari: Web Page visited
I have a feeling I may have been in Safari every time it has crashed, but can't be sure. CandyBar is uninstalled. uTorrent and Photoshop were the only things running from outside of the App Store.
More from console just before the time of the crash:
16/05/2013 22:24:51.615 com.apple.backupd: Created new backup: 2013-05-16-222451
16/05/2013 22:24:51.721 com.apple.backupd: Starting post-backup thinning
16/05/2013 22:25:01.670 com.apple.backupd: Deleted /Volumes/BACK-UP/Backups.backupdb/Luke’s iMac/2013-05-15-220838 (44.9 MB)
16/05/2013 22:25:01.670 com.apple.backupd: Post-back up thinning complete: 1 expired backups removed
16/05/2013 22:25:01.740 com.apple.backupd: Backup completed successfully.
16/05/2013 22:26:14.244 WindowServer: CGXRegisterWindowWithSystemStatusBar: window b already registered
16/05/2013 22:26:14.809 WindowServer: CGXRegisterWindowWithSystemStatusBar: window b already registered
[the previous line was then repeated many times]
16/05/2013 22:29:55.998 com.apple.usbmuxd: _heartbeat_failed heartbeat detected detach for device 0xab-192.168.1.64:0!
16/05/2013 22:37:36.000 kernel: en1: BSSID changed to 80:b6:86:db:af:0d
16/05/2013 22:37:36.000 kernel: en1::IO80211Interface::postMessage bssid changed
16/05/2013 22:37:36.000 kernel: AirPort: RSN handshake complete on en1
16/05/2013 22:39:52.589 WindowServer: CGXRegisterWindowWithSystemStatusBar: window b already registered
16/05/2013 22:39:53.765 WindowServer: CGXRegisterWindowWithSystemStatusBar: window b already registered
16/05/2013 22:39:54.171 WindowServer: CGXRegisterWindowWithSystemStatusBar: window b already registered
16/05/2013 22:41:19.647 com.apple.usbmuxd: _heartbeat_failed heartbeat detected detach for device 0xb2-192.168.1.64:0!
I have NO idea what it could be now. Safari and iTunes are the only things in common with all of the crashes as far as I am aware. It is even a brand new HD (that wasn't even restored from a back-up) from the first time it crashed around a year ago.
Unless it ran out of RAM? But surely it would just force quit something or take logical actions rather than just locking up?
uTorrent, Photoshop, QuickTime, iTunes, Mail and many Safari tabs were open -
Any software downloaded using a torrent client is likely to be illegitimate and is probably unsafe to use. It is anyone's guess what you downloaded and its resulting effects on your system.
It's your Mac, do with it as you please, but if it were mine I would completely erase it and rebuild the system from the ground up, given the uncertainty of having downloaded and installed illegitimate software.