Restarting after logging in the first time

Turn off FileVault if it is turned on.

These instructions must be carried out as an administrator. If you have only one user account, you are the administrator.

Launch the Console application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad and start typing the name.

Step 1

For this step, the title of the Console window should be All Messages. If it isn't, select

SYSTEM LOG QUERIES ▹ All Messages

from the log list on the left. If you don't see that list, select

View ▹ Show Log List

from the menu bar at the top of the screen.

In the top right corner of the Console window, there's a search box labeled Filter. Enter "BOOT_TIME" (without the quotes.)

Each message in the log begins with the date and time when it was entered. Select the BOOT_TIME log message that corresponds to the last boot time when you had the problem. Now clear the search box to reveal all messages. Select the ones logged before the boot, during the time something abnormal was happening. Copy them to the Clipboard by pressing the key combination command-C. Paste into a reply to this message by pressing command-V.

For example, if the system was unresponsive or was failing to shut down for three minutes before you forced a restart, post the messages timestamped within three minutes before the boot time, not after. Please include the BOOT_TIME message at the end of the log extract—not at the beginning.

If there are long runs of repeated messages, please post only one example of each. Don’t post many repetitions of the same message.

When posting a log extract, be selective. A few dozen lines are almost always more than enough.

Some private information, such as your name, may appear in the log. Anonymize before posting.

Please don't indiscriminately dump thousands of lines from the log into this discussion.

Please don't post screenshots of log messages—post the text.

Step 2

In the Console window, select

DIAGNOSTIC AND USAGE INFORMATION ▹ System Diagnostic Reports

(not Diagnostic and Usage Messages) from the log list on the left. If you don't see that list, select

View ▹ Show Log List

from the menu bar.

There is a disclosure triangle to the left of the list item. If the triangle is pointing to the right, click it so that it points down. You'll see a list of reports. A crash report has a name that begins with the name of the crashed process and ends in ".crash". A panic report has a name that begins with "Kernel" and ends in ".panic". A shutdown stall report has a name that ends in ".shutdownstall". Select the most recent of each, if any. The contents of the report will appear on the right. Use copy and paste to post the entire contents—the text, not a screenshot. It's possible that none of these reports exists.

I know the report is long, maybe several hundred lines. Please post all of it anyway.

If you don't see any reports listed, but you know there was a crash or panic, you may have chosen Diagnostic and Usage Messages from the log list. Choose DIAGNOSTIC AND USAGE INFORMATION instead.

In the interest of privacy, I suggest that, before posting, you edit out the “Anonymous UUID,” a long string of letters, numbers, and dashes in the header of the report, if it’s present (it may not be.)

Please don’t post other kinds of diagnostic report—they're very long and rarely helpful.

When you post the log extract or the crash report, you might see an error message on the web page: "You have included content in your post that is not permitted," or "The message contains invalid characters." That's a bug in the forum software. Please post the text on Pastebin, then post a link here to the page you created.