Anyone else experiencing random restarts since updating to OS X 10.11.6?

Question

Level 1

100 points

Anyone else experiencing random restarts since updating to OS X 10.11.6?

Hi,

Ever since updating to OS X 10.11.6 I've been experiencing random restarts. I have not been able to pin the blame on any application or any piece of hardware. Safari is almost always running, since I usually start it when I login, but I'm not always working in it when the MacBook Pro 17" restarts.

The machine in question is a MacBook Pro 17" late 2011 model. I have an Akitio Thunder2 Duo RAID 1 drive connected to the MBP's Thunderbolt port, an Akitio Thunder2 Dock connected to the Thunder2 Duo, an Apple 27" Thunderbolt Display connected to the Thunder2 Dock's other Thunderbolt 2 port, and a LaCie 2big Quadra (RAID 1) connected to one of the Thunder2 Dock's eSATA ports.

In February 2016 the MBP was repaired under the so-called MacBook Pro Repair Extension Program for Video Issues. One qualifying video issue is random restarts, although my MBP experienced issues that were visible on the MBP's display and on the connected Apple 24" LED Cinema Display as well as random restarts, whereas up to now I see no video problems.

Is anybody else experiencing such random restarts? Does anybody have any idea what might be causing them?

Thanks

OS X El Capitan (10.11.6), 16 GB RAM, 2 TB SSD

Posted on Aug 26, 2016 4:25 PM

Reply

Answer 1

Jun 23, 2017 6:12 AM in response to Richard Liu

My Mac mini (late 2012) didn't start crashing until I upgraded to Sierra. El Capitan works great, no crashing. I wonder if it could be the Port Multiplier driver? I installed the charging drivers and it doesn't crash as much.

Reply

Answer 2

BobHarris

Level 9

57,035 points

Aug 26, 2016 5:45 PM in response to Richard Liu

Not really.

Do you have kernel panic files? If you do, please post a few of them as replies to this thread

Kernel Panic reports: "/Library/Logs/DiagnosticReports"

<http://support.apple.com/kb/ht2546>

<http://support.apple.com/en-us/HT200553>

The panic report should have "panic" in the file name.

If you remove all your external devices (USB, Thrunderbold, external displays, etc...), does this still happen?

You might want to also post the EtreCheck output for analysis

<https://discussions.apple.com/docs/DOC-6174> or <http://etrecheck.com>

Reply

Answer 3

Richard Liu Author

Level 1

100 points

Aug 26, 2016 7:37 PM in response to BobHarris

In /Library/Logs/DiagnosticReports I find no file with "panic" in the name. In fact, what I am experiencing is not like the usual panic, with the grey screen that rolls down informing me that the computer must restart, and when it does restart, I receive no message informing me that a kernel panic occurred, do I want to send a report to Apple? The computer just restarts the way it does when I turn it on.

Here is the EtreCheck:

EtreCheck version: 3.0.2 (306)

Report generated 2016-08-27 04:16:26

Download EtreCheck from https://etrecheck.com

Runtime 2:14

Performance: Excellent

Click the [Support] links for help with non-Apple products.

Click the [Details] links for more information about that line.

Problem: Computer is restarting

Description:

Same as previous report, but run from Admin account

Hardware Information:ⓘ

MacBook Pro Intel Core i7, 17" (Early 2011)

[Technical Specifications] - [User Guide] - [Warranty & Service]

MacBook Pro - model: MacBookPro8,3

1 2.4 GHz Intel Core i7 CPU: 4-core

16 GB RAM Upgradeable - [Instructions]

BANK 0/DIMM0

8 GB DDR3 1333 MHz ok

BANK 1/DIMM0

8 GB DDR3 1333 MHz ok

Bluetooth: Old - Handoff/Airdrop2 not supported

Wireless: en1: 802.11 a/b/g/n

Battery: Health = Normal - Cycle count = 26

Video Information:ⓘ

Intel HD Graphics 3000

AMD Radeon HD 6770M - VRAM: 1024 MB

Color LCD 1920 x 1200

Thunderbolt Display 2560 x 1440

System Software:ⓘ

OS X El Capitan 10.11.6 (15G31) - Time since boot: about 4 hours

Disk Information:ⓘ

Samsung SSD 850 EVO 2TB disk0 : (2 TB) (Solid State - TRIM: Yes)

EFI (disk0s1) <not mounted> : 210 MB

Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB

Macintosh HD (disk1) / : 2.00 TB (1.11 TB free)

Core Storage: disk0s2 2.00 TB Online

MATSHITADVD-R UJ-8A8 ()

eSATA-2 LaCie 2BigQuadra disk2 : (2 TB) (Rotational)

EFI (disk2s1) <not mounted> : 210 MB

MacBook Pro HD Clone (disk2s2) /Volumes/MacBook Pro HD Clone : 2.00 TB (1.12 TB free)

AKiTiO Safe disk3 : (4 TB) (Rotational)

EFI (disk3s1) <not mounted> : 210 MB

MacBook Pro Time Machine 2016-06-22 (disk3s2) /Volumes/MacBook Pro Time Machine 2016-06-22 : 4.00 TB (3.11 TB free)

USB Information:ⓘ

Apple Inc. FaceTime HD Camera (Built-in)

Apple Inc. BRCM2070 Hub

Apple Inc. Bluetooth USB Host Controller

Apple Inc. Apple Internal Keyboard / Trackpad

Apple Computer, Inc. IR Receiver

Apple Inc. Keyboard Hub

Apple Inc. Apple Keyboard

Apple Inc. FaceTime HD Camera (Display)

Apple Inc. Apple Thunderbolt Display

Apple Inc. Display Audio

Thunderbolt Information:ⓘ

Apple Inc. thunderbolt_bus

inXtron AKiTiO Thunder2 Duo Pro

inXtron AKiTiO Thunder 2 Dock

Apple Inc. Thunderbolt Display

Configuration files:ⓘ

/etc/sudoers, File size 1282 but expected 2299

Gatekeeper:ⓘ

Mac App Store and identified developers

Unknown Files:ⓘ

/Library/LaunchDaemons/com.micromat.techtoolpro9.BackgroundTool.plist

/Library/PrivilegedHelperTools/com.micromat.techtoolpro9.BackgroundTool

One unknown file found. [Check files]

Kernel Extensions:ⓘ

/Library/Application Support/Roxio

[not loaded] com.roxio.TDIXController (2.0 - 2015-09-06) [Support]

/Library/Extensions

[loaded] at.obdev.nke.LittleSnitch (3.6.4 - SDK 10.8 - 2016-08-02) [Support]

[not loaded] com.Akitio.ThunderDockChargingSupport (1.0 - SDK 10.9 - 2016-08-02) [Support]

[not loaded] org.cindori.TrimEnabler (1.0 - SDK 10.10 - 2016-08-02) [Support]

/System/Library/Extensions

[not loaded] com.elgato.driver.DontMatchAfaTech (1.1 - 2016-08-02) [Support]

[not loaded] com.elgato.driver.DontMatchCinergy450 (1.1 - 2016-08-02) [Support]

[not loaded] com.elgato.driver.DontMatchCinergyXS (1.1 - 2016-08-02) [Support]

[not loaded] com.elgato.driver.DontMatchEmpia (1.1 - 2016-08-02) [Support]

[not loaded] com.elgato.driver.DontMatchVoyager (1.1 - 2016-08-02) [Support]

[not loaded] com.firmtek.driver.FirmTek_SI_SATA_II (5.4.1 - 2016-08-02) [Support]

[not loaded] com.markspace.iokit.IOMissingSyncMassStorage (6.0.4 - 2016-08-02) [Support]

[not loaded] com.markspace.missingsync.palmos.classicseize (1.0.0 - 2016-08-02) [Support]

System Launch Agents:ⓘ

[not loaded] 8 Apple tasks

[loaded] 155 Apple tasks

[running] 75 Apple tasks

System Launch Daemons:ⓘ

[failed] com.apple.csrutil.report.plist (2015-08-26)

[not loaded] 43 Apple tasks

[loaded] 152 Apple tasks

[running] 94 Apple tasks

Launch Agents:ⓘ

[running] at.obdev.LittleSnitchUIAgent.plist (2016-07-21) [Support]

[not loaded] com.adobe.AAM.Updater-1.0.plist (2012-11-27) [Support]

[failed] com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a2 3d420d.plist (2016-07-12) [Support]

[running] com.bitdefender.antivirusformac.plist (2016-05-04) [Support]

[loaded] com.google.keystone.agent.plist (2016-07-12) [Support]

[not loaded] com.maintain.LogOut.plist (2016-07-05)

[not loaded] com.maintain.PurgeInactiveMemory.plist (2016-07-05)

[not loaded] com.maintain.Restart.plist (2016-07-05)

[not loaded] com.maintain.ShutDown.plist (2016-07-05)

[not loaded] com.maintain.Sleep.plist (2016-07-05)

[running] com.maintain.SystemEvents.plist (2016-07-05)

[running] com.micromat.TechToolProAgent.plist (2016-07-30) [Support]

[loaded] com.oracle.java.Java-Updater.plist (2014-12-05) [Support]

[loaded] org.macosforge.xquartz.startx.plist (2014-08-11) [Support]

Launch Daemons:ⓘ

[running] at.obdev.littlesnitchd.plist (2016-07-21) [Support]

[not loaded] com.actualtechnologies.odbcmanager.plist (2010-06-30) [Support]

[loaded] com.adobe.ARMDC.Communicator.plist (2016-07-12) [Support]

[loaded] com.adobe.ARMDC.SMJobBlessHelper.plist (2016-07-12) [Support]

[loaded] com.adobe.fpsaud.plist (2016-06-29) [Support]

[loaded] com.bitdefender.AuthHelperTool.plist (2016-05-04) [Support]

[not loaded] com.bitdefender.agent.plist [Support]

[loaded] com.bitdefender.upgrade.plist (2016-05-04) [Support]

[running] com.elgato.EyeConnect.plist (2014-02-11) [Support]

[loaded] com.google.keystone.daemon.plist (2016-07-12) [Support]

[loaded] com.maintain.CocktailScheduler.plist (2016-08-08)

[not loaded] com.maintain.HideSpotlightMenuBarIcon.plist (2016-07-05)

[running] com.micromat.TechToolProDaemon.plist (2016-07-30) [Support]

[running] com.micromat.techtoolpro9.BackgroundTool.plist (2016-08-05) [Support]

[loaded] com.microsoft.office.licensing.helper.plist (2010-08-25) [Support]

[loaded] com.omnigroup.OmniSoftwareUpdate.OSUInstallerPrivilegedHelper.6.plist (2015-12-02) [Support]

[loaded] com.omnigroup.OmniSoftwareUpdate.OSUInstallerPrivilegedHelper.plist (2014-10-29) [Support]

[loaded] com.oracle.java.Helper-Tool.plist (2014-12-05) [Support]

[loaded] com.skype.skypeinstaller.plist (2016-08-06) [Support]

[loaded] net.tunnelblick.tunnelblick.tunnelblickd.plist (2016-08-26) [Support]

[loaded] org.cindori.SenseiTool.plist (2015-07-26) [Support]

[loaded] org.cindori.TEAuth.plist (2015-07-25) [Support]

[loaded] org.macosforge.xquartz.privileged_startx.plist (2014-08-11) [Support]

[loaded] org.wireshark.ChmodBPF.plist (2015-09-15) [Support]

Internet Plug-ins:ⓘ

Google Earth Web Plug-in: 7.1 (2016-08-20) [Support]

Default Browser: 601 - SDK 10.11 (2016-07-22)

Flip4Mac WMV Plugin: 3.2.0.16 - SDK 10.8 (2014-04-11) [Support]

OfficeLiveBrowserPlugin: 12.2.8 (2010-12-10) [Support]

AdobePDFViewerNPAPI: 10.1.6 (2013-02-26) [Support]

FlashPlayer-10.6: 22.0.0.209 - SDK 10.9 (2016-07-20) [Support]

Silverlight: 5.1.50428.0 - SDK 10.6 (2016-06-30) [Support]

QuickTime Plugin: 7.7.3 (2016-07-22)

Flash Player: 22.0.0.209 - SDK 10.9 (2016-07-20) Cannot contact Adobe

iPhotoPhotocast: 7.0 - SDK 10.8 (2012-07-30)

PepperFlashPlayer: 22.0.0.209 - SDK 10.6 (2016-07-20) [Support]

AdobePDFViewer: 10.1.6 (2013-02-26) [Support]

CANONiMAGEGATEWAYDL: 3.1.0.2 (2009-09-09) [Support]

SharePointBrowserPlugin: 14.6.6 - SDK 10.6 (2016-07-29) [Support]

JavaAppletPlugin: Java 8 Update 101 build 13 (2016-07-23) Check version

3rd Party Preference Panes:ⓘ

Flash Player (2016-06-29) [Support]

Flip4Mac WMV (2013-03-29) [Support]

FUSE for OS X (OSXFUSE) (2015-06-14) [Support]

Java (2016-07-23) [Support]

TechTool Protection (2016-07-30) [Support]

Time Machine:ⓘ

Skip System Files: NO

Mobile backups: ON

Auto backup: YES

Volumes being backed up:

Macintosh HD: Disk size: 2.00 TB Disk used: 892.97 GB

Destinations:

MacBook Pro Time Machine 2016-06-22 [Local]

Total size: 4.00 TB

Total number of backups: 35

Oldest backup: 22/06/16 17:01

Last backup: 27/08/16 4:07

Size of backup disk: Adequate

Backup size 4.00 TB > (Disk used 892.97 GB X 3)

Top Processes by CPU:ⓘ

11% Little Snitch Agent(2)

9% WindowServer

3% kernel_task

1% fontd(2)

1% Little Snitch Network Monitor(2)

Top Processes by Memory:ⓘ

2.02 GB com.apple.WebKit.WebContent(21)

1.41 GB Safari

1.19 GB kernel_task

786 MB mds_stores

442 MB mdworker(26)

Virtual Memory Information:ⓘ

2.70 GB Free RAM

13.00 GB Used RAM (4.59 GB Cached)

0 B Swap Used

Diagnostics Information:ⓘ

Aug 27, 2016, 12:45:36 AM /Library/Logs/DiagnosticReports/backupd_2016-08-27-004536_[redacted].cpu_resour ce.diag [Details]

/System/Library/CoreServices/backupd.bundle/Contents/Resources/backupd

Aug 26, 2016, 11:58:48 PM Self test - passed

Aug 26, 2016, 01:39:55 PM /Library/Logs/DiagnosticReports/Safari_2016-08-26-133955_[redacted].cpu_resourc e.diag [Details]

/Applications/Safari.app/Contents/MacOS/Safari

Aug 25, 2016, 06:12:30 AM /Library/Logs/DiagnosticReports/com.apple.WebKit.WebContent_2016-08-25-061230_[ redacted].cpu_resource.diag [Details]

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.We bKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent

Thanks for your help.

Reply

Answer 4

BobHarris

Level 9

57,035 points

Aug 26, 2016 8:18 PM in response to Richard Liu

Well you might want to check if System Preferences -> Energy Saver -> Schedule is enabled to shutdown your Mac.

You can also check

Applications -> Utilities -> Terminal -> pmset -g

to see if any of the power management options have shutdowns scheduled.

You could look at the Applications -> Utilities -> Console -> system.log, and see if there are interesting messages around the time the shutdown happens. Maybe a message that says shutdown was initiated by xyz.

I would suggest you remove the following 3rd party additions as they are often the cause of undesirable behavior on Macs:

[running] com.bitdefender.antivirusformac.plist (2016-05-04) [Support]

[not loaded] com.maintain.LogOut.plist (2016-07-05)

[not loaded] com.maintain.PurgeInactiveMemory.plist (2016-07-05)

[not loaded] com.maintain.Restart.plist (2016-07-05)

[not loaded] com.maintain.ShutDown.plist (2016-07-05)

[not loaded] com.maintain.Sleep.plist (2016-07-05)

[running] com.maintain.SystemEvents.plist (2016-07-05)

[loaded] com.bitdefender.AuthHelperTool.plist (2016-05-04) [Support]

[not loaded] com.bitdefender.agent.plist [Support]

[loaded] com.bitdefender.upgrade.plist (2016-05-04) [Support]

Apps that clean your memory, fight OS X memory management.

Anti-virus apps are frequently causing more problems than actually protecting the Mac.

Since El Capitan allows you to enable TRIM with a Terminal command, I do not think you need TrimEnabler any more.

[not loaded] org.cindori.TrimEnabler (1.0 - SDK 10.10 - 2016-08-02) [Support]

Are you really still using MissingSync? That is to say, do you have a Palm device you are syncing?

[not loaded] com.markspace.iokit.IOMissingSyncMassStorage (6.0.4 - 2016-08-02) [Support]

[not loaded] com.markspace.missingsync.palmos.classicseize (1.0.0 - 2016-08-02) [Support]

Looking at the collection of 3rd party additions, I'm suspecting you have a lot of clutter you are not using any more.

I suggest you go though the EtreCheck output and remove anything you do no use anymore. EasyFind can be helpful in finding all parts of the things you decide to remove. <http://www.devontechnologies.com/products/freeware.html>

If you decide to keep any of the 3rd party additions, make sure you have the lastest El Capitan compatible version.

Reply

Answer 5

gaheba

Level 1

8 points

Aug 26, 2016 9:18 PM in response to Richard Liu

Yes, I have had this happen to me. I am running a 27" Mid 2011 2.7GHz iMac.

The first time it happened, about April this year I think, I had a crash report indicating a kernel panic. I have had many random restarts since, but never had another crash report generated, at least not in the user logs.

Just before last Christmas, my internal drive failed, so that was replaced. It ran fine.

I also added another 16gig OWC ram to the original 8gig, giving 24gig, roughly the same time as the hard drive was replaced. I had no issues with either of these hardware changes on Yosemite 10.10.5 and I had never known the mac to restart itself. It was after installing 10.11.4 that I first noticed my mac restarting itself.

I am currently in the process of a clean install with a fresh download of 10.11.6. About to start reinstalling all my software (audio software).

Gary.

Reply

Answer 6

Richard Liu Author

Level 1

100 points

Sep 3, 2016 12:15 PM in response to BobHarris

Bob,

Thanks for your suggestions. I apologize for the delay in following them up. In the meantime, I have taken the MBP to the Apple Store here in Basel to have them check the hardware. I wanted to be able to discount a recurrence of the video issues for which the motherboard was already exchanged once. The machines did indeed pass all hardware tests. So now I can concentrate on the software.

I did contact both Maintain (for Cocktail) and Bitdefender (Antivirus for Mac), explaining that I wished to look at their products' logs to see whether I could find any suspicious activity. Bitdefender told me where to find the logs, but added that its program was not authorized to perform a restart, it can only prompt the user to do so. Maintain sent me an app to delete all of Cocktail's preferences and recommended that I run it, uninstall Cocktail and download and install the latest version. Maintain did not state that Cocktail could even cause random restarts, let alone take the blame for them, nor was I told where to find the logs. When I asked whether the instructions were a tacit admission of culpability, I received an answer to the question about the logs. I was still waiting for an answer to the question, whether Cocktail could be causing the random restarts when one occurred. So I have deleted Cocktail and its preferences and have not reinstalled it.

I have also removed Trim Enabler and Markspace Missing Sync. You are right. Snow Leopard was probably the last version of OS X and I installed clean and then reinstalled all applications. For all succeeding major versions of OS X I have reformatted a new internal hard disk or SSD, made a clean installation of OS X, then migrated the user accounts, and therewith also the applications.

I have also unset the System Preference to sleep attached hard disks in response to another problem that I am having (spinning beachball when I first right-click in the Finder after logging in). I will wait and see whether the measures that I have taken have any effect on the random restarts before doing anything else.

As an aside: In iPhoto (not Photos!) I have been experiencing random crashes since about the same time as the random restarts. The two phenomena might have the same cause, but the MBP has restarted even when iPhoto was not running, but also when it was.

Reply

Answer 7

BobHarris

Level 9

57,035 points

Sep 3, 2016 3:04 PM in response to Richard Liu

Bitdefender (Antivirus for Mac),

Most of us that try to help in the forums, do not recommend any Anti-virus. Please read:

How does Mac OS X protect me?

<http://www.thesafemac.com/mmg-builtin/>

I have also removed Trim Enabler

El Capitan includes the 'trimforce' command you can issue from an Applications -> Utilities -> Terminal session

<http://osxdaily.com/2015/10/29/use-trimforce-trim-ssd-mac-os-x/>

<http://www.macrumors.com/2015/06/12/os-x-el-capitan-trim-support/>

As an aside: In iPhoto (not Photos!) I have been experiencing random crashes since about the same time as the random restarts. The two phenomena might have the same cause, but the MBP has restarted even when iPhoto was not running, but also when it was.

If iPhoto crashes frequently enough to be sure it will happen the next time you use it, then try booting into "Safe" mode, and play with iPhoto until it either crashes again or you are sure it is not going to crash.

<http://support.apple.com/kb/ht1564>

This is an experiment, as Safe mode will not load all your 3rd party additions. If it runs without crashing, that is a strong indication that one of your 3rd party additions is causing the problem. If it runs without crashing, and you are sure it would have by now, then that would tend to clear the 3rd party additions.

I'm going to guess that when you added the SSD, you also added more RAM. Crashes can also be caused by flaky RAM or an SSD that is not behaving correctly (I'm not seriously considering the SSD, but you still have to consider all changes; NOTE: I've put a 1TB Samsung 840 SSD and Crucial.com RAM in my Macbook Pro, so I'm not against these kinds of upgrades).

It would not hurt to run Rember against your RAM (quitting as may apps and other memory consuming things as you can so Rember has the maximum amount of free memory to test)

<http://www.kelleycomputing.net/rember/>

Set Loops: [X] Maximum

and run overnight

Reply

Answer 8

Eric Root

Level 10

685,293 points

Sep 3, 2016 4:30 PM in response to Richard Liu

Startup – Computer restarts by itself – Yosemite

Reply

Answer 9

Richard Liu Author

Level 1

100 points

Sep 3, 2016 8:04 PM in response to BobHarris

Bob,

Thanks for the advice.

The decision to install an antivirus program was not taken lightly, I assure you. I sometimes work as an IT contractor/consultant. I prefer to use my own laptop whenever possible, but employers understandably will not allow me to connect it to their intranet if I do not use some kind of virus protection.

The SSD is a Samsung SSD 850 EVO 2 TB and 2 x 8 GB of Kingston RAM. The SSD has been in the machine for just over one year; the 16 GB RAM, for a bit over four years. I have no reason to suspect them. They have passed Tech Tool Pro 9's tests as well as the tests that the Apple Store in Basel performed last week. Yes, nevertheless, perhaps ... but then I would have expected a classic kernel panic.

Regarding iPhoto crashes: I do have 58,169 photos (iPhoto Library is about 556 GB), but the library has grown steadily since OS X Tiger, whereas the crashes are recent (since about OS X 10.11.6). I did use the machine for two weeks while I was visiting relatives in Los Angeles, and had neither random startups nor iPhoto crashes. But then, only a 2 TB LaCie Rugged Thunderbolt drive was attached, not the usual Akitio Thunder 2 Duo (4 TB RAID 1 for Time Machine), LaCie 2big (2 TB RAID 1 for cloning boot disk) connected via eSATA and Apple 27" Thunderbolt Cinema Display connected by Thunderbolt to an Akitio Thunder 2 Dock. So it is difficult to say how long iPhoto should run without crashing before I conclude that it isn't going to.

Reply

Answer 10

BobHarris

Level 9

57,035 points

Sep 3, 2016 8:23 PM in response to Richard Liu

The decision to install an antivirus program was not taken lightly, I assure you. I sometimes work as an IT contractor/consultant. I prefer to use my own laptop whenever possible, but employers understandably will not allow me to connect it to their intranet if I do not use some kind of virus protection.

Anti-virus programs are "The" #1 cause of software induced kernel panics we see in these forums.

You need to eliminate your Anti-virus package as the cause of your panics.

but then I would have expected a classic kernel panic

You are saying you are not getting panics?

Kernel Panic reports: Finder -> Go -> Go to Folder -> /Library/Logs/DiagnosticReports

<http://support.apple.com/kb/ht2546>

<http://support.apple.com/en-us/HT200553>

The panic report should have "panic" in the file name.

If that is the case, you should be looking at your Applications -> Utilities > Console logs (system.log, system.log.0.gz, system.log.1.gz, etc...) to see if a reason for rebooting is in the logs. I have no idea what to look for, but hopefully something is identified. The logs do contain timestamps so you should be able to identify the area of the logs where useful messages exist?

Reply

Answer 11

Richard Liu Author

Level 1

100 points

Sep 4, 2016 7:43 AM in response to BobHarris

Bob,

It probably escaped your notice in the remarks that prefaced the EtreCheck: I do not find any panic logs. The "random restarts" that I experience do not seem to be kernel panics. The screen does not gradually go grey before displaying a message that the Mac needs to restart, and after the restart I do not receive the dialog about sending the log to Apple. It's almost as if I had initiated the restart.

Yes, I realize that, in the process of eliminating possible causes, I will need to experimentally disable a lot of things one by one. The difficulty is, how long should I let an experiment run before I conclude that I have found the cause of the restarts? Right now, the machine is running without Cocktail.

Reply

Answer 12

John Galt

Level 10

156,296 points

Sep 4, 2016 8:12 AM in response to Richard Liu

BobHarris's comments remain relevant. That Mac is extensively modified with worthless garbage, the presence of which will only complicate troubleshooting. Certain such utilities can delete log files including kernel panic logs. I am not alleging that's the reason you cannot find any such logs; it is simply a general observation.

... employers understandably will not allow me to connect it to their intranet if I do not use some kind of virus protection.

OS X already includes robust protections against viruses and malware, whereas a Mac modified with non-Apple "anti-virus" garbage will not work properly and will increase its exposure to various threats. A Mac so modified should not be used at all, let alone on a corporate network. Therefore your employers' requests are not "understandable" at all. They are the products of ignorance and prejudice.

Read below to determine the cause for the shutdowns.

Wait until the Mac shuts down unexpectedly, then examine your system.log file to identify the numeric code associated with the shutdown. Read below.

Find the Console app - it is in your Utilities folder and looks like this

You can find it by selecting Utilities from the Finder's Go menu.

Open Console.

If the log list column on the left is not already displayed, show the log list by selecting Show Log List from Console's View menu.

Locate system.log in the list and select it. Many date and time-stamped entries will appear, hundreds of them, and you must find the entries relevant to your Mac's problem.

To do that type the words shutdown cause in the Filter field at the upper right of the Console window.

That will cause all log entries to be hidden, except for the entries containing those words. There will be a numeric code associated with the log entry starting with "Previous shutdown cause". What is that code?

Reply

Answer 13

Richard Liu Author

Level 1

100 points

Sep 4, 2016 9:17 AM in response to John Galt

John,

I thank you for the instructions for determining the cause of the restarts. "Unfortunately," since removing Cocktail I have not experienced any.

Yes, third-party apps does complicate not only troubleshooting, but also software design and testing. We can exchange views on the use of "worthless garbage" in a more appropriate thread.

Reply

Answer 14

John Galt

Level 10

156,296 points

Sep 4, 2016 9:39 AM in response to Richard Liu

Like all worthless "maintenance" utilities, "Cocktail" is very likely to have contributed to the problems you've been experiencing.

Reply

Answer 15

Richard Liu Author

Level 1

100 points

Sep 16, 2016 2:31 PM in response to John Galt

Well, I don't wish to debate whether Cocktail contributed to the problem or not, but the problem has recurred without Cocktail being installed. It occurred twice recently. Both times one of the two LaCie disks was running. Both are connected to the eSATA ports of an AKiTiO Thunder2 Dock, which is then connected as follows to the MacBook Pro:

An AKiTiO Thunder2 Duo configured for RAID 1 is connected directly to the MBP, the Thunder2 Dock is connected to the Thunder2 Duo, and so is an Apple Thunderbolt 27" Display. SuperDuper! was just finishing backing up the boot disk to a LaCie 2big Quadra (configured RAID 1, connected via eSATA to the Thunder2 Dock) when the whole UI became unresponsive. I was watching cable TV using EyeTV Hybrid (a USB gizmo that connects the MBP to the cable TV output) when EyeTV lost contact to the station to which I was tuned. That's when I noticed that the UI had also become unresponsive. The machine did nothing for what seemed like ages before finally rebooting. No kernel panic, no offer to send a panic log to Apple.

As you suggested, I examined the system.log and ran EtreCheck. Here is the EtreCheck. In the Description I describe what I found in the system.log.

EtreCheck version: 3.0.3 (307)

Report generated 2016-09-16 22:59:41

Download EtreCheck from https://etrecheck.com

Runtime 2:18

Performance: Excellent

Click the [Support] links for help with non-Apple products.

Click the [Details] links for more information about that line.

Problem: Computer is restarting

Description:

Random shutdowns not so random. The last two times they occurred, one of the LaCie drives (connected via eSATA to AKiTiO Thunder2 Dock) has been running. In the system.log I see:

Sep 16 21:54:43 localhost locationd[92]: locationd was started after an unclean shutdown

…

Sep 16 21:54:45 RRL-MacBookPro kernel[0]: Previous shutdown cause: -128

Here’s what happens just prior to rebooting:

Sep 16 21:52:31 RRL-MacBookPro kernel[0]: Sandbox: coresymbolicatio(6972) System Policy: deny(1) file-write-data /System/Library/Caches/com.apple.coresymbolicationd/data

Sep 16 21:52:31 RRL-MacBookPro coresymbolicationd[6972]: Attempt to create [/System/Library/Caches/com.apple.coresymbolicationd/data] failed. Operation not permitted

Sep 16 21:52:31 RRL-MacBookPro coresymbolicationd[6972]: Unable to open storage at /System/Library/Caches/com.apple.coresymbolicationd/data

Sep 16 21:52:31 RRL-MacBookPro com.apple.xpc.launchd[1] (com.apple.coresymbolicationd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.

Sep 16 21:52:34 RRL-MacBookPro kernel[0]: FireWire GUID 0000000000000000 is invalid!

Sep 16 21:52:41 --- last message repeated 1 time ---

Sep 16 21:52:41 RRL-MacBookPro kernel[0]: Sandbox: coresymbolicatio(6983) System Policy: deny(1) file-write-data /System/Library/Caches/com.apple.coresymbolicationd/data

Sep 16 21:52:41 RRL-MacBookPro coresymbolicationd[6983]: /System/Library/Caches/com.apple.coresymbolicationd/data did not validate, resetting cache

Sep 16 21:52:41 RRL-MacBookPro kernel[0]: Sandbox: coresymbolicatio(6983) System Policy: deny(1) file-write-unlink /System/Library/Caches/com.apple.coresymbolicationd/data

Sep 16 21:52:41 RRL-MacBookPro kernel[0]: Sandbox: coresymbolicatio(6983) System Policy: deny(1) file-write-data /System/Library/Caches/com.apple.coresymbolicationd/data

Sep 16 21:52:41 RRL-MacBookPro coresymbolicationd[6983]: Attempt to create [/System/Library/Caches/com.apple.coresymbolicationd/data] failed. Operation not permitted

Sep 16 21:52:41 RRL-MacBookPro coresymbolicationd[6983]: Unable to open storage at /System/Library/Caches/com.apple.coresymbolicationd/data

Sep 16 21:52:41 RRL-MacBookPro com.apple.xpc.launchd[1] (com.apple.coresymbolicationd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.

Sep 16 21:54:37 localhost bootlog[0]: BOOT_TIME 1474055677 0

I see that sequence repeated at roughly 10 sec. intervals preceding the final repeat that seems to end in a reboot. During that time no interaction with the UI was possible, if memory serves me correctly.

Hardware Information:ⓘ

MacBook Pro (17-inch, Late 2011)

[Technical Specifications] - [User Guide] - [Warranty & Service]

MacBook Pro - model: MacBookPro8,3

1 2.4 GHz Intel Core i7 CPU: 4-core

16 GB RAM Upgradeable - [Instructions]

BANK 0/DIMM0

8 GB DDR3 1333 MHz ok

BANK 1/DIMM0

8 GB DDR3 1333 MHz ok

Bluetooth: Old - Handoff/Airdrop2 not supported

Wireless: en1: 802.11 a/b/g/n

Battery: Health = Normal - Cycle count = 27

Video Information:ⓘ

Intel HD Graphics 3000

AMD Radeon HD 6770M - VRAM: 1024 MB

Color LCD 1920 x 1200

Thunderbolt Display 2560 x 1440

System Software:ⓘ

OS X El Capitan 10.11.6 (15G1004) - Time since boot: about one hour

Disk Information:ⓘ

Samsung SSD 850 EVO 2TB disk0 : (2 TB) (Solid State - TRIM: Yes)

EFI (disk0s1) <not mounted> : 210 MB

Recovery HD (disk0s3) <not mounted> [Recovery]: 650 MB

Macintosh HD (disk1) / : 2.00 TB (1.09 TB free)

Core Storage: disk0s2 2.00 TB Online

MATSHITADVD-R UJ-8A8 ()

eSATA-2 LaCie 2BigQuadra disk2 : (2 TB) (Rotational)

EFI (disk2s1) <not mounted> : 210 MB

MacBook Pro HD Clone (disk2s2) /Volumes/MacBook Pro HD Clone : 2.00 TB (1.10 TB free)

AKiTiO Safe disk3 : (4 TB) (Rotational)

EFI (disk3s1) <not mounted> : 210 MB

MacBook Pro Time Machine 2016-06-22 (disk3s2) /Volumes/MacBook Pro Time Machine 2016-06-22 : 4.00 TB (3.06 TB free)

USB Information:ⓘ

Apple Inc. FaceTime HD Camera (Built-in)

Apple Inc. BRCM2070 Hub

Apple Inc. Bluetooth USB Host Controller

Apple Inc. Apple Internal Keyboard / Trackpad

Elgato EyeTV Hybrid

Apple Computer, Inc. IR Receiver

Apple Inc. Keyboard Hub

Apple Inc. Apple Keyboard

Apple Inc. FaceTime HD Camera (Display)

Apple Inc. Apple Thunderbolt Display

Apple Inc. Display Audio

Thunderbolt Information:ⓘ

Apple Inc. thunderbolt_bus

inXtron AKiTiO Thunder2 Duo Pro

inXtron AKiTiO Thunder 2 Dock

Apple Inc. Thunderbolt Display

Configuration files:ⓘ

/etc/sudoers, File size 1282 but expected 2299

Gatekeeper:ⓘ

Mac App Store and identified developers

Unknown Files:ⓘ

/Library/LaunchDaemons/com.micromat.techtoolpro9.BackgroundTool.plist

/Library/PrivilegedHelperTools/com.micromat.techtoolpro9.BackgroundTool

One unknown file found. [Check files]

Kernel Extensions:ⓘ

/Library/Application Support/Roxio

[not loaded] com.roxio.TDIXController (2.0 - 2015-09-06) [Support]

/Library/Extensions

[loaded] at.obdev.nke.LittleSnitch (3.7 - SDK 10.11 - 2016-09-15) [Support]

[not loaded] com.Akitio.ThunderDockChargingSupport (1.0 - SDK 10.9 - 2016-09-15) [Support]

[not loaded] org.cindori.TrimEnabler (1.0 - SDK 10.10 - 2016-09-15) [Support]

/System/Library/Extensions

[not loaded] com.elgato.driver.DontMatchAfaTech (1.1 - 2016-09-15) [Support]

[not loaded] com.elgato.driver.DontMatchCinergy450 (1.1 - 2016-09-15) [Support]

[not loaded] com.elgato.driver.DontMatchCinergyXS (1.1 - 2016-09-15) [Support]

[not loaded] com.elgato.driver.DontMatchEmpia (1.1 - 2016-09-15) [Support]

[not loaded] com.elgato.driver.DontMatchVoyager (1.1 - 2016-09-15) [Support]

System Launch Agents:ⓘ

[not loaded] 8 Apple tasks

[loaded] 159 Apple tasks

[running] 71 Apple tasks

System Launch Daemons:ⓘ

[not loaded] 43 Apple tasks

[loaded] 157 Apple tasks

[running] 90 Apple tasks

Launch Agents:ⓘ

[running] at.obdev.LittleSnitchUIAgent.plist (2016-09-15) [Support]

[not loaded] com.adobe.AAM.Updater-1.0.plist (2012-11-27) [Support]

[failed] com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a2 3d420d.plist (2016-07-12) [Support]

[running] com.bitdefender.antivirusformac.plist (2016-05-04) [Support]

[loaded] com.google.keystone.agent.plist (2016-07-12) [Support]

[running] com.micromat.TechToolProAgent.plist (2016-07-30) [Support]

[loaded] com.oracle.java.Java-Updater.plist (2014-12-05) [Support]

[loaded] org.macosforge.xquartz.startx.plist (2014-08-11) [Support]

Launch Daemons:ⓘ

[running] at.obdev.littlesnitchd.plist (2016-09-15) [Support]

[not loaded] com.actualtechnologies.odbcmanager.plist (2010-06-30) [Support]

[loaded] com.adobe.ARMDC.Communicator.plist (2016-07-12) [Support]

[loaded] com.adobe.ARMDC.SMJobBlessHelper.plist (2016-07-12) [Support]

[loaded] com.adobe.fpsaud.plist (2016-06-29) [Support]

[loaded] com.bitdefender.AuthHelperTool.plist (2016-05-04) [Support]

[not loaded] com.bitdefender.agent.plist [Support]

[loaded] com.bitdefender.upgrade.plist (2016-05-04) [Support]

[running] com.elgato.EyeConnect.plist (2014-02-11) [Support]

[loaded] com.google.keystone.daemon.plist (2016-09-02) [Support]