Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

New Mac Pro somehow reverted to earlier state! Time Machine Off!

T

tengo84

macrumors newbie
Original poster
Aug 2, 2010
26
0
Chicago
Hello friends,

I have a new Mac Pro running 10.6.4 (see sig for details). I left it idle a half-day while tending to some errands. Nothing major was running, just a few browser windows and a basic Apple screen saver. When I returned, the system was hung with a blue screen and spinning dial. I waited a while, gave up, and turned it off with power button. Turned back on, loaded up in a snap, and everything seemed OK.

When I opened Apple Mail, I noticed messages previously read and/or deleted were marked unread. When I restored my browser session (Firefox), it loaded tabs I had already closed hours earlier. And when I opened a TextEdit doc I use to type notes, it loaded a previous version even though I knew with certainty I had saved newer versions. It was like my computer had gone back in time 8 hrs. :confused:

It's not related to Time Machine, I have it turned off until I receive my new backup drive. Also, it's not due to Apple's software updates or the recent firmware update, which had already been installed.

I run my system and apps from the OWC SSD. Hard disks are set never to turn off. RAM is a mix of 3rd party and Apple. No other problems or issues I'm aware of.

Any thoughts?
 
Wirelessly posted (Mozilla/5.0 (iPod; U; CPU iPhone OS 4_1 like Mac OS X; en-us) AppleWebKit/532.9 (KHTML, like Gecko) Version/4.0.5 Mobile/8B117 Safari/6531.22.7)

It sounds like journaling may have returned your files to a previous state.

In any event, I would immediately run DiskWarrior on the disk to reconstruct the directory.
 
Run 'Console' (in /Applications/Utilities) and select "All Messages" in the left pane. Scroll the right pane to the approximate time you think the fault happened and see if there are any error messages. Some of the log may look like gibberish if you have never used this app. Post it up here and we can take a look if you see something suspicious.
 
Thanks for the suggestion. I copied the log and replaced personal info with "xxxx". For some reason the time stamps at the beginning are out of order, as they appeared in the log. I added bold print to one line. "Mercury" is my boot drive, "Maverick" is backup/media. Thanks for your help.

11/3/10 6:50:15 AM kernel npvhash=4095
11/2/10 2:02:51 PM [0x0-0x2ff2ff].org.videolan.vlc[6850] [flv @ 0x102072210] Estimating duration from bitrate, this may be inaccurate
11/3/10 6:50:15 AM kernel Darwin Kernel Version 10.4.2: Tue Jul 27 21:17:17 PDT 2010; root:xnu-1504.7.60~1/RELEASE_X86_64
11/3/10 6:50:15 AM kernel vm_page_bootstrap: 2483128 free pages and 138312 wired pages
11/3/10 6:50:15 AM kernel kext submap [0xffffff7f80600000 - 0xffffff8000000000], kernel text [0xffffff8000200000 - 0xffffff8000600000]
11/3/10 6:50:15 AM kernel standard timeslicing quantum is 10000 us
11/3/10 6:50:15 AM kernel mig_table_max_displ = 73
11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=0 LocalApicId=0 Enabled
11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=1 LocalApicId=2 Enabled
11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=2 LocalApicId=4 Enabled
11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=3 LocalApicId=6 Enabled
11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=4 LocalApicId=1 Enabled
11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=5 LocalApicId=3 Enabled
11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=6 LocalApicId=5 Enabled
11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=7 LocalApicId=7 Enabled
11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=8 LocalApicId=0 Disabled
11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=9 LocalApicId=0 Disabled
11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=10 LocalApicId=0 Disabled
11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=11 LocalApicId=0 Disabled
11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=12 LocalApicId=0 Disabled
11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=13 LocalApicId=0 Disabled
11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=14 LocalApicId=0 Disabled
11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=15 LocalApicId=0 Disabled
11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=16 LocalApicId=0 Disabled
11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=17 LocalApicId=0 Disabled
11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=18 LocalApicId=0 Disabled
11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=19 LocalApicId=0 Disabled
11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=20 LocalApicId=0 Disabled
11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=21 LocalApicId=0 Disabled
11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=22 LocalApicId=0 Disabled
11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=23 LocalApicId=0 Disabled
11/3/10 6:50:15 AM kernel calling mpo_policy_init for TMSafetyNet
11/3/10 6:50:15 AM kernel Security policy loaded: Safety net for Time Machine (TMSafetyNet)
11/3/10 6:50:15 AM kernel calling mpo_policy_init for Quarantine
11/3/10 6:50:15 AM kernel Security policy loaded: Quarantine policy (Quarantine)
11/3/10 6:50:15 AM kernel calling mpo_policy_init for Sandbox
11/3/10 6:50:15 AM kernel Security policy loaded: Seatbelt sandbox policy (Sandbox)
11/3/10 6:50:15 AM kernel Copyright (c) 1982, 1986, 1989, 1991, 1993
11/3/10 6:50:15 AM kernel The Regents of the University of California. All rights reserved.
11/3/10 6:50:15 AM kernel MAC Framework successfully initialized
11/3/10 6:50:15 AM kernel using 16384 buffer headers and 4096 cluster IO buffer headers
11/3/10 6:50:15 AM kernel IOAPIC: Version 0x20 Vectors 64:87
11/3/10 6:50:15 AM kernel ACPI: System State [S0 S3 S4 S5] (S3)
11/3/10 6:50:15 AM kernel AppleIntelCPUPowerManagement: Turbo Ratios 1112
11/3/10 6:50:15 AM kernel AppleIntelCPUPowerManagement: initialization complete
11/3/10 6:50:15 AM kernel mbinit: done (96 MB memory set for mbuf pool)
11/3/10 6:50:15 AM kernel rooting via boot-uuid from /chosen: C0F4FD8A-D7EA-3780-ADED-3004941BEF56
11/3/10 6:50:15 AM kernel Waiting on <dict ID="0"><key>IOProviderClass</key><string ID="1">IOResources</string><key>IOResourceMatch</key><string ID="2">boot-uuid-media</string></dict>
11/3/10 6:50:15 AM kernel com.apple.AppleFSCompressionTypeZlib kmod start
11/3/10 6:50:15 AM kernel com.apple.AppleFSCompressionTypeZlib load succeeded
11/3/10 6:50:15 AM kernel AppleIntelCPUPowerManagementClient: ready
11/3/10 6:50:15 AM kernel Intel82574L::start - Built Jul 27 2010 21:31:39 -- running on device at b10d0f0
11/3/10 6:50:15 AM kernel Intel82574L::start - Built Jul 27 2010 21:31:39 -- running on device at b9d0f0
11/3/10 6:50:15 AM kernel Got boot device = IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/SATA@1F,2/AppleAHCI/PRT1@1/IOAHCIDevice@0/AppleAHCIDiskDriver/IOAHCIBlockStorageDevice/IOBlockStorageDriver/OWC Mercury Extreme Pro SSD Media/IOGUIDPartitionScheme/Mercury@2
11/3/10 6:50:15 AM kernel BSD root: disk0s2, major 14, minor 2
11/3/10 6:50:15 AM kernel jnl: unknown-dev: replay_journal: from: 175104 to: 2759680 (joffset 0x37e000)
11/3/10 6:50:15 AM kernel wl0: Broadcom BCM432b 802.11 Wireless Controller
11/3/10 6:50:15 AM kernel 5.10.91.27
11/3/10 6:50:15 AM kernel jnl: unknown-dev: journal replay done.
11/3/10 6:50:15 AM kernel FireWire (OHCI) TI ID 823f built-in now active, GUID 78ca39fffe05c53c; max speed s800.
11/3/10 6:50:15 AM kernel Kernel is LP64
11/3/10 6:50:15 AM kernel hfs: Removed 7 orphaned / unlinked files and 0 directories
11/3/10 6:50:14 AM com.apple.launchd[1] *** launchd[1] has started up. ***
11/3/10 6:50:15 AM DirectoryService[15] Improper shutdown detected
11/3/10 6:50:15 AM blued[17] Apple Bluetooth daemon started
11/3/10 6:50:16 AM kernel Intel82574L: Ethernet address e8:06:88:cb:86:92
11/3/10 6:50:16 AM kernel Intel82574L: Ethernet address e8:06:88:cb:68:d2
11/3/10 6:50:16 AM kernel AirPort_Brcm43xx: Ethernet address 00:26:08:fd:93:c8
11/3/10 6:50:16 AM kernel IO80211Controller::dataLinkLayerAttachComplete(): adding AppleEFINVRAM notification
11/3/10 6:50:16 AM kernel systemShutdown false
11/3/10 6:50:16 AM com.apple.SecurityServer[23] Session 0x5fbff962 created
11/3/10 6:50:16 AM com.apple.SecurityServer[23] Entering service
11/3/10 6:50:16 AM kernel AirPort: Link Down on en2. Reason 8 (Disassociated because station leaving).
11/3/10 6:50:16 AM com.apple.kextd[10] Can't load /System/Library/Extensions/IOSerialFamily.kext/Contents/PlugIns/InternalModemSupport.kext - no code for running kernel's architecture.
11/3/10 6:50:16 AM com.apple.kextd[10] Failed to load /System/Library/Extensions/IOSerialFamily.kext/Contents/PlugIns/InternalModemSupport.kext - (libkern/kext) requested architecture/executable not found.
11/3/10 6:50:16 AM com.apple.kextd[10] Load com.apple.driver.InternalModemSupport failed; removing personalities.
11/3/10 6:50:17 AM kernel Previous Shutdown Cause: 3
11/3/10 6:50:17 AM kernel DSMOS has arrived
11/3/10 6:50:17 AM kernel AppleTyMCEDriver::start coreVIDPID = 0xffffffff Number of packages = 1 Number of cpus = 8 memory monitor trough MCA
11/3/10 6:50:17 AM kernel ** Device in slot: SLOT-1 **
11/3/10 6:50:17 AM configd[13] bootp_session_transmit: bpf_write(en2) failed: Network is down (50)
11/3/10 6:50:17 AM configd[13] DHCP en2: INIT transmit failed
11/3/10 6:50:17 AM configd[13] setting hostname to "xxxxxxxxxxx-Mac-Pro.local"
11/3/10 6:50:17 AM configd[13] network configuration changed.
11/3/10 6:50:18 AM kernel jnl: disk2s2: replay_journal: from: 46416896 to: 47205888 (joffset 0x1d1c000)
11/3/10 6:50:18 AM kernel jnl: disk2s2: journal replay done.
11/3/10 6:50:18 AM kernel Ethernet [Intel82574L]: Link up on en0, 100-Megabit, Full-duplex, No flow-control, Debug [796d,6c08,0de1,0200,41e1,4000]
11/3/10 6:50:19 AM bootlog[55] BOOT_TIME: 1288785014 0
11/3/10 6:50:20 AM fseventsd[48] event logs in /Volumes/Maverick/.fseventsd out of sync with volume. destroying old logs. (432803 2 456305)
11/3/10 6:50:20 AM mDNSResponder[43] mDNSResponder mDNSResponder-214.3.2 (Apr 12 2010 19:33:48) starting
11/3/10 6:50:20 AM com.apple.usbmuxd[37] usbmuxd-201 built for iTunesTen on Aug 12 2010 at 17:33:03, running 64 bit
11/3/10 6:50:20 AM /System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow[44] Login Window Application Started
11/3/10 6:50:20 AM fseventsd[48] log dir: /Volumes/Maverick/.fseventsd getting new uuid: D33AC983-0290-44A2-9D63-F4684DB1C527
11/3/10 6:50:20 AM configd[13] network configuration changed.
11/3/10 6:50:20 AM configd[13] network configuration changed.
11/3/10 6:50:20 AM fseventsd[48] event logs in /.fseventsd out of sync with volume. destroying old logs. (402289 6 456305)
11/3/10 6:50:20 AM fseventsd[48] log dir: /.fseventsd getting new uuid: E6ABE089-E709-4AF4-8375-2C39DF8289C6
11/3/10 6:50:21 AM configd[13] network configuration changed.
11/3/10 6:50:23 AM kernel en1 Link down
11/3/10 6:50:23 AM com.apple.SecurityServer[23] Session 0x230086e created
11/3/10 6:50:23 AM com.apple.SecurityServer[23] Session 0x230086e attributes 0x30
11/3/10 6:50:23 AM loginwindow[44] Login Window Started Security Agent
11/3/10 6:50:23 AM WindowServer[67] kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.
11/3/10 6:50:23 AM com.apple.WindowServer[67] Wed Nov 3 06:50:23 xxxxxxxxxxx-Mac-Pro.local WindowServer[67] <Error>: kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.
11/3/10 6:50:23 AM SecurityAgent[86] Showing Login Window
11/3/10 6:50:23 AM configd[13] setting hostname to "a570.g.akamai.net"
11/3/10 6:50:29 AM SecurityAgent[86] User info context values set for xxxxxxxxx
11/3/10 6:50:29 AM authorizationhost[85] Failed to authenticate user <xxxxxxxxx> (tDirStatus: -14090).
11/3/10 6:50:34 AM SecurityAgent[86] User info context values set for xxxxxxxxx
11/3/10 6:50:35 AM SecurityAgent[86] Login Window Showing Progress
11/3/10 6:50:35 AM SecurityAgent[86] Login Window done
11/3/10 6:50:35 AM loginwindow[44] Login Window - Returned from Security Agent
11/3/10 6:50:35 AM loginwindow[44] USER_PROCESS: 44 console
11/3/10 6:50:35 AM com.apple.launchd.peruser.501[92] (com.apple.ReportCrash) Falling back to default Mach exception handler. Could not find: com.apple.ReportCrash.Self
11/3/10 6:50:36 AM com.apple.launchd.peruser.501[92] (com.apple.Kerberos.renew.plist[114]) Exited with exit code: 1
11/3/10 6:50:56 AM kernel BootCache: hit rate below threshold (4270 hits on 8541 lookups)
11/3/10 6:51:10 AM mdworker[132] (Error) SyncInfo: searchfs error (Result too large) -- falling back to fsw search /
11/3/10 6:57:21 AM com.apple.launchd[1] (com.apple.suhelperd[144]) Exited with exit code: 2
11/3/10 7:00:36 AM /System/Library/CoreServices/CCacheServer.app/Contents/MacOS/CCacheServer[119] No valid tickets, timing out
11/3/10 8:23:11 AM loginwindow[44] in pam_sm_authenticate(): Failed to determine Kerberos principal name.
11/3/10 9:12:57 AM loginwindow[44] in pam_sm_authenticate(): Failed to determine Kerberos principal name.
 
Wirelessly posted (Mozilla/5.0 (iPod; U; CPU iPhone OS 4_1 like Mac OS X; en-us) AppleWebKit/532.9 (KHTML, like Gecko) Version/4.0.5 Mobile/8B117 Safari/6531.22.7)

One of those console entries suggests directory damage (orphaned/unlinked files) which could be minor, but I would again recommend running DiskWarrior, which IMHO should be in everyone's toolkit.

I would also suggest using Disk Utility to repair permissions and to check the disk for errors, if you haven't yet done that.
 
There are several "journal replay" entries, consistent with your observations. Your hard disk may be failing.

I would back up your data immediately before running disk scanning programs. This stress of a scan could damage the drive further and make your data irretrievable.
 
cutterman said:
There are several "journal replay" entries, consistent with your observations. Your hard disk may be failing.

I would back up your data immediately before running disk scanning programs. This stress of a scan could damage the drive further and make your data irretrievable.
Click to expand...

Agreed; I thought the OP had a current backup and just turned off Time Machine recently. But on re-reading the post I am not so sure the OP's backup is current. So get those files backed up ASAP and then run the diagnostics.

Your files reverting to previous versions made me suspect journal replaying was involved, and it looks like your machine thinks it crashed or otherwise had an abnormal shutdown prior to the 6 a.m. entries.

Was your previous shutdown a normal software shutdown? If not, this can corrupt the directory and makes it more likely to be directory damage rather than hardware failure. But just in case, get those files backed up, then run Diskwarrior.
 
Thanks for the replies.

I do have backups. I just disabled Time Machine until a dedicated backup drive arrived. I don't fully understand Time Machine yet so I was relying more on old-fashioned manual backups.

I rarely shut down my machine. My previous shutdown was related to the firmware update a few days ago, which completed normally. Now that I think about it, I believe this rollback has happened once before, maybe a month ago. I was puzzled about some old browser windows re-opening which I was sure I had closed.

I just ran Disk Utility from a separate drive. "Repair Disk" found no issues on the primary (SSD) drive. "Repair Permissions" fixed three errors. No problems were found on the 2nd drive.

Before I shell out for Disk Warrior, are there any other thoughts based on this update? Should I shut down my machine a few times and see if anything strange happens? Thanks.
 
tengo84 said:
Before I shell out for Disk Warrior, are there any other thoughts based on this update? Should I shut down my machine a few times and see if anything strange happens? Thanks.
Click to expand...

Since you're backed up, sure. Check the console after each restart to see if the OS replays the journal again or reports an abnormal shutdown. If so -- and if the disk continues to check out clean, it could be a damaged installation of Mac OS X or you might have gotten a bad SSD that intermittently fails. Have you tried shutting down and re-seating the SSD's connector?

As for DiskWarrior, most agree that it's an indispensable tool. I'd get it even if you eventually solve this issue. I run it every month or so as a preventative measure on all my disks, and it often finds minor damage that Disk Utility misses and sometimes major issues. Most of my consulting clients use it, too.
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back