Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Does anyone understand system logs?

rye9

rye9

macrumors 65816
Original poster
Sep 20, 2005
1,347
77
New York (not NYC)
Does anyone understand system logs?... my iBook acted funky today... apps didnt open so i rebooted and lost .45GB HD space... and I was wondering what this meant.

May 19 14:36:20 ryan-mckays-ibook-g4 lookupd[1157]: lookupd (version 369.5) starting - Fri May 19 14:36:20 2006
May 19 14:40:44 ryan-mckays-ibook-g4 /Applications/Safari.app/Contents/MacOS/Safari: *** Warning: Line option kATSLineIsDisplayOnly has been deprecated. ***
May 19 15:14:24 ryan-mckays-ibook-g4 crashdump[1171]: WindowServer crashed
May 19 15:14:30 ryan-mckays-ibook-g4 crashdump[1171]: crash report written to: /Library/Logs/CrashReporter/WindowServer.crash.log
May 19 15:14:47 ryan-mckays-ibook-g4 crashdump[1173]: WindowServer crashed
May 19 15:14:55 ryan-mckays-ibook-g4 crashdump[1173]: crash report written to: /Library/Logs/CrashReporter/WindowServer.crash.log
May 19 15:15:35 ryan-mckays-ibook-g4 crashdump[1175]: WindowServer crashed
May 19 15:15:39 ryan-mckays-ibook-g4 crashdump[1175]: crash report written to: /Library/Logs/CrashReporter/WindowServer.crash.log
May 19 15:15:55 ryan-mckays-ibook-g4 crashdump[1177]: WindowServer crashed
May 19 15:15:59 ryan-mckays-ibook-g4 crashdump[1177]: crash report written to: /Library/Logs/CrashReporter/WindowServer.crash.log
May 19 15:16:32 ryan-mckays-ibook-g4 crashdump[1179]: WindowServer crashed
May 19 15:16:36 ryan-mckays-ibook-g4 crashdump[1179]: crash report written to: /Library/Logs/CrashReporter/WindowServer.crash.log
May 19 15:20:09 ryan-mckays-ibook-g4 crashdump[1181]: WindowServer crashed
May 19 15:20:13 ryan-mckays-ibook-g4 crashdump[1181]: crash report written to: /Library/Logs/CrashReporter/WindowServer.crash.log
May 19 15:29:21 ryan-mckays-ibook-g4 crashdump[1183]: WindowServer crashed
May 19 15:29:27 ryan-mckays-ibook-g4 crashdump[1183]: crash report written to: /Library/Logs/CrashReporter/WindowServer.crash.log
May 19 15:49:48 ryan-mckays-ibook-g4 shutdown: reboot by Ryan:
May 19 15:49:50 ryan-mckays-ibook-g4 SystemStarter[1189]: authentication service (1197) did not complete successfully
May 19 15:49:59 ryan-mckays-ibook-g4 SystemStarter[1189]: The following StartupItems failed to properly start:
May 19 15:49:59 ryan-mckays-ibook-g4 SystemStarter[1189]: /System/Library/StartupItems/AuthServer
May 19 15:49:59 ryan-mckays-ibook-g4 SystemStarter[1189]: - execution of Startup script failed
May 19 15:50:39 localhost kernel[0]: standard timeslicing quantum is 10000 us
May 19 15:50:39 localhost memberd[37]: memberd starting up
May 19 15:50:39 localhost kernel[0]: vm_page_bootstrap: 125051 free pages
May 19 15:50:39 localhost mDNSResponder-107.4 (Nov 15 2005 21: 34:38)[30]: starting
May 19 15:50:39 localhost kernel[0]: mig_table_max_displ = 70
May 19 15:50:39 localhost lookupd[41]: lookupd (version 369.5) starting - Fri May 19 15:50:39 2006
May 19 15:50:39 localhost kernel[0]: 90 prelinked modules
May 19 15:50:39 localhost DirectoryService[42]: Launched version 2.1 (v353.2)
May 19 15:50:39 localhost kernel[0]: Copyright (c) 1982, 1986, 1989, 1991, 1993
May 19 15:50:39 localhost kernel[0]: The Regents of the University of California. All rights reserved.
May 19 15:50:39 localhost kernel[0]: using 1310 buffer headers and 1310 cluster IO buffer headers
May 19 15:50:39 localhost kernel[0]: ADB present:84
May 19 15:50:39 localhost kernel[0]: FireWire (OHCI) Apple ID 31 built-in now active, GUID 001451ff fe24fb10; max speed s400.
May 19 15:50:39 localhost kernel[0]: CSRHIDTransitionDriver::probe:
May 19 15:50:39 localhost kernel[0]: CSRHIDTransitionDriver::start before command
May 19 15:50:39 localhost kernel[0]: Security auditing service present
May 19 15:50:39 localhost kernel[0]: BSM auditing present
May 19 15:50:39 localhost kernel[0]: disabled
May 19 15:50:39 localhost kernel[0]: rooting via boot-uuid from /chosen: 7BCF7D41-F56C-38C9-A7FF-1C5D02C926C7
May 19 15:50:39 localhost kernel[0]: Waiting on <dict ID="0"><key>IOProviderClass</key><string ID="1">IOResources</string><key>IOResourceMatch</key><string ID="2">boot-uuid-media</string></dict>
May 19 15:50:39 localhost kernel[0]: Got boot device = IOService:/MacRISC2PE/pci@f4000000/AppleMacRiscPCI/ata-6@D/AppleKauaiATA/ATADeviceNub@0/IOATABlockStorageDriver/IOATABlockStorageDevice/IOBlockStorageDriver/FUJITSU MHV2040AT Media/IOApplePartitionScheme/Untitled@3
May 19 15:50:39 localhost kernel[0]: BSD root: disk0s3, major 14, minor 2
May 19 15:50:39 localhost kernel[0]: CSRHIDTransitionDriver::stop
May 19 15:50:39 localhost kernel[0]: IOBluetoothHCIController::start Idle Timer Stopped
May 19 15:50:39 localhost kernel[0]: HFS: Removed 2 orphaned unlinked files
May 19 15:50:39 localhost kernel[0]: Jettisoning kernel linker.
May 19 15:50:39 localhost kernel[0]: Resetting IOCatalogue.
May 19 15:50:39 localhost kernel[0]: Matching service count = 0
May 19 15:50:39 localhost kernel[0]: Matching service count = 1
May 19 15:50:39 localhost kernel[0]: Matching service count = 1
May 19 15:50:39 localhost kernel[0]: Matching service count = 1
May 19 15:50:39 localhost kernel[0]: Matching service count = 1
May 19 15:50:39 localhost kernel[0]: Matching service count = 1
May 19 15:50:39 localhost kernel[0]: IPv6 packet filtering initialized, default to accept, logging disabled
May 19 15:50:40 localhost diskarbitrationd[36]: disk0s3 hfs 7BCF7D41-F56C-38C9-A7FF-1C5D02C926C7 Macintosh HD /
May 19 15:50:41 localhost kernel[0]: UniNEnet: Ethernet address 00:14:51:24:fb:10
May 19 15:50:41 localhost kernel[0]: AirPortPCI_MM: Ethernet address 00:14:51:7f:75:4c
May 19 15:50:41 localhost launchd: Server 2b07 in bootstrap 1103 uid 0: "/usr/sbin/lookupd"[41]: exited abnormally: Hangup
May 19 15:50:41 localhost lookupd[58]: lookupd (version 369.5) starting - Fri May 19 15:50:41 2006
May 19 15:50:43 localhost kernel[0]: [HCIController][setupHardware] AFH Is Supported
May 19 15:50:44 localhost kernel[0]: ATY,Snowy_A: vram [98000000:02000000]
May 19 15:50:44 localhost kernel[0]: ATY,Snowy_B: vram [98000000:02000000]
May 19 15:50:44 localhost /System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow: Login Window Application Started
May 19 15:50:44 localhost mDNSResponder: Adding browse domain local.
May 19 15:50:45 localhost loginwindow[62]: Login Window Started Security Agent
May 19 15:50:52 ryan-mckays-ibook-g4 configd[34]: setting hostname to "ryan-mckays-ibook-g4.local"
May 19 15:50:54 ryan-mckays-ibook-g4 kernel[0]: AirPort: Link Active: "04B412683549" - 00e098d616c7 - chan 6
May 19 15:50:56 ryan-mckays-ibook-g4 launchd: Server 0 in bootstrap 1103 uid 0: "/usr/sbin/lookupd"[58]: exited abnormally: Hangup
May 19 15:50:56 ryan-mckays-ibook-g4 configd[34]: executing /System/Library/SystemConfiguration/Kicker.bundle/Contents/Resources/enable-network
May 19 15:50:56 ryan-mckays-ibook-g4 configd[34]: posting notification com.apple.system.config.network_change
May 19 15:50:56 ryan-mckays-ibook-g4 lookupd[88]: lookupd (version 369.5) starting - Fri May 19 15:50:56 2006
May 19 15:50:54 ryan-mckays-ibook-g4 configd[34]: target=enable-network: disabled
May 19 16:51:40 ryan-mckays-ibook-g4 /Applications/Safari.app/Contents/MacOS/Safari: *** Warning: Line option kATSLineIsDisplayOnly has been deprecated. ***
May 19 20:24:09 ryan-mckays-ibook-g4 ntpd[134]: time set 0.176833 s
 
The Safari thing is just a warning. It doesn't have to mean anything.

After that, the WindowServer crashed repeatedly. That's not good.

Then you did a reboot, and the following log messages look like normal startup messages.
 
gekko513 said:
Then you did a reboot, and the following log messages look like normal startup messages.
Click to expand...

It wasnt normal, it said something did not start up correctly:

authentication service (1197) did not complete successfully
May 19 15:49:59 ryan-mckays-ibook-g4 SystemStarter[1189]: The following StartupItems failed to properly start:/System/Library/StartupItems/AuthServer
May 19 15:49:59 ryan-mckays-ibook-g4 SystemStarter[1189]: - execution of Startup script failed
Click to expand...

Could any of this have to do with how my HD lost .45GB? What about when my WindowServer crashed? It says crashdump, what does that mean?
 
rye9 said:
It wasnt normal, it said something did not start up correctly:



Could any of this have to do with how my HD lost .45GB? What about when my WindowServer crashed? It says crashdump, what does that mean?
Click to expand...

it might of dumped .45gigs of data from memory?
 
rye9 said:
It wasnt normal, it said something did not start up correctly:



Could any of this have to do with how my HD lost .45GB? What about when my WindowServer crashed? It says crashdump, what does that mean?
Click to expand...
You're right. AuthServer doesn't seem to start up correctly. I've been googling the error message and has found several others with that log entry, but the problems they are troubleshooting don't seem to have much in common.

I still haven't found anyone who were able to fix it, or what it actually does, except that it handles some user authentication (network related?) and is related to PasswordService. I'm still googling it... (most of the discussions I found were for people running Mac OS X Server, but I'm guessing server running people are more likely to discuss their log entries, so that doesn't have to mean anything.)

As for the crash dump. You'll find a crash log for the WindowServer in the file location that is indicated. It contains information that may explain why it crashed.
 
May 20 16:07:14 ryan-mckays-ibook-g4 cp: error processing extended attributes: Operation not permitted
May 20 16:09:24 ryan-mckays-ibook-g4 cp: error processing extended attributes: Operation not permitted

What does this mean? I ask this because for a couple minutes my iBook started to make noise constantly... like more of a gurgle, not something spinning.
 
That's a file copy (cp) operation that failed. Why it did, and what invoked it, I can't tell.
 
OK, so yesterday apps wouldn't open, so I rebooted and found less HD space. Also, the systemUIserver crashed so I just quit it and everything was fine. I posted the logs on here... so after the analysis, should I just pretend nothing ever happened or should I do something now? If it happens again I will surely take my iBook to an Apple Store though... but should I do it now?
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back