How do I determine sudden reboot cause?

Discussion in 'OS X El Capitan (10.11)' started by RichardF, Jun 28, 2016.

  1. RichardF macrumors 6502a

    RichardF

    Joined:
    Oct 27, 2006
    Location:
    New York City
    #1
    Hello everyone

    My 2016 rMBP 13" OS X 10.11.5 just rebooted on me with absolutely no warning or sign.

    Could someone help me and explain where to look in the logs and how to interpret the reason it did that?

    Thank you!
     
  2. richard2 macrumors regular

    richard2

    Joined:
    Oct 21, 2010
    Location:
    England, United Kingdom
    #2
    You can view diagnostic reports using Console.
     
  3. JohnDS macrumors 65816

    Joined:
    Oct 25, 2015
    #3
    In console check the logs for immediately before the reboot.
     
  4. RichardF thread starter macrumors 6502a

    RichardF

    Joined:
    Oct 27, 2006
    Location:
    New York City
    #4
    I am in Console.
    And I have All Messages highlighted in the left column.

    I found a gap for a time which is probably the time when I experienced the sudden shut down.

    The computer was charging to so I know it wasn't a low battery level issue.

    6/28/16 5:41:27.000 PM kernel[0]: en0: channel changed to 149,80
    6/28/16 5:41:31.000 PM kernel[0]: AppleCamIn::handleWakeEvent_gated
    6/28/16 5:41:37.000 PM syslogd[42]: ASL Sender Statistics
    6/28/16 5:47:34.000 PM bootlog[0]: BOOT_TIME 1467161254 0
     
  5. Weaselboy Moderator

    Weaselboy

    Staff Member

    Joined:
    Jan 23, 2005
    Location:
    California
    #5
    Try looking in this folder for a crash report at the exact date/time this happened.

    Code:
    /Library/Logs/DiagnosticReports 
     
  6. RichardF thread starter macrumors 6502a

    RichardF

    Joined:
    Oct 27, 2006
    Location:
    New York City
    #6
    Thank you very much.

    There are two crash reports from Vmware. 5:53:03 PM and 6:01:16 PM
    This allowed me to pinpoint a timeframe. Here is the Console entries for those times:

    6/28/16 5:49:58.000 PM kernel[0]: vmnet: Hub 8
    6/28/16 5:49:58.000 PM kernel[0]: vmnet: Port 0
    6/28/16 5:49:58.000 PM kernel[0]: vmnet: Port 1
    6/28/16 5:49:58.000 PM kernel[0]: vmnet: Port 2
    6/28/16 5:49:58.000 PM kernel[0]: vmnet: Port 3
    6/28/16 5:49:58.000 PM kernel[0]: vmnet: Port 4
    6/28/16 5:49:58.000 PM kernel[0]: vmnet: VNetUserIfFree: freeing userif9.
    6/28/16 5:52:08.508 PM com.apple.xpc.launchd[1]: (com.apple.auditd[562]) Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.auditd
    6/28/16 5:52:08.516 PM rMBP13[566]: audit warning: allsoft
    6/28/16 5:52:08.516 PM rMBP13[567]: audit warning: soft /var/audit
    6/28/16 5:52:08.517 PM rMBP13[568]: audit warning: closefile /var/audit/20160629004950.20160629005208
    6/28/16 5:53:01.000 PM kernel[0]: process vmware-vmx[531] caught causing excessive wakeups. Observed wakeups rate (per sec): 235; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45064
    6/28/16 5:53:01.065 PM com.apple.xpc.launchd[1]: (com.apple.ReportCrash.Root[573]) Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.ReportCrash.DirectoryService
    6/28/16 5:53:01.158 PM SubmitDiagInfo[575]: Couldn't load config file from on-disk location. Falling back to default location. Reason: Won't serialize in _readDictionaryFromJSONData due to nil object
    6/28/16 5:53:01.242 PM SubmitDiagInfo[575]: Couldn't load config file from on-disk location. Falling back to default location. Reason: Won't serialize in _readDictionaryFromJSONData due to nil object
    6/28/16 5:53:03.021 PM spindump[574]: Saved wakeups_resource.diag report for vmware-vmx version ??? (???) to /Library/Logs/DiagnosticReports/vmware-vmx_2016-06-28-175303_rMBP13-2.wakeups_resource.diag
    6/28/16 5:54:54.000 PM kernel[0]: ignored is_io_service_close(0x10000047d,IOHIDParamUserClient)
    6/28/16 5:56:25.000 PM kernel[0]: ignored is_io_service_close(0x10000047d,IOHIDParamUserClient)
    6/28/16 5:56:36.000 PM kernel[0]: vmmon: Cycles 63



    and

    6/28/16 6:01:15.000 PM kernel[0]: process vmware-vmx[591] caught causing excessive wakeups. Observed wakeups rate (per sec): 161; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45011
    6/28/16 6:01:15.721 PM com.apple.xpc.launchd[1]: (com.apple.ReportCrash.Root[622]) Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.ReportCrash.DirectoryService
    6/28/16 6:01:16.412 PM spindump[574]: Saved wakeups_resource.diag report for vmware-vmx version ??? (???) to /Library/Logs/DiagnosticReports/vmware-vmx_2016-06-28-180116_rMBP13-2.wakeups_resource.diag
    6/28/16 6:05:03.559 PM AppleSpell[357]: Lexicon creation failed: Lexicon resources not found
     
  7. richard2 macrumors regular

    richard2

    Joined:
    Oct 21, 2010
    Location:
    England, United Kingdom
    #7
    Please provide complete list of all the diagnostic reports on your Mac by doing the following:

    1. Open Terminal.
    2. Enter the following:

      ls -1 /Library/Logs/DiagnosticReports ~/Library/Logs/DiagnosticReports
    3. Include the contents of the Terminal window in a reply to this post.
     
  8. RichardF thread starter macrumors 6502a

    RichardF

    Joined:
    Oct 27, 2006
    Location:
    New York City
    #8
    Thank you.

    This is what I got:


    rMBP13-2:~ rMBP13$ ls -1 /Library/Logs/DiagnosticReports ~/Library/Logs/DiagnosticReports

    /Library/Logs/DiagnosticReports:

    Mail_2016-06-26-183359_rMBP13-2.hang

    com.apple.WebKit.WebContent_2016-06-13-234142_rMBP13-2.wakeups_resource.diag

    vmware-vmx_2016-05-31-180604_rMBP13-2.wakeups_resource.diag

    vmware-vmx_2016-06-01-212708_rMBP13-2.wakeups_resource.diag

    vmware-vmx_2016-06-04-070630_rMBP13-2.wakeups_resource.diag

    vmware-vmx_2016-06-04-100239_rMBP13-2.wakeups_resource.diag

    vmware-vmx_2016-06-12-180129_rMBP13-2.wakeups_resource.diag

    vmware-vmx_2016-06-14-180912_rMBP13-2.wakeups_resource.diag

    vmware-vmx_2016-06-26-122007_rMBP13-2.wakeups_resource.diag

    vmware-vmx_2016-06-26-122643_rMBP13-2.wakeups_resource.diag

    vmware-vmx_2016-06-26-125834_rMBP13-2.wakeups_resource.diag

    vmware-vmx_2016-06-26-130117_rMBP13-2.wakeups_resource.diag

    vmware-vmx_2016-06-27-211057_rMBP13-2.wakeups_resource.diag

    vmware-vmx_2016-06-27-211759_rMBP13-2.wakeups_resource.diag

    vmware-vmx_2016-06-28-175303_rMBP13-2.wakeups_resource.diag

    vmware-vmx_2016-06-28-180116_rMBP13-2.wakeups_resource.diag


    /Users/rMBP13/Library/Logs/DiagnosticReports:

    useractivityd_2016-06-12-070634_rMBP13-2.crash
     
  9. JohnDS macrumors 65816

    Joined:
    Oct 25, 2015
  10. richard2 macrumors regular

    richard2

    Joined:
    Oct 21, 2010
    Location:
    England, United Kingdom
    #10
    These are the only reports created in the last 24 hours, and they're merely "excessive system resource usage" reports, not crash reports.

    Try the following:

    1. Open Console.
    2. In the left pane, select /var/logsystem.log.
    3. In the right pane, locate the point at which your computer spontaneously restarted, and then examine the immediately preceding messages for clues.
     
  11. RichardF thread starter macrumors 6502a

    RichardF

    Joined:
    Oct 27, 2006
    Location:
    New York City
    #11


    I am having trouble remembering the exact time.
    Based on the other things I found above, I thought it was 5:53:03 PM and 6:01:16 PM.
    I see a lot of activity for the entire 5:47 PM minute with nothing found before as far back as 5:41 PM
    It exceeds the 7,000 characters posting limit.

    then the next similar "jump" presenting a gap in the log (with no activity written for a while) is

     

Share This Page