How do I determine sudden reboot cause?

[RichardF]

Hello everyone

My 2016 rMBP 13" OS X 10.11.5 just rebooted on me with absolutely no warning or sign.

Could someone help me and explain where to look in the logs and how to interpret the reason it did that?

Thank you!

 

[richard2]

You can view diagnostic reports using Console.

 

[JohnDS]

In console check the logs for immediately before the reboot.

 

[RichardF]

I am in Console.
And I have All Messages highlighted in the left column.

I found a gap for a time which is probably the time when I experienced the sudden shut down.

The computer was charging to so I know it wasn't a low battery level issue.

6/28/16 5:41:27.000 PM kernel[0]: en0: channel changed to 149,80
6/28/16 5:41:31.000 PM kernel[0]: AppleCamIn::handleWakeEvent_gated
6/28/16 5:41:37.000 PM syslogd[42]: ASL Sender Statistics
6/28/16 5:47:34.000 PM bootlog[0]: BOOT_TIME 1467161254 0

 

[Weaselboy]

Hello everyone

My 2016 rMBP 13" OS X 10.11.5 just rebooted on me with absolutely no warning or sign.

Could someone help me and explain where to look in the logs and how to interpret the reason it did that?

Thank you!

Try looking in this folder for a crash report at the exact date/time this happened.

/Library/Logs/DiagnosticReports

 

[RichardF]

Thank you very much.

There are two crash reports from Vmware. 5:53:03 PM and 6:01:16 PM
This allowed me to pinpoint a timeframe. Here is the Console entries for those times:

6/28/16 5:49:58.000 PM kernel[0]: vmnet: Hub 8
6/28/16 5:49:58.000 PM kernel[0]: vmnet: Port 0
6/28/16 5:49:58.000 PM kernel[0]: vmnet: Port 1
6/28/16 5:49:58.000 PM kernel[0]: vmnet: Port 2
6/28/16 5:49:58.000 PM kernel[0]: vmnet: Port 3
6/28/16 5:49:58.000 PM kernel[0]: vmnet: Port 4
6/28/16 5:49:58.000 PM kernel[0]: vmnet: VNetUserIfFree: freeing userif9.
6/28/16 5:52:08.508 PM com.apple.xpc.launchd[1]: (com.apple.auditd[562]) Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.auditd
6/28/16 5:52:08.516 PM rMBP13[566]: audit warning: allsoft
6/28/16 5:52:08.516 PM rMBP13[567]: audit warning: soft /var/audit
6/28/16 5:52:08.517 PM rMBP13[568]: audit warning: closefile /var/audit/20160629004950.20160629005208
6/28/16 5:53:01.000 PM kernel[0]: process vmware-vmx[531] caught causing excessive wakeups. Observed wakeups rate (per sec): 235; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45064
6/28/16 5:53:01.065 PM com.apple.xpc.launchd[1]: (com.apple.ReportCrash.Root[573]) Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.ReportCrash.DirectoryService
6/28/16 5:53:01.158 PM SubmitDiagInfo[575]: Couldn't load config file from on-disk location. Falling back to default location. Reason: Won't serialize in _readDictionaryFromJSONData due to nil object
6/28/16 5:53:01.242 PM SubmitDiagInfo[575]: Couldn't load config file from on-disk location. Falling back to default location. Reason: Won't serialize in _readDictionaryFromJSONData due to nil object
6/28/16 5:53:03.021 PM spindump[574]: Saved wakeups_resource.diag report for vmware-vmx version ??? (???) to /Library/Logs/DiagnosticReports/vmware-vmx_2016-06-28-175303_rMBP13-2.wakeups_resource.diag
6/28/16 5:54:54.000 PM kernel[0]: ignored is_io_service_close(0x10000047d,IOHIDParamUserClient)
6/28/16 5:56:25.000 PM kernel[0]: ignored is_io_service_close(0x10000047d,IOHIDParamUserClient)
6/28/16 5:56:36.000 PM kernel[0]: vmmon: Cycles 63



and

6/28/16 6:01:15.000 PM kernel[0]: process vmware-vmx[591] caught causing excessive wakeups. Observed wakeups rate (per sec): 161; Maximum permitted wakeups rate (per sec): 150; Observation period: 300 seconds; Task lifetime number of wakeups: 45011
6/28/16 6:01:15.721 PM com.apple.xpc.launchd[1]: (com.apple.ReportCrash.Root[622]) Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.ReportCrash.DirectoryService
6/28/16 6:01:16.412 PM spindump[574]: Saved wakeups_resource.diag report for vmware-vmx version ??? (???) to /Library/Logs/DiagnosticReports/vmware-vmx_2016-06-28-180116_rMBP13-2.wakeups_resource.diag
6/28/16 6:05:03.559 PM AppleSpell[357]: Lexicon creation failed: Lexicon resources not found

 

[richard2]

Please provide complete list of all the diagnostic reports on your Mac by doing the following:

1. Open Terminal.
2. Enter the following:
   
   ls -1 /Library/Logs/DiagnosticReports ~/Library/Logs/DiagnosticReports
3. Include the contents of the Terminal window in a reply to this post.

 

[RichardF]

Thank you.

This is what I got:


rMBP13-2:~ rMBP13$ ls -1 /Library/Logs/DiagnosticReports ~/Library/Logs/DiagnosticReports

/Library/Logs/DiagnosticReports:

Mail_2016-06-26-183359_rMBP13-2.hang

com.apple.WebKit.WebContent_2016-06-13-234142_rMBP13-2.wakeups_resource.diag

vmware-vmx_2016-05-31-180604_rMBP13-2.wakeups_resource.diag

vmware-vmx_2016-06-01-212708_rMBP13-2.wakeups_resource.diag

vmware-vmx_2016-06-04-070630_rMBP13-2.wakeups_resource.diag

vmware-vmx_2016-06-04-100239_rMBP13-2.wakeups_resource.diag

vmware-vmx_2016-06-12-180129_rMBP13-2.wakeups_resource.diag

vmware-vmx_2016-06-14-180912_rMBP13-2.wakeups_resource.diag

vmware-vmx_2016-06-26-122007_rMBP13-2.wakeups_resource.diag

vmware-vmx_2016-06-26-122643_rMBP13-2.wakeups_resource.diag

vmware-vmx_2016-06-26-125834_rMBP13-2.wakeups_resource.diag

vmware-vmx_2016-06-26-130117_rMBP13-2.wakeups_resource.diag

vmware-vmx_2016-06-27-211057_rMBP13-2.wakeups_resource.diag

vmware-vmx_2016-06-27-211759_rMBP13-2.wakeups_resource.diag

vmware-vmx_2016-06-28-175303_rMBP13-2.wakeups_resource.diag

vmware-vmx_2016-06-28-180116_rMBP13-2.wakeups_resource.diag


/Users/rMBP13/Library/Logs/DiagnosticReports:

useractivityd_2016-06-12-070634_rMBP13-2.crash

 

[JohnDS]

Is your version of VMWare up to date?

 

[richard2]

vmware-vmx_2016-06-28-175303_rMBP13-2.wakeups_resource.diag
vmware-vmx_2016-06-28-180116_rMBP13-2.wakeups_resource.diag

These are the only reports created in the last 24 hours, and they're merely "excessive system resource usage" reports, not crash reports.

Try the following:

1. Open Console.
2. In the left pane, select /var/log → system.log.
3. In the right pane, locate the point at which your computer spontaneously restarted, and then examine the immediately preceding messages for clues.

 

[RichardF]

These are the only reports created in the last 24 hours, and they're merely "excessive system resource usage" reports, not crash reports.

Try the following:

1. Open Console.
2. In the left pane, select /var/log → system.log.
3. In the right pane, locate the point at which your computer spontaneously restarted, and then examine the immediately preceding messages for clues.

I am having trouble remembering the exact time.
Based on the other things I found above, I thought it was 5:53:03 PM and 6:01:16 PM.
I see a lot of activity for the entire 5:47 PM minute with nothing found before as far back as 5:41 PM
It exceeds the 7,000 characters posting limit.

Jun 28 17:41:37 rMBP13-2 syslogd[42]: ASL Sender Statistics
Jun 28 17:47:34 localhost bootlog[0]: BOOT_TIME 1467161254 0

then the next similar "jump" presenting a gap in the log (with no activity written for a while) is

Jun 28 17:49:58 rMBP13-2 kernel[0]: vmnet: VNetUserIfFree: freeing userif9.
Jun 28 17:52:08 rMBP13-2 com.apple.xpc.launchd[1] (com.apple.auditd[562]): Endpoint has been activated through legacy launch(3) APIs. Please switch to XPC or bootstrap_check_in(): com.apple.auditd