New Mac Pro somehow reverted to earlier state! Time Machine Off!

Discussion in 'Mac Pro' started by tengo84, Nov 3, 2010.

  1. tengo84 macrumors newbie

    Joined:
    Aug 2, 2010
    Location:
    Chicago
    #1
    Hello friends,

    I have a new Mac Pro running 10.6.4 (see sig for details). I left it idle a half-day while tending to some errands. Nothing major was running, just a few browser windows and a basic Apple screen saver. When I returned, the system was hung with a blue screen and spinning dial. I waited a while, gave up, and turned it off with power button. Turned back on, loaded up in a snap, and everything seemed OK.

    When I opened Apple Mail, I noticed messages previously read and/or deleted were marked unread. When I restored my browser session (Firefox), it loaded tabs I had already closed hours earlier. And when I opened a TextEdit doc I use to type notes, it loaded a previous version even though I knew with certainty I had saved newer versions. It was like my computer had gone back in time 8 hrs. :confused:

    It's not related to Time Machine, I have it turned off until I receive my new backup drive. Also, it's not due to Apple's software updates or the recent firmware update, which had already been installed.

    I run my system and apps from the OWC SSD. Hard disks are set never to turn off. RAM is a mix of 3rd party and Apple. No other problems or issues I'm aware of.

    Any thoughts?
     
  2. SkyNite macrumors member

    Joined:
    Sep 21, 2010
    #2
    Wirelessly posted (Mozilla/5.0 (iPod; U; CPU iPhone OS 4_1 like Mac OS X; en-us) AppleWebKit/532.9 (KHTML, like Gecko) Version/4.0.5 Mobile/8B117 Safari/6531.22.7)

    It sounds like journaling may have returned your files to a previous state.

    In any event, I would immediately run DiskWarrior on the disk to reconstruct the directory.
     
  3. cutterman macrumors regular

    Joined:
    Apr 27, 2010
    #3
    Run 'Console' (in /Applications/Utilities) and select "All Messages" in the left pane. Scroll the right pane to the approximate time you think the fault happened and see if there are any error messages. Some of the log may look like gibberish if you have never used this app. Post it up here and we can take a look if you see something suspicious.
     
  4. tengo84 thread starter macrumors newbie

    Joined:
    Aug 2, 2010
    Location:
    Chicago
    #4
    Thanks for the suggestion. I copied the log and replaced personal info with "xxxx". For some reason the time stamps at the beginning are out of order, as they appeared in the log. I added bold print to one line. "Mercury" is my boot drive, "Maverick" is backup/media. Thanks for your help.

    11/3/10 6:50:15 AM kernel npvhash=4095
    11/2/10 2:02:51 PM [0x0-0x2ff2ff].org.videolan.vlc[6850] [flv @ 0x102072210] Estimating duration from bitrate, this may be inaccurate
    11/3/10 6:50:15 AM kernel Darwin Kernel Version 10.4.2: Tue Jul 27 21:17:17 PDT 2010; root:xnu-1504.7.60~1/RELEASE_X86_64
    11/3/10 6:50:15 AM kernel vm_page_bootstrap: 2483128 free pages and 138312 wired pages
    11/3/10 6:50:15 AM kernel kext submap [0xffffff7f80600000 - 0xffffff8000000000], kernel text [0xffffff8000200000 - 0xffffff8000600000]
    11/3/10 6:50:15 AM kernel standard timeslicing quantum is 10000 us
    11/3/10 6:50:15 AM kernel mig_table_max_displ = 73
    11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=0 LocalApicId=0 Enabled
    11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=1 LocalApicId=2 Enabled
    11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=2 LocalApicId=4 Enabled
    11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=3 LocalApicId=6 Enabled
    11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=4 LocalApicId=1 Enabled
    11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=5 LocalApicId=3 Enabled
    11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=6 LocalApicId=5 Enabled
    11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=7 LocalApicId=7 Enabled
    11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=8 LocalApicId=0 Disabled
    11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=9 LocalApicId=0 Disabled
    11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=10 LocalApicId=0 Disabled
    11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=11 LocalApicId=0 Disabled
    11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=12 LocalApicId=0 Disabled
    11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=13 LocalApicId=0 Disabled
    11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=14 LocalApicId=0 Disabled
    11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=15 LocalApicId=0 Disabled
    11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=16 LocalApicId=0 Disabled
    11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=17 LocalApicId=0 Disabled
    11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=18 LocalApicId=0 Disabled
    11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=19 LocalApicId=0 Disabled
    11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=20 LocalApicId=0 Disabled
    11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=21 LocalApicId=0 Disabled
    11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=22 LocalApicId=0 Disabled
    11/3/10 6:50:15 AM kernel AppleACPICPU: ProcessorId=23 LocalApicId=0 Disabled
    11/3/10 6:50:15 AM kernel calling mpo_policy_init for TMSafetyNet
    11/3/10 6:50:15 AM kernel Security policy loaded: Safety net for Time Machine (TMSafetyNet)
    11/3/10 6:50:15 AM kernel calling mpo_policy_init for Quarantine
    11/3/10 6:50:15 AM kernel Security policy loaded: Quarantine policy (Quarantine)
    11/3/10 6:50:15 AM kernel calling mpo_policy_init for Sandbox
    11/3/10 6:50:15 AM kernel Security policy loaded: Seatbelt sandbox policy (Sandbox)
    11/3/10 6:50:15 AM kernel Copyright (c) 1982, 1986, 1989, 1991, 1993
    11/3/10 6:50:15 AM kernel The Regents of the University of California. All rights reserved.
    11/3/10 6:50:15 AM kernel MAC Framework successfully initialized
    11/3/10 6:50:15 AM kernel using 16384 buffer headers and 4096 cluster IO buffer headers
    11/3/10 6:50:15 AM kernel IOAPIC: Version 0x20 Vectors 64:87
    11/3/10 6:50:15 AM kernel ACPI: System State [S0 S3 S4 S5] (S3)
    11/3/10 6:50:15 AM kernel AppleIntelCPUPowerManagement: Turbo Ratios 1112
    11/3/10 6:50:15 AM kernel AppleIntelCPUPowerManagement: initialization complete
    11/3/10 6:50:15 AM kernel mbinit: done (96 MB memory set for mbuf pool)
    11/3/10 6:50:15 AM kernel rooting via boot-uuid from /chosen: C0F4FD8A-D7EA-3780-ADED-3004941BEF56
    11/3/10 6:50:15 AM kernel Waiting on <dict ID="0"><key>IOProviderClass</key><string ID="1">IOResources</string><key>IOResourceMatch</key><string ID="2">boot-uuid-media</string></dict>
    11/3/10 6:50:15 AM kernel com.apple.AppleFSCompressionTypeZlib kmod start
    11/3/10 6:50:15 AM kernel com.apple.AppleFSCompressionTypeZlib load succeeded
    11/3/10 6:50:15 AM kernel AppleIntelCPUPowerManagementClient: ready
    11/3/10 6:50:15 AM kernel Intel82574L::start - Built Jul 27 2010 21:31:39 -- running on device at b10d0f0
    11/3/10 6:50:15 AM kernel Intel82574L::start - Built Jul 27 2010 21:31:39 -- running on device at b9d0f0
    11/3/10 6:50:15 AM kernel Got boot device = IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/SATA@1F,2/AppleAHCI/PRT1@1/IOAHCIDevice@0/AppleAHCIDiskDriver/IOAHCIBlockStorageDevice/IOBlockStorageDriver/OWC Mercury Extreme Pro SSD Media/IOGUIDPartitionScheme/Mercury@2
    11/3/10 6:50:15 AM kernel BSD root: disk0s2, major 14, minor 2
    11/3/10 6:50:15 AM kernel jnl: unknown-dev: replay_journal: from: 175104 to: 2759680 (joffset 0x37e000)
    11/3/10 6:50:15 AM kernel wl0: Broadcom BCM432b 802.11 Wireless Controller
    11/3/10 6:50:15 AM kernel 5.10.91.27
    11/3/10 6:50:15 AM kernel jnl: unknown-dev: journal replay done.
    11/3/10 6:50:15 AM kernel FireWire (OHCI) TI ID 823f built-in now active, GUID 78ca39fffe05c53c; max speed s800.
    11/3/10 6:50:15 AM kernel Kernel is LP64
    11/3/10 6:50:15 AM kernel hfs: Removed 7 orphaned / unlinked files and 0 directories
    11/3/10 6:50:14 AM com.apple.launchd[1] *** launchd[1] has started up. ***
    11/3/10 6:50:15 AM DirectoryService[15] Improper shutdown detected
    11/3/10 6:50:15 AM blued[17] Apple Bluetooth daemon started
    11/3/10 6:50:16 AM kernel Intel82574L: Ethernet address e8:06:88:cb:86:92
    11/3/10 6:50:16 AM kernel Intel82574L: Ethernet address e8:06:88:cb:68:d2
    11/3/10 6:50:16 AM kernel AirPort_Brcm43xx: Ethernet address 00:26:08:fd:93:c8
    11/3/10 6:50:16 AM kernel IO80211Controller::dataLinkLayerAttachComplete(): adding AppleEFINVRAM notification
    11/3/10 6:50:16 AM kernel systemShutdown false
    11/3/10 6:50:16 AM com.apple.SecurityServer[23] Session 0x5fbff962 created
    11/3/10 6:50:16 AM com.apple.SecurityServer[23] Entering service
    11/3/10 6:50:16 AM kernel AirPort: Link Down on en2. Reason 8 (Disassociated because station leaving).
    11/3/10 6:50:16 AM com.apple.kextd[10] Can't load /System/Library/Extensions/IOSerialFamily.kext/Contents/PlugIns/InternalModemSupport.kext - no code for running kernel's architecture.
    11/3/10 6:50:16 AM com.apple.kextd[10] Failed to load /System/Library/Extensions/IOSerialFamily.kext/Contents/PlugIns/InternalModemSupport.kext - (libkern/kext) requested architecture/executable not found.
    11/3/10 6:50:16 AM com.apple.kextd[10] Load com.apple.driver.InternalModemSupport failed; removing personalities.
    11/3/10 6:50:17 AM kernel Previous Shutdown Cause: 3
    11/3/10 6:50:17 AM kernel DSMOS has arrived
    11/3/10 6:50:17 AM kernel AppleTyMCEDriver::start coreVIDPID = 0xffffffff Number of packages = 1 Number of cpus = 8 memory monitor trough MCA
    11/3/10 6:50:17 AM kernel ** Device in slot: SLOT-1 **
    11/3/10 6:50:17 AM configd[13] bootp_session_transmit: bpf_write(en2) failed: Network is down (50)
    11/3/10 6:50:17 AM configd[13] DHCP en2: INIT transmit failed
    11/3/10 6:50:17 AM configd[13] setting hostname to "xxxxxxxxxxx-Mac-Pro.local"
    11/3/10 6:50:17 AM configd[13] network configuration changed.
    11/3/10 6:50:18 AM kernel jnl: disk2s2: replay_journal: from: 46416896 to: 47205888 (joffset 0x1d1c000)
    11/3/10 6:50:18 AM kernel jnl: disk2s2: journal replay done.
    11/3/10 6:50:18 AM kernel Ethernet [Intel82574L]: Link up on en0, 100-Megabit, Full-duplex, No flow-control, Debug [796d,6c08,0de1,0200,41e1,4000]
    11/3/10 6:50:19 AM bootlog[55] BOOT_TIME: 1288785014 0
    11/3/10 6:50:20 AM fseventsd[48] event logs in /Volumes/Maverick/.fseventsd out of sync with volume. destroying old logs. (432803 2 456305)
    11/3/10 6:50:20 AM mDNSResponder[43] mDNSResponder mDNSResponder-214.3.2 (Apr 12 2010 19:33:48) starting
    11/3/10 6:50:20 AM com.apple.usbmuxd[37] usbmuxd-201 built for iTunesTen on Aug 12 2010 at 17:33:03, running 64 bit
    11/3/10 6:50:20 AM /System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow[44] Login Window Application Started
    11/3/10 6:50:20 AM fseventsd[48] log dir: /Volumes/Maverick/.fseventsd getting new uuid: D33AC983-0290-44A2-9D63-F4684DB1C527
    11/3/10 6:50:20 AM configd[13] network configuration changed.
    11/3/10 6:50:20 AM configd[13] network configuration changed.
    11/3/10 6:50:20 AM fseventsd[48] event logs in /.fseventsd out of sync with volume. destroying old logs. (402289 6 456305)
    11/3/10 6:50:20 AM fseventsd[48] log dir: /.fseventsd getting new uuid: E6ABE089-E709-4AF4-8375-2C39DF8289C6
    11/3/10 6:50:21 AM configd[13] network configuration changed.
    11/3/10 6:50:23 AM kernel en1 Link down
    11/3/10 6:50:23 AM com.apple.SecurityServer[23] Session 0x230086e created
    11/3/10 6:50:23 AM com.apple.SecurityServer[23] Session 0x230086e attributes 0x30
    11/3/10 6:50:23 AM loginwindow[44] Login Window Started Security Agent
    11/3/10 6:50:23 AM WindowServer[67] kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.
    11/3/10 6:50:23 AM com.apple.WindowServer[67] Wed Nov 3 06:50:23 xxxxxxxxxxx-Mac-Pro.local WindowServer[67] <Error>: kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.
    11/3/10 6:50:23 AM SecurityAgent[86] Showing Login Window
    11/3/10 6:50:23 AM configd[13] setting hostname to "a570.g.akamai.net"
    11/3/10 6:50:29 AM SecurityAgent[86] User info context values set for xxxxxxxxx
    11/3/10 6:50:29 AM authorizationhost[85] Failed to authenticate user <xxxxxxxxx> (tDirStatus: -14090).
    11/3/10 6:50:34 AM SecurityAgent[86] User info context values set for xxxxxxxxx
    11/3/10 6:50:35 AM SecurityAgent[86] Login Window Showing Progress
    11/3/10 6:50:35 AM SecurityAgent[86] Login Window done
    11/3/10 6:50:35 AM loginwindow[44] Login Window - Returned from Security Agent
    11/3/10 6:50:35 AM loginwindow[44] USER_PROCESS: 44 console
    11/3/10 6:50:35 AM com.apple.launchd.peruser.501[92] (com.apple.ReportCrash) Falling back to default Mach exception handler. Could not find: com.apple.ReportCrash.Self
    11/3/10 6:50:36 AM com.apple.launchd.peruser.501[92] (com.apple.Kerberos.renew.plist[114]) Exited with exit code: 1
    11/3/10 6:50:56 AM kernel BootCache: hit rate below threshold (4270 hits on 8541 lookups)
    11/3/10 6:51:10 AM mdworker[132] (Error) SyncInfo: searchfs error (Result too large) -- falling back to fsw search /
    11/3/10 6:57:21 AM com.apple.launchd[1] (com.apple.suhelperd[144]) Exited with exit code: 2
    11/3/10 7:00:36 AM /System/Library/CoreServices/CCacheServer.app/Contents/MacOS/CCacheServer[119] No valid tickets, timing out
    11/3/10 8:23:11 AM loginwindow[44] in pam_sm_authenticate(): Failed to determine Kerberos principal name.
    11/3/10 9:12:57 AM loginwindow[44] in pam_sm_authenticate(): Failed to determine Kerberos principal name.
     
  5. SkyNite macrumors member

    Joined:
    Sep 21, 2010
    #5
    Wirelessly posted (Mozilla/5.0 (iPod; U; CPU iPhone OS 4_1 like Mac OS X; en-us) AppleWebKit/532.9 (KHTML, like Gecko) Version/4.0.5 Mobile/8B117 Safari/6531.22.7)

    One of those console entries suggests directory damage (orphaned/unlinked files) which could be minor, but I would again recommend running DiskWarrior, which IMHO should be in everyone's toolkit.

    I would also suggest using Disk Utility to repair permissions and to check the disk for errors, if you haven't yet done that.
     
  6. cutterman macrumors regular

    Joined:
    Apr 27, 2010
    #6
    There are several "journal replay" entries, consistent with your observations. Your hard disk may be failing.

    I would back up your data immediately before running disk scanning programs. This stress of a scan could damage the drive further and make your data irretrievable.
     
  7. SkyNite macrumors member

    Joined:
    Sep 21, 2010
    #7
    Agreed; I thought the OP had a current backup and just turned off Time Machine recently. But on re-reading the post I am not so sure the OP's backup is current. So get those files backed up ASAP and then run the diagnostics.

    Your files reverting to previous versions made me suspect journal replaying was involved, and it looks like your machine thinks it crashed or otherwise had an abnormal shutdown prior to the 6 a.m. entries.

    Was your previous shutdown a normal software shutdown? If not, this can corrupt the directory and makes it more likely to be directory damage rather than hardware failure. But just in case, get those files backed up, then run Diskwarrior.
     
  8. tengo84 thread starter macrumors newbie

    Joined:
    Aug 2, 2010
    Location:
    Chicago
    #8
    Thanks for the replies.

    I do have backups. I just disabled Time Machine until a dedicated backup drive arrived. I don't fully understand Time Machine yet so I was relying more on old-fashioned manual backups.

    I rarely shut down my machine. My previous shutdown was related to the firmware update a few days ago, which completed normally. Now that I think about it, I believe this rollback has happened once before, maybe a month ago. I was puzzled about some old browser windows re-opening which I was sure I had closed.

    I just ran Disk Utility from a separate drive. "Repair Disk" found no issues on the primary (SSD) drive. "Repair Permissions" fixed three errors. No problems were found on the 2nd drive.

    Before I shell out for Disk Warrior, are there any other thoughts based on this update? Should I shut down my machine a few times and see if anything strange happens? Thanks.
     
  9. SkyNite macrumors member

    Joined:
    Sep 21, 2010
    #9
    Since you're backed up, sure. Check the console after each restart to see if the OS replays the journal again or reports an abnormal shutdown. If so -- and if the disk continues to check out clean, it could be a damaged installation of Mac OS X or you might have gotten a bad SSD that intermittently fails. Have you tried shutting down and re-seating the SSD's connector?

    As for DiskWarrior, most agree that it's an indispensable tool. I'd get it even if you eventually solve this issue. I run it every month or so as a preventative measure on all my disks, and it often finds minor damage that Disk Utility misses and sometimes major issues. Most of my consulting clients use it, too.
     

Share This Page