Spontaneous random logouts -- help troubleshooting

[rogersmj]

I have a 2011 27" iMac running OS X 10.8 that within the last few weeks has started suffering spontaneous logouts. Before I start ripping things apart or reloading the OS, I was wondering if anyone here has any troubleshooting tips.

The logouts do seem truly random. Most of the time, they seem to happen when I'm away from the computer. However, a few have happened while I'm at the computer, actively using it. I'll be using an application (in one case Aperture, or a couple times trying to play the new (terrible) SimCity) and -- without any warning at all, no beachball, no lockup, nothing -- I'm suddenly back at the OS X login screen. It happens amazingly fast.

I modified this iMac when I first bought it 2 years ago to use a 128GB SSD as my primary drive. I kept the 1TB drive it shipped with as a secondary drive that holds most of my files. I do have Time Machine backups of the whole thing.

What does this behavior indicate to you? It sort of seems like it might be a hardware failure of some kind, but I'm not sure how to begin troubleshooting. I have a newborn so my time for tinkering is limited -- which is why I'm appealing to you all for a head start

 

[chown33]

Apple Hardware Test:
http://support.apple.com/kb/ht1509

 

[benwiggy]

Look at the log messages in the Console utility, and see if anything there is relevant.

 

[rogersmj]

Look at the log messages in the Console utility, and see if anything there is relevant.

I'm not an expert at deciphering what I see here, but there are a few interesting things:

1. Huge amounts of unsuccessful SSH login attempts from a specific IP. Looks like I need to block that at my firewall.
2. Since I don't know when exactly the machine logs out, unless it happens while I'm in front of it (rare), it's hard to find the right spot in the log -- but from what I can tell, shortly before the login screen last appeared, a process called WindowServer crashed. I found the specific log file for that event, and have attached it (I can't make sense of it). Looking at when each crash of WindowServer has occurred, I can't be sure yet but it *seems* to correlate with the times I've experienced logouts.

I will attempt the hardware diagnostic soon.

 

[benwiggy]

WindowServer is, unsurprisingly, the process in charge of windows. So it's a fairly low-level bit of the OS that doesn't normally crash in this way.

There doesn't seem to be any third-party software causing conflicts, so hardware does seem a possibility, unless your OS system files have become corrupted through some disk problem.

 

[rogersmj]

The hardware test yielded nothing. All passed.

I was just in the room when it did it again, and I noticed the 1TB hard drive did a "reset" -- it made the click and whirr noise of a HDD's startup sequence right when the machine got logged out. I don't know if that might be a cause (HD failure) or an effect (whatever's causing the crash is also doing something that causes the HDD to cycle). Even if that HDD was failing, I'd be surprised if it could cause a low-level OS process to crash, because the OS isn't running on that drive -- it's on the SSD. The spinning drive just has some of my personal files.

 

[benwiggy]

Verify your internal drive.

And you might like to post the log entries for the logout time.

 

[rogersmj]

Both internal drives verified OK.

I believe I have fixed the problem with a complete wipe and reload of my OS drive. A simple reinstall on top of OS X in place did not work, but I wiped it and have been manually rebuilding (not restoring apps/settings from a Time Machine backup) and have gone two days without a crash. <knocks on wood>

Strange and scary that something may have gotten installed on my machine that could crash OS X like that. I still have no idea what it might have been. Since I'm rebuilding and only reinstalling apps as I need them, I'm paying close attention and hopefully will have a suspect if it starts happening again.