How to find cause of repeated reboots?

Question

I have been having issues with my mid-2009 Mac Pro ever since I installed Mountain Lion. First it was intermittent kernel panics; I did some research and found that this is an ML bug that's triggered by having multiple Nvidia GeForce 120 video cards. Nothing I can do about that but wait for Apple to fix it.

Then I started coming to my desk in the morning to find the computer shut down. I could tell from the logs that it happened around 6:00 am, but I could not tell why - the messages just before the crash were different every time, and usually were not error messages.

The only thing I know of that runs in the wee hours of the morning is my SuperDuper! backups, so I commented all of those out in crontab. I thought that had fixed it, but this morning I realized that actually what that did was change it from a shutdown to a reboot. "last" shows this:

janine    ttys004                   Mon Apr  8 05:53 - 11:20  (05:26)
janine    ttys003                   Mon Apr  8 05:53 - 11:20  (05:26)
janine    ttys002                   Mon Apr  8 05:53 - 11:20  (05:26)
janine    ttys001                   Mon Apr  8 05:53 - 11:20  (05:26)
janine    ttys000                   Mon Apr  8 05:53 - 11:20  (05:26)
janine    console                   Mon Apr  8 05:52 - 11:20  (05:27)
reboot    ~                         Mon Apr  8 05:52 
janine    ttys004                   Sat Apr  6 06:22 - crash (1+23:30)
janine    ttys003                   Sat Apr  6 06:22 - crash (1+23:30)
janine    ttys001                   Sat Apr  6 06:22 - crash (1+23:30)
janine    ttys002                   Sat Apr  6 06:22 - crash (1+23:30)
janine    ttys000                   Sat Apr  6 06:22 - crash (1+23:30)
janine    console                   Sat Apr  6 06:20 - crash (1+23:32)
reboot    ~                         Sat Apr  6 06:19 

The crashes due to the video cards cause Kernel.panic files to be written to /Library/Logs/DiagnosticReports, but these reboots don't leave any trace behind other than the above.

There is nothing running from crontab now. The only things I can think of that run automagically are Dropbox sync, Backblaze and Time Machine, but those run several times a day, and it seems unlikely that they would only cause a reboot at a specific time of day.

I tried to run the Apple Hardware Test but was unsuccessful. Holding down D while the computer boots does nothing, and neither does option-D. I even switched from wireless to an Ethernet cable and running the test from the Internet still did not work (by which I mean the system just boots normally, with a slight delay which is presumably when it's looking for the test). I do have a wired keyboard so it should be getting the keystroke at the appropriate time.

What else can I do to track this down?

Answer 1

You can look up what is going on at the specific time by using Console.

Utility/Console

Also look up under the tab Diagnostic and Usage messages.

Answer 2

crontab is legacy unix and is not the preferred facility for running scheduled tasks. This means you are not seeing all the background daemons that actually being run in your system. So you have a lot more checking to do. Below I give a brief description OS X's preferred facility for running scheduled tasks.

In OS X scheduled tasks are managed by launchd. There are two types of launchd tasks: LaunchDaemons and LaunchAgents. Both LaunchDaemons and LaunchAgents are configured in .plist files. You use the launchctl command to install, uninstall, start, stop, etc daemons and agents. Read the man pages for for both launchd and launchctl for info on how to use these tools.

LaunchDaemons start running at system boot. They are system-global in that they are user-independent. They are stored in /System/Library/LaunchDaemons/, and /Library/LaunchDaemons/.

LaunchAgents start running at user login. They come in two flavors: system-global and per-user. They are stored in /System/Library/LaunchAgents/, /Library/LaunchAgents/ and ~/Library/LaunchAgents/.

EDIT

In the .plist file defining a daemon or agent there's more than one way to specify the time at which the daemon/agent should run. Your question suggests the culprit starts at ~6:00 AM. You will likely want to check the StartCalendarInterval property in each .plist file. Read the man page for launchd.plist to learn more about scheduling daemons/agents.

Answer 3

I looked at the many things being launched and was overwhelmed. But eventually I narrowed it down to something that runs while I'm logged in, and that led me to look at my login items. Somehow a bunch of them got duplicated. I cleaned up the list, and the reboots stopped. This doesn't make a whole lot of sense to me, but I'm thankful to have it solved.