1

**UPDATE: Log shows a normal boot up to login screen. Was confused because I was comparing it to a log of a firevault protected computer

BOOT LOGS SHOWN BELOW:

Mar 29 15:41:55 localhost bootlog[0]: BOOT_TIME 1434483715 0
Mar 29 15:42:23 localhost syslogd[40]: Configuration Notice:
ASL Module "com.apple.AccountPolicyHelper" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
Mar 29 15:42:23 localhost syslogd[40]: Configuration Notice:
ASL Module "com.apple.authd" sharing output destination "/var/log/asl" with ASL Module "com.apple.asl".
Output parameters from ASL Module "com.apple.asl" override any specified in ASL Module "com.apple.authd".
Mar 29 15:42:23 localhost syslogd[40]: Configuration Notice:
ASL Module "com.apple.authd" sharing output destination "/var/log/system.log" with ASL Module "com.apple.asl".
Output parameters from ASL Module "com.apple.asl" override any specified in ASL Module "com.apple.authd".
Mar 29 15:42:23 localhost syslogd[40]: Configuration Notice:
ASL Module "com.apple.authd" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
Mar 29 15:42:23 localhost syslogd[40]: Configuration Notice:
ASL Module "com.apple.awdd" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
Mar 29 15:42:23 localhost syslogd[40]: Configuration Notice:
ASL Module "com.apple.callhistory.asl.conf" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
Mar 29 15:42:23 localhost syslogd[40]: Configuration Notice:
ASL Module "com.apple.cloudd" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
Mar 29 15:42:23 localhost syslogd[40]: Configuration Notice:
ASL Module "com.apple.clouddocs" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
Mar 29 15:42:23 localhost syslogd[40]: Configuration Notice:
ASL Module "com.apple.commerce.asl" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
Mar 29 15:42:23 localhost syslogd[40]: Configuration Notice:
ASL Module "com.apple.CoreDuetAdmissionControl" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
Mar 29 15:42:23 localhost syslogd[40]: Configuration Notice:
ASL Module "com.apple.eventmonitor" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
Mar 29 15:42:23 localhost syslogd[40]: Configuration Notice:
ASL Module "com.apple.family.asl" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
Mar 29 15:42:23 localhost syslogd[40]: Configuration Notice:
ASL Module "com.apple.ical" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
Mar 29 15:42:23 localhost syslogd[40]: Configuration Notice:
ASL Module "com.apple.icloud.FindMyDevice" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
Mar 29 15:42:23 localhost syslogd[40]: Configuration Notice:
ASL Module "com.apple.install" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
Mar 29 15:42:23 localhost syslogd[40]: Configuration Notice:
ASL Module "com.apple.iokit.power" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
Mar 29 15:42:23 localhost syslogd[40]: Configuration Notice:
ASL Module "com.apple.mail" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
Mar 29 15:42:23 localhost syslogd[40]: Configuration Notice:
ASL Module "com.apple.MessageTracer" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
Mar 29 15:42:23 localhost syslogd[40]: Configuration Notice:
ASL Module "com.apple.networking.symptoms" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
Mar 29 15:42:26 --- last message repeated 1 time ---
Mar 29 15:42:23 localhost syslogd[40]: Configuration Notice:
ASL Module "com.apple.performance" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
Mar 29 15:42:23 localhost syslogd[40]: Configuration Notice:
ASL Module "com.apple.sandbox.telemetry" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
Mar 29 15:42:23 localhost syslogd[40]: Configuration Notice:
ASL Module "com.apple.secinitd" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
Mar 29 15:42:23 localhost syslogd[40]: Configuration Notice:
ASL Module "com.apple.securityd" claims selected messages.
Those messages may not appear in standard system log files or in the ASL database.
Mar 29 15:42:26 --- last message repeated 6 times ---
Mar 29 15:42:23 localhost kernel[0]: Longterm timer threshold: 1000 ms
Mar 29 15:42:23 localhost kernel[0]: Darwin Kernel Version 14.3.0: Mon Mar 23 11:59:05 PDT 2015; root:xnu-2782.20.48~5/RELEASE_X86_64
Mar 29 15:42:23 localhost kernel[0]: vm_page_bootstrap: 879991 free pages and 94857 wired pages
Mar 29 15:42:23 localhost kernel[0]: kext submap [0xffffff7f80a00000 - 0xffffff8000000000], kernel text [0xffffff8000200000 - 0xffffff8000a00000]
Mar 29 15:42:23 localhost kernel[0]: zone leak detection enabled
Mar 29 15:42:23 localhost kernel[0]: "vm_compressor_mode" is 4
Mar 29 15:42:23 localhost kernel[0]: multiq scheduler config: deep-drain 0, urgent first 1, depth limit 4, band limit 127, sanity check 0
Mar 29 15:42:23 localhost kernel[0]: standard timeslicing quantum is 10000 us
Mar 29 15:42:23 localhost kernel[0]: standard background quantum is 2500 us
Mar 29 15:42:23 localhost kernel[0]: mig_table_max_displ = 13
Mar 29 15:42:23 localhost kernel[0]: AppleACPICPU: ProcessorId=0 LocalApicId=0 Enabled
Mar 29 15:42:23 localhost kernel[0]: AppleACPICPU: ProcessorId=1 LocalApicId=1 Enabled
Mar 29 15:42:23 localhost kernel[0]: calling mpo_policy_init for TMSafetyNet
Mar 29 15:42:23 localhost kernel[0]: Security policy loaded: Safety net for Time Machine (TMSafetyNet)
Mar 29 15:42:23 localhost kernel[0]: calling mpo_policy_init for AMFI
Mar 29 15:42:23 localhost kernel[0]: Security policy loaded: Apple Mobile File Integrity (AMFI)
Mar 29 15:42:23 localhost kernel[0]: calling mpo_policy_init for Sandbox
Mar 29 15:42:23 localhost kernel[0]: Security policy loaded: Seatbelt sandbox policy (Sandbox)
Mar 29 15:42:23 localhost kernel[0]: calling mpo_policy_init for Quarantine
Mar 29 15:42:23 localhost kernel[0]: Security policy loaded: Quarantine policy (Quarantine)
Mar 29 15:42:23 localhost kernel[0]: Copyright (c) 1982, 1986, 1989, 1991, 1993
Mar 29 15:42:23 localhost kernel[0]: The Regents of the University of California. All rights reserved.
Mar 29 15:42:23 localhost kernel[0]: MAC Framework successfully initialized
Mar 29 15:42:23 localhost kernel[0]: using 16384 buffer headers and 10240 cluster IO buffer headers
Mar 29 15:42:08 localhost com.apple.xpc.launchd[1] (com.oracle.java.Helper-Tool): Unknown key for string: SHAuthorizationRight
Mar 29 15:42:23 localhost kernel[0]: AppleKeyStore starting (BUILT: Mar 23 2015 11:37:46)
Mar 29 15:42:23 localhost kernel[0]: IOAPIC: Version 0x11 Vectors 64:87
Mar 29 15:42:23 localhost kernel[0]: ACPI: sleep states S3 S4 S5
Mar 29 15:42:23 localhost kernel[0]: pci (build 11:38:56 Mar 23 2015), flags 0xe3000, pfm64 (36 cpu) 0xf80000000, 0x80000000
Mar 29 15:42:23 localhost kernel[0]: AppleIntelCPUPowerManagement: (built 11:31:44 Mar 23 2015) initialization complete
Mar 29 15:42:23 localhost kernel[0]: [ PCI configuration begin ]
Mar 29 15:42:23 localhost kernel[0]: console relocated to 0xf80010000
Mar 29 15:42:23 localhost kernel[0]: [ PCI configuration end, bridges 6, devices 18 ]
Mar 29 15:42:23 localhost kernel[0]: NVEthernet::start - Built Mar 23 2015 11:36:34
Mar 29 15:42:23 localhost kernel[0]: FireWire (OHCI) Lucent ID 5901 built-in now active, GUID 00264afffe0761ee; max speed s800.
Mar 29 15:42:23 localhost kernel[0]: USBMSC Identifier (non-unique): 000000009833 0x5ac 0x8403 0x9833, 2
Mar 29 15:42:23 localhost kernel[0]: mcache: 2 CPU(s), 64 bytes CPU cache line size
Mar 29 15:42:23 localhost kernel[0]: Waiting on <dict ID="0"><key>IOProviderClass</key><string ID="1">IOResources</string><key>IOResourceMatch</key><string ID="2">boot-uuid-media</string></dict>
Mar 29 15:42:23 localhost kernel[0]: com.apple.AppleFSCompressionTypeZlib kmod start
Mar 29 15:42:23 localhost kernel[0]: com.apple.AppleFSCompressionTypeDataless kmod start
Mar 29 15:42:23 localhost kernel[0]: com.apple.AppleFSCompressionTypeZlib load succeeded
Mar 29 15:42:23 localhost kernel[0]: com.apple.AppleFSCompressionTypeDataless load succeeded
Mar 29 15:42:23 localhost kernel[0]: AppleIntelCPUPowerManagementClient: ready
Mar 29 15:42:23 localhost kernel[0]: BTCOEXIST off 
Mar 29 15:42:23 localhost kernel[0]: BRCM tunables:
Mar 29 15:42:23 localhost kernel[0]: pullmode[1] txringsize[  256] txsendqsize[1024] reapmin[   32] reapcount[  128]
Mar 29 15:42:23 localhost kernel[0]: Got boot device = IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/SATA@B/AppleMCP79AHCI/PRT0@0/IOAHCIDevice@0/AppleAHCIDiskDriver/IOAHCIBlockStorageDevice/IOBlockStorageDriver/FUJITSU MJA2250BH FFS G1 Media/IOGUIDPartitionScheme/Customer@2
Mar 29 15:42:23 localhost kernel[0]: BSD root: disk0s2, major 1, minor 2
Mar 29 15:42:23 localhost kernel[0]: hfs: mounted Macintosh HD on device root_device
Mar 29 15:42:23 localhost kernel[0]: VM Swap Subsystem is ON
Mar 29 15:42:08 localhost com.apple.xpc.launchd[1] (org.macosforge.xquartz.privileged_startx): The TimeOut key is no longer respected. It never did anything anyway.
Mar 29 15:42:08 localhost com.apple.xpc.launchd[1] (com.apple.alf): The HideUntilCheckIn property is an architectural performance issue. Please transition away from it.
Mar 29 15:42:08 localhost com.apple.xpc.launchd[1] (com.apple.audio.coreaudiod): Unknown key for array: seatbelt-profiles
Mar 29 15:42:08 localhost com.apple.xpc.launchd[1] (com.apple.auditd): The TimeOut key is no longer respected. It never did anything anyway.
Mar 29 15:42:22 localhost hidd[93]: void __IOHIDPlugInLoadBundles(): Loaded 0 HID plugins
Mar 29 15:42:22 localhost watchdogd[54]:  [watchdog_daemon] @(    wd_watchdog_open) - IOIteratorNext failed (kr=0)
Mar 29 15:42:22 localhost watchdogd[54]:  [watchdog_daemon] @(      wd_daemon_init) - could not initialize the hardware watchdog
Mar 29 15:42:08 localhost com.apple.xpc.launchd[1] (com.apple.autofsd): This service is defined to be constantly running and is inherently inefficient.
Mar 29 15:42:22 localhost watchdogd[54]:  [watchdog_daemon] @(                main) - cannot initialize the watchdog service
Mar 29 15:42:22 localhost hidd[93]: IOHIDService compatibility thread running at priority 63 and schedule 2.
Mar 29 15:42:08 localhost com.apple.xpc.launchd[1] (com.apple.backupd-status): The HideUntilCheckIn property is an architectural performance issue. Please transition away from it.
Mar 29 15:42:22 localhost iconservicesagent[61]: iconservicesagent launched.
Mar 29 15:42:08 localhost com.apple.xpc.launchd[1] (com.apple.backupd.status.xpc): The HideUntilCheckIn property is an architectural performance issue. Please transition away from it.
Mar 29 15:42:08 localhost com.apple.xpc.launchd[1] (com.apple.bsd.dirhelper): The TimeOut key is no longer respected. It never did anything anyway.
Mar 29 15:42:08 localhost com.apple.xpc.launchd[1] (com.apple.cmio.AVCAssistant): ThrottleInterval set to zero. You're not that important. Ignoring.
Mar 29 15:42:22 localhost watchdogd[99]:  [watchdog_daemon] @(    wd_watchdog_open) - IOIteratorNext failed (kr=0)
Mar 29 15:42:23 localhost watchdogd[99]:  [watchdog_daemon] @(      wd_daemon_init) - could not initialize the hardware watchdog
Mar 29 15:42:23 localhost watchdogd[99]:  [watchdog_daemon] @(                main) - cannot initialize the watchdog service
Mar 29 15:42:22 localhost com.apple.SecurityServer[76]: Session 100000 created
Mar 29 15:42:08 localhost com.apple.xpc.launchd[1] (com.apple.cmio.IIDCVideoAssistant): ThrottleInterval set to zero. You're not that important. Ignoring.
Mar 29 15:42:08 localhost com.apple.xpc.launchd[1] (com.apple.cmio.VDCAssistant): ThrottleInterval set to zero. You're not that important. Ignoring.
Mar 29 15:42:08 localhost com.apple.xpc.launchd[1] (com.apple.configd): This service is defined to be constantly running and is inherently inefficient.
Mar 29 15:42:08 localhost com.apple.xpc.launchd[1] (com.apple.CoreRAID): The HideUntilCheckIn property is an architectural performance issue. Please transition away from it.
Mar 29 15:42:08 localhost com.apple.xpc.launchd[1] (com.apple.CoreRAID): The ServiceIPC key is no longer respected. Please remove it.
Mar 29 15:42:08 localhost com.apple.xpc.launchd[1] (com.apple.installd): This key does not do anything: OnDemand
Mar 29 15:42:23 localhost com.apple.xpc.launchd[1] (com.apple.watchdogd): Service only ran for 1 seconds. Pushing respawn out by 9 seconds.
Mar 29 15:42:23 localhost kernel[0]: IO80211Controller::dataLinkLayerAttachComplete():  adding AppleEFINVRAM notification
Mar 29 15:42:23 localhost kernel[0]: IO80211Interface::efiNVRAMPublished():  
Mar 29 15:42:23 localhost kernel[0]: bpfAttach len 64 dlt 12
Mar 29 15:42:22 localhost wirelessproxd[70]: updateScanner - central is not powered on: 0
Mar 29 15:42:23 localhost iconservicesagent[61]: Starting service with cache path: /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/com.apple.iconservices
Mar 29 15:42:25 localhost com.apple.xpc.launchd[1] (com.avast.daemon): This service is defined to be constantly running and is inherently inefficient.
Mar 29 15:42:25 localhost syslog[147]: ChmodBPF: Forcing creation and setting permissions for /dev/bpf*
Mar 29 15:42:25 localhost powerd[50]: Activity changes from 0xffff to 0x0. Assertions:1 HidState:0
Mar 29 15:42:25 localhost com.apple.SecurityServer[76]: Entering service
Mar 29 15:42:26 localhost kernel[0]: IOGraphics flags 0x43
Mar 29 15:42:26 localhost kernel[0]: IOBluetoothUSBDFU::probe
Mar 29 15:42:26 localhost kernel[0]: IOBluetoothUSBDFU::probe ProductID - 0x8213 FirmwareVersion - 0x0208
Mar 29 15:42:26 localhost kernel[0]: **** [IOBluetoothHostControllerUSBTransport][start] -- completed -- result = TRUE -- 0x5000 ****
Mar 29 15:42:26 localhost kernel[0]: **** [BroadcomBluetoothHostControllerUSBTransport][start] -- Completed (matched on Device) -- 0x5000 ****
Mar 29 15:42:26 localhost kernel[0]: NVDAStartup: Official
Mar 29 15:42:26 localhost kernel[0]: NVDANV50HAL loaded and registered
Mar 29 15:42:26 localhost kernel[0]: [IOBluetoothHCIController][staticBluetoothTransportShowsUp] -- Received Bluetooth Controller register service notification -- 0x5000 
Mar 29 15:42:26 localhost kernel[0]: [IOBluetoothHCIController][start] -- completed
Mar 29 15:42:26 localhost kernel[0]: [IOBluetoothHCIController::setConfigState] calling registerService
Mar 29 15:42:26 localhost kernel[0]: **** [IOBluetoothHCIController][ProcessBluetoothTransportShowsUpActionWL] -- Connected to the transport successfully -- 0xfb00 -- 0x1800 -- 0x5000 ****
Mar 29 15:42:26 localhost opendirectoryd[69]: BUG in libdispatch: 14D136 - 2004 - 0x5
Mar 29 15:42:26 localhost distnoted[97]: # distnote server daemon  absolute time: 32.520141728   civil time: Tue     Mar 29 15:42:26 2015   pid: 97 uid: 241  root: yes
Mar 29 15:42:26 localhost hidd[93]: ____IOHIDSessionScheduleAsync_block_invoke: thread_id=0x105e76000
Mar 29 15:42:26 localhost hidd[93]: HID Session async scheduling initiated.
Mar 29 15:42:26 localhost hidd[93]: HID Session async root queue running at priority 63 and schedule 2.
Mar 29 15:42:26 localhost hidd[93]: HID Session async scheduling complete.
Mar 29 15:42:26 localhost hidd[93]: Successfully opened the IOHIDSession
Mar 29 15:42:26 localhost thermald[46]: Waiting for OSTT support notification
Mar 29 15:42:26 localhost com.apple.usbmuxd[75]: usbmuxd-344.6 on Mar 16 2015 at 23:31:17, running 64 bit
Mar 29 15:42:26 localhost kernel[0]: Waiting for DSMOS...
Mar 29 15:42:26 localhost kernel[0]: Previous shutdown cause: 5
Mar 29 15:42:26 localhost kernel[0]: DSMOS has arrived
Mar 29 15:42:26 localhost loginwindow[89]: Login Window Application Started
Mar 29 15:42:26 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system): Service "com.apple.ManagedClient.startup" tried to hijack endpoint "com.apple.ManagedClient.agent" from owner: com.apple.ManagedClient
Mar 29 15:42:26 localhost digest-service[176]: label: default
Mar 29 15:42:26 localhost digest-service[176]:  dbname: od:/Local/Default
Mar 29 15:42:26 localhost digest-service[176]:  mkey_file: /var/db/krb5kdc/m-key
Mar 29 15:42:26 localhost digest-service[176]:  acl_file: /var/db/krb5kdc/kadmind.acl
Mar 29 15:42:26 localhost UserEventAgent[41]: Captive: CNPluginHandler en1: Inactive
9
  • 2
    it was probably your Avast virus scanner, a lousy piece of software (so intrusive)
    – Ruskes
    Jul 21 '15 at 2:15
  • Thanks for the response, what are you saying the Avast virus scanner did/affected? My question is asking if it looks like this computer was booted up by someone else who had it (not me) .... and if they got passed the login/password screen somehow or did anything. Thanks
    – catmac
    Jul 21 '15 at 2:19
  • 1
    That can not be answered from this log, it looks like normal log. You do have the Avast virus scanner that would make changes, and you also have the Wireshark that also does some changes.
    – Ruskes
    Jul 21 '15 at 2:23
  • Okay gotcha, this was the SYSTEM.LOG file. Do you know of any other log files that would be more helpful for determining this ?
    – catmac
    Jul 21 '15 at 2:25
  • 1
    You need the log from the time stamp when you suspect something, this one goes normally true the log in ect... What is not clear if someone had it, what kind of access did they have? (guest account ?)
    – Ruskes
    Jul 21 '15 at 2:28
0

Most of what you are looking for is recorded, the issue is finding the right log. This question (unix.stackexchange.com) is similar to yours and has a couple of good answers.

0
0

Seem like typical answers that others have heard in days gone by so they repeat them without a second thought and with zero evidence to support their conclusions which are just regurgitation.

I don't think full boot log messages are stored anywhere actually since they predate the dawn of your OS itself and would need to be stored in NVRAM or something similar then copied into the system's memory. Which is probably why you won't find the actual boot log from blah blah Property of The Regents of the University of California etc..

What you can do is using boot-args (like what safe mode is) to see what is going on. The best I can say to catch everything is use your phone's video camera of slow-mo to catch everything. Boot into Recovery Mode and open the Terminal under Utilities and type

nvram boot-args="debug=0x144e kextlog=0xffffffff -s -v -x"

You may wish to use a different debug= value, there's plenty of info out there as to what various values do. You can adjust the f's after kextlog between 1 and 8 total to increase or decrease verbosity of what's noted during booting 0xffffffff (8 f's) is the most verbose, -s for single user, -v for verbose mode, -x for safe boot. Remove -x -s if you'd like but it's best to leave -x in there for the full effect. Boot back into Recovery Mode and type nvram boot-args= to clear out these settings and return to normal.

I do not recommend this for the faint of heart...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .