• 2.3 Ghz Intel Core i7 8GB DDR3: Was running NetAdmin Pro which is monitoring my office LAN, processors consumption was at ~15 - 20%. Simultaneously I ran WiFI Explorer, 3.7% no more than 5% CPU usage. And I was updating Xcode to v 7.3.1 and was browsing and watching video from playground.ru

  • Watch the videos until half of it (20mins) the Video froze I moved the mouse and turned out the whole OSX is frozen.

  • littleSnitch v 3.7 has no reaction

  • I immediately pull the Ethernet adaptor and MacBook just went to black screen. I then switch off the wireless router. (My MacBook Pro is connected to the network via Ethernet adaptor and via WiFi router bearing different IP, I was thinking of cutting both network communication, in case it was an intrusion)

  • MacBook just restarted itself to login screen, after 15-20 sec of black screen and total silence)

  • I again restarted and booted into Recovery mode use disk utility. After completing disk check.

  • Login and previously opened programs resume back (NetAdmin Pro, WiFi Explorer, Yandex browser, Activity Monitor and AppStore)

  • AppStore doesn't resume the download everything else is functioning normally and in Addition I have got my calendar open after login (I did not launch accidental nor was it set to start with system login)

Question 1: Are there any way to know what was happening and what was OS El Capitan last reaction before it froze and rebooted?

Question 2: Are there any software better than "Console" v10.11 to interpret what was going on before it crashes?

P.S. Thank you in advance, I will try to upload the Console messages later from the MacBook Pro

DDT-2:~ Chaleune$ syslog | grep -i "shutdown cause"

Jun 22 14:15:37 DDT-2 kernel[0] <Notice>: Previous shutdown cause: 5

Jun 22 20:34:46 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 23 15:18:23 DDT-2 kernel[0] <Notice>: Previous shutdown cause: 5

Jun 24 17:58:32 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 24 20:09:52 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 24 22:58:15 localhost kernel[0] <Notice>: Previous shutdown cause: 5Jun 25 14:43:36 DDT-2 kernel[0] <Notice>: Previous shutdown cause: 5

Jun 25 21:55:31 localhost kernel[0] <Notice>: Previous shutdown cause: 3

Jun 25 22:20:57 localhost kernel[0] <Notice>: Kext com.apple.driver.AppleOSXWatchdog failed to load (0xdc008012).Previous shutdown cause: 5

Jun 26 10:18:44 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 26 12:09:45 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 26 18:00:31 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 27 13:05:58 DDT-2 kernel[0] <Notice>: Previous shutdown cause: 5

Jun 27 22:56:11 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 28 14:18:27 DDT-2 kernel[0] <Notice>: Previous shutdown cause: 5

*Jun 29 18:56:21 localhost kernel[0] <Notice>: Previous shutdown cause: -128*

Jun 29 23:31:22 DDT-2 kernel[0] <Notice>: Previous shutdown cause: -128

Opensource.apple shows the following

  • dsIllInstErr = 3, /illegal instruction error/
  • dsChkErr = 5, /check trap error/
  • userCanceledErr = -128

macwizard gave the following interpretation:

  • 03 Illegal Instruction The computer has a specific vocabulary of machine language instructions it can understand. If a computer tries to execute an instruction that isn't in its vocabulary, you see this error code. It's less likely than error 02, but still very common.
  • 05 Range Check Error Programmers can use an instruction in the Motorola 68000 to check if a number is within a certain range. This error indicates that the number tested isn't in the specified range.
  • -128 userCanceledErr User canceled an operation
  • Find out what the shutdown cause was by issuing the command syslog | grep -i "shutdown cause" and post the results. You can also run Apple Hardware Test (AHT). Hold down "D" while booting from a powered off state with AC adapter connected.
    – Allan
    Jun 29, 2016 at 14:54
  • Jun 27 13:05:58 DDT-2 kernel Chaleune console Wed Jun 29 18:56 still logged in Chaleune console Mon Jun 27 22:56 - crash (1+20:00) Chaleune console Sun Jun 26 18:00 - 22:55 (1+04:54) Chaleune console Sun Jun 26 12:09 - 12:50 (00:40)
    – Kuma
    Jun 29, 2016 at 16:49
  • Apple answers is not satisfactory. I did not have overheat, my fan works normally. Beside that I have cause 5 and 3. After replying to your message I re-run the command and now have -128. And the incident was happening around 18:00 hrs Jun 29.
    – Kuma
    Jun 29, 2016 at 17:28
  • Opensource.apple shows the following - dsIllInstErr = 3, /*illegal instruction error*/ - dsChkErr = 5, /*check trap error*/ - userCanceledErr = -128
    – Kuma
    Jun 29, 2016 at 17:38
  • Shutdown codes are different that system errors. However, a -128 is unidentified, but most of the time it's related to memory. Pull out a module and run Apple Hardware Test. Hold down D while booting from power off state with AC connected.
    – Allan
    Jun 29, 2016 at 18:27

3 Answers 3


Run a sysdisgnose. That is how Apple receives feedback from seeding/beta customers. The keyboard shortcut is Cmd Opt Ctrl Shift Period.

You can also run sudo sysdiagnose -f ~/Desktop/ in Terminal. The former will save to /var/tmp and the latter will save to the Desktop.

Sysdiagnose will contain pretty much A to Z.

You should be sure to check the disks.txt, diskutil.txt, errorlog.txt, logs.txt, and the diagnostics folder.

  • while good advice, it's not an answer to the quesiton. It's the first step in diagnosing.
    – Allan
    Jun 29, 2016 at 14:55
  • @Allan correct me if I'm wrong but I'm pretty sure it answers question 2. And I think it's an implied answer to question 1 that if he reads the sys diagnose, there's a way to know what went wrong.
    – Bora
    Jun 29, 2016 at 14:57
  • So, what does he look for?
    – Allan
    Jun 29, 2016 at 14:59
  • @Allan answer edited. You're right. My bad.
    – Bora
    Jun 29, 2016 at 15:01
  • Thank you @BoraOztekin, well I did as you have suggested, but how do I learn how to read/interpret what 'sysdiagnose' generated. It's way way too much of information for me. I was just wanted to understand the causes of today incidents and hopefully I could prevent it or at least avoid and not try to repeat the same mistakes. I have save the logs from the Console and will update it to the question.
    – Kuma
    Jun 29, 2016 at 18:36

Shutdown cause numbers are different from Error Codes. For example, a shutdown cause of 0 means that your Mac lost power. An error code of 0 (in Bash, for example) means that the function or command exited normally with no error. Apple has this backward.

Using this case as an example, *Error code -128" in software means user canceled, while shutdown cause -128 is undefined.

So, in the output you provided, you have 3 error codes: 3, 5, and -128.

  • cause 3 is a "dirty" shutdown meaning that something was force quit and/or the power button was held down to power off the system

  • cause 5 is a clean exit and there is nothing to worry about

  • cause 128 is "undefined." However, most of the time that I have run across this has been either memory or the logic board

The best way to diagnose this is to run Apple Hardware Test (AHT) with one of your memory modules removed (Mid-2012 and earlier. 2013 and newer models have modules that cannot be removed). Hold D while booting from a powered off state with the AC adapter plugged in. If your test comes out clean, shutdown, remove the module and replace it with the first one that you removed. Re-run AHT.

  • rMBP has soldered memory, so can't exactly just take one of them out.
    – tolgraven
    Jun 29, 2016 at 22:41
  • I keep forgetting which year they went from modules to soldered RAM. Either way, -128 is usually RAM and the 2nd link I provided was the exact same case as yours
    – Allan
    Jun 29, 2016 at 22:58
  • MBP Retina Mid 2012, I did AHT with extended test, result was PASSED. Sorry I couldn't take out any memory modules as I don't have the tools. (Last time I happen to ask some dealer if they could upgrade my SSD drive, they said it soldered and can't be upgraded. So this happen with the RAM too?)
    – Kuma
    Jun 30, 2016 at 8:37
  • You will probably have to run AHT multiple times since this is an intermittent problem
    – Allan
    Jun 30, 2016 at 11:18
  1. The combination of the model, video viewing(/discrete gpu usage) and the way it just respawned to the login screen makes me fairly certain it's a faulty GPU issue. Luckily there's a warranty extension repair program running until the end of the year, see http://www.apple.com/support/macbookpro-videoissues/

Check /Library/Logs/DiagnosticReports for .gpuRestart files to make sure.

  1. Yes. brew install lnav and never look back.

Lastly, neither of the links you posted are about current shutdown causes, so just ignore them.

  • Would those who downvoted this mind explaining why? My faulty rMBP behaved exactly like this, a very significant proportion of first-gen rMBP's are suffering from this issue, and I explained how he can try to confirm this issue and get a free repair from Apple if it happens to be the case. I also answered his second question about a better syslog reader, and lnav is definitely just that.
    – tolgraven
    Jun 29, 2016 at 22:47
  • Thank you @tolgraven for your input, I haven't voted anyone anything yet, and I had like to have more clarification before I put all the causes to GPU. regarding "lnav" : ruby -e "$(curl -fsSL raw.githubusercontent.com/Homebrew/install/master/install)" < /dev/null 2> /dev/null curl: (7) Couldn't connect to server
    – Kuma
    Jun 30, 2016 at 8:56
  • Yeah, look into it and if it turns out to be plausible then Apple will still obviously do additional extended tests before replacing the logic board. re: brew I'm guessing you're still on your work network and it uses a proxy? Try adding --noproxy before "-fsSL" and see if it works, or just save the file using your browser and run it manually.
    – tolgraven
    Jun 30, 2016 at 10:03
  • Thank you for answering the 2nd question, I have got it running by downloading it (no installation). Now I was wondering if it could help me reads the saved *.logs, Kernel_2016-06-25-212600_DDT-2.gpuRestart, *.diag files that @Bora Oztekin suggested? (haven't have time to read the lnav.org yet, thanks in advance)
    – Kuma
    Jul 1, 2016 at 8:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .