El Capitan froze and rebooted (Macbook Pro Retina Mid 2012)

Question

• 2.3 Ghz Intel Core i7 8GB DDR3: Was running NetAdmin Pro which is monitoring my office LAN, processors consumption was at ~15 - 20%. Simultaneously I ran WiFI Explorer, 3.7% no more than 5% CPU usage. And I was updating Xcode to v 7.3.1 and was browsing and watching video from playground.ru

• Watch the videos until half of it (20mins) the Video froze I moved the mouse and turned out the whole OSX is frozen.

• littleSnitch v 3.7 has no reaction

• I immediately pull the Ethernet adaptor and MacBook just went to black screen. I then switch off the wireless router. (My MacBook Pro is connected to the network via Ethernet adaptor and via WiFi router bearing different IP, I was thinking of cutting both network communication, in case it was an intrusion)

• MacBook just restarted itself to login screen, after 15-20 sec of black screen and total silence)

• I again restarted and booted into Recovery mode use disk utility. After completing disk check.

• Login and previously opened programs resume back (NetAdmin Pro, WiFi Explorer, Yandex browser, Activity Monitor and AppStore)

• AppStore doesn't resume the download everything else is functioning normally and in Addition I have got my calendar open after login (I did not launch accidental nor was it set to start with system login)

Question 1: Are there any way to know what was happening and what was OS El Capitan last reaction before it froze and rebooted?

Question 2: Are there any software better than "Console" v10.11 to interpret what was going on before it crashes?

P.S. Thank you in advance, I will try to upload the Console messages later from the MacBook Pro

---

DDT-2:~ Chaleune$ syslog | grep -i "shutdown cause"

Jun 22 14:15:37 DDT-2 kernel[0] <Notice>: Previous shutdown cause: 5

Jun 22 20:34:46 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 23 15:18:23 DDT-2 kernel[0] <Notice>: Previous shutdown cause: 5

Jun 24 17:58:32 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 24 20:09:52 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 24 22:58:15 localhost kernel[0] <Notice>: Previous shutdown cause: 5Jun 25 14:43:36 DDT-2 kernel[0] <Notice>: Previous shutdown cause: 5

Jun 25 21:55:31 localhost kernel[0] <Notice>: Previous shutdown cause: 3

Jun 25 22:20:57 localhost kernel[0] <Notice>: Kext com.apple.driver.AppleOSXWatchdog failed to load (0xdc008012).Previous shutdown cause: 5

Jun 26 10:18:44 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 26 12:09:45 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 26 18:00:31 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 27 13:05:58 DDT-2 kernel[0] <Notice>: Previous shutdown cause: 5

Jun 27 22:56:11 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 28 14:18:27 DDT-2 kernel[0] <Notice>: Previous shutdown cause: 5

*Jun 29 18:56:21 localhost kernel[0] <Notice>: Previous shutdown cause: -128*

Jun 29 23:31:22 DDT-2 kernel[0] <Notice>: Previous shutdown cause: -128

---

Opensource.apple shows the following

• dsIllInstErr = 3, /illegal instruction error/
• dsChkErr = 5, /check trap error/
• userCanceledErr = -128

macwizard gave the following interpretation:

• 03 Illegal Instruction The computer has a specific vocabulary of machine language instructions it can understand. If a computer tries to execute an instruction that isn't in its vocabulary, you see this error code. It's less likely than error 02, but still very common.
• 05 Range Check Error Programmers can use an instruction in the Motorola 68000 to check if a number is within a certain range. This error indicates that the number tested isn't in the specified range.
• -128 userCanceledErr User canceled an operation

Answer 1

Run a sysdisgnose. That is how Apple receives feedback from seeding/beta customers. The keyboard shortcut is Cmd Opt Ctrl Shift Period.

You can also run sudo sysdiagnose -f ~/Desktop/ in Terminal. The former will save to /var/tmp and the latter will save to the Desktop.

Sysdiagnose will contain pretty much A to Z.

You should be sure to check the disks.txt, diskutil.txt, errorlog.txt, logs.txt, and the diagnostics folder.

Answer 2

Shutdown cause numbers are different from Error Codes. For example, a shutdown cause of 0 means that your Mac lost power. An error code of 0 (in Bash, for example) means that the function or command exited normally with no error. Apple has this backward.

Using this case as an example, *Error code -128" in software means user canceled, while shutdown cause -128 is undefined.

So, in the output you provided, you have 3 error codes: 3, 5, and -128.

• cause 3 is a "dirty" shutdown meaning that something was force quit and/or the power button was held down to power off the system

• cause 5 is a clean exit and there is nothing to worry about

• cause 128 is "undefined." However, most of the time that I have run across this has been either memory or the logic board

  • Shutdown Cause -128
  • MBP Retina 15 inch, late 2013 shuts down randomly

The best way to diagnose this is to run Apple Hardware Test (AHT) with one of your memory modules removed (Mid-2012 and earlier. 2013 and newer models have modules that cannot be removed). Hold D while booting from a powered off state with the AC adapter plugged in. If your test comes out clean, shutdown, remove the module and replace it with the first one that you removed. Re-run AHT.

Answer 3

1. The combination of the model, video viewing(/discrete gpu usage) and the way it just respawned to the login screen makes me fairly certain it's a faulty GPU issue. Luckily there's a warranty extension repair program running until the end of the year, see http://www.apple.com/support/macbookpro-videoissues/

Check /Library/Logs/DiagnosticReports for .gpuRestart files to make sure.

2. Yes. brew install lnav and never look back.

Lastly, neither of the links you posted are about current shutdown causes, so just ignore them.