3

I just upgraded my Mac mini (Late 2012) to macOS 10.12 (Sierra) and noticed something strange: When running the last command in the Terminal—which shows you a history of user logins, reboots and shutdowns—seemingly all of the entries are now indicating “crash” when I can assure you this system has never crashed since the upgrade.

Here is the output of last on my system:

my_mac:~ jake$ last 
jake      ttys001                   Sat Sep 24 09:05   still logged in
jake      ttys000                   Sat Sep 24 09:05   still logged in
jake      console                   Sat Sep 24 09:01   still logged in
reboot    ~                         Sat Sep 24 09:00 
jake      ttys000                   Sat Sep 24 09:00 - crash  (00:00)
jake      ttys000                   Sat Sep 24 01:19 - crash  (07:41)
jake      ttys000                   Sat Sep 24 00:13 - crash  (08:47)
jake      ttys000                   Fri Sep 23 23:45 - crash  (09:15)
jake      console                   Fri Sep 23 22:45 - crash  (10:15)
reboot    ~                         Fri Sep 23 22:44 
jake      ttys000                   Fri Sep 23 07:35 - crash  (15:08)
jake      ttys000                   Fri Sep 23 07:31 - crash  (15:12)
jake      console                   Fri Sep 23 07:00 - crash  (15:43)
reboot    ~                         Fri Sep 23 06:59 
jake      ttys000                   Thu Sep 22 22:56 - crash  (08:03)
jake      ttys000                   Thu Sep 22 22:03 - crash  (08:56)
jake      ttys000                   Thu Sep 22 21:21 - crash  (09:38)
jake      ttys001                   Thu Sep 22 21:18 - crash  (09:41)
jake      ttys000                   Thu Sep 22 21:16 - crash  (09:42)
jake      ttys000                   Thu Sep 22 19:59 - crash  (10:59)
jake      ttys000                   Thu Sep 22 19:23 - crash  (11:36)
_mbsetupuser  console                   Thu Sep 22 08:35 - crash  (22:24)
jake      console                   Thu Sep 22 08:26 - crash  (22:33)
reboot    ~                         Thu Sep 22 08:21 

Typically that output should reflect reboot for a cold boot or even a warm reboot. That data can be gleaned now by running last reboot as shown here:

my_mac:~ jack$ last reboot
reboot    ~                         Sat Sep 24 09:00 
reboot    ~                         Fri Sep 23 22:44 
reboot    ~                         Fri Sep 23 06:59 
reboot    ~                         Thu Sep 22 08:21 

But it still seems odd/broken to me since I’m quote confident this behavior was not the case in Mac OS X 10.11 (El Capitan) or previous versions of Mac OS X since the main reason I use last like this is to casually keep track of the last times I shut down or restarted the system.

NOTE: Yes, that last man page I link to on the Apple website states that the entry is for Mac OS X 10.9 and is a “retired” document, the output of man last on my macOS 10.12 system is 100% the same.

  • Having the user session terminated by crash might just be a bug – nohillside Sep 27 '16 at 12:10
  • @patrix Possibly. But the issue is not the supposed “crash” stuff as much as why reboots and shutdowns don’t seem to show up anywhere. The tool is old and solid, but works. Wonder if there is something fundamental in macOS Sierra that has mucked things up? – JakeGould Sep 27 '16 at 22:28
  • The reboots show up, even in your last output above. It's "just" that the user sessions are terminated by "crash" instead of "shutdown" (or whatever was the reason before). If last hasn't changed it's probably macOS which writes the utmp records differently. – nohillside Sep 28 '16 at 6:40

You must log in to answer this question.

Browse other questions tagged .