4

I was working, then I received a phone call and left my iMac for a while. macOS Sierra is actually running.

I came back about 30 minutes later and found my Mac was turned off.

Since there are no phantoms at home, I thought I forgot I turned it off, maybe absentmindedly (I'm quite sure I didn't, anyway).

The question is: is there any way to check HOW the iMac turned off? (crash, eletricity grid issue, manual, etc.)

I read the console data but I don't know exactly what to search for (apparently there's no crash).

Update: The last thing I see in system.log:

Jan  4 10:33:53 M-iMac com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.pid.IDECacheDeleteAppExtension.2237): Path not allowed in target domain: type = pid, path = /Applications/Xcode.app/Contents/SharedFrameworks/LLDB.framework/Versions/A/XPCServices/RootDebuggingXPCService.xpc error = 147: The specified service did not ship in the requestor's bundle, origin = /Applications/Xcode.app/Contents/PlugIns/IDECacheDeleteAppExtension.appex    
Jan  4 10:33:54 M-iMac com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.pid.IDECacheDeleteAppExtension.2237): Path not allowed in target domain: type = pid, path = /Applications/Xcode.app/Contents/Frameworks/DFRSupportKit.framework/Versions/A/XPCServices/IDETouchBarSimulatorService.xpc error = 147: The specified service did not ship in the requestor's bundle, origin = /Applications/Xcode.app/Contents/PlugIns/IDECacheDeleteAppExtension.appex
Jan  4 10:33:54 M-iMac com.apple.xpc.launchd[1] (com.apple.nowplayingtouchui): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.

Here I'm restarting (I suppose):

Jan  4 11:03:51 localhost bootlog[0]: BOOT_TIME 1483524231 0
| improve this question | |
  • In Terminal, issue the command syslog | grep -i "shutdown cause" and post the results to your question. – Allan Jan 4 '17 at 11:22
  • Not very useful, I suppose. I only get: "NOTE: Most system logs have moved to a new logging system. See log(1) for more information." – 3000 Jan 4 '17 at 11:25
  • Grrrr...I forgot that macOS switched to a new logging system and I don't have access to a Mac with Sierra to test out. You can however look in the Console for the System log. Search for the "shutdown cause" phrase. You can find the "system log" by clicking on "Show Log List" in the menu bar of Console. – Allan Jan 4 '17 at 11:30
1

There are other Questions on Ask Different regarding what the shutdown codes mean - e.g. Where to find shutdown causes errors list? [which links to a list maintained by one of the Ask Different senior members], but I went for the simplest, GUI-based way of finding the data, rather than using terminal.

[I need to know if this still work on Sierra, as comments suggest the data location may now be different]
This is from El Capitan.

Launch Console from Applications/Utilities
On the left, select 'All Messages' then top right in the search box, type 'shutdown'

enter image description here

Note that a Restart does not appear to generate any shutdown message.

| improve this answer | |
  • I must say my console GUI (in Sierra) is a bit different. Anyway, I coud not find any shutdown. The only thing's quite clear is that nothing is reported for half an hour. – 3000 Jan 4 '17 at 11:42
  • I updated the body of the question – 3000 Jan 4 '17 at 11:47
  • You may need to log in as a user with administrator privileges in order to see all of the appropriate messages. Console selectively hides things from non-admins; but I'm not sure if the power down message is hidden or not. – Kent Jan 4 '17 at 11:53
  • I'm admin and root – 3000 Jan 4 '17 at 12:46
0

What happens if you enter the following in Terminal:

log show --style syslog --last 24h | egrep shutdown\ cause | awk -F')' '{print substr($0,1,19), $NF}'

Note: The above will display any shutdown causes for the past 24hrs. If you need it to go back further, edit the 24h value.

For example, to interrogate the past 36hrs you would change the 24h to 36h so that you're entering:

log show --style syslog --last 36h | egrep shutdown\ cause | awk -F')' '{print substr($0,1,19), $NF}'

Let me know how you go.

| improve this answer | |
  • -bash: log: command not found ?? Is that Sierra only? I'm still on el cap – Tetsujin Jan 4 '17 at 12:36
  • This is what I get: 2017-01-04 08:09:24 Previous shutdown cause: 0 2017-01-04 11:04:39 Previous shutdown cause: 0 Probably the shutdown I'm looling for is the one at 11:04 (when I rebooted) – 3000 Jan 4 '17 at 12:45
  • Now, if 0 is a "power supply" issue, it is very strange because the first of the two shutdowns has been "manual" – 3000 Jan 4 '17 at 12:50
  • @Tetsujin I haven't Installed Sierra on any of my machines, but I do have this command listed in my "toolbox" (so to speak), confirmed as working on Sierra 10.12.1 in mid-November. I keep meticulous records (even if I do say so myself) and was very confident this would give the OP what they wanted. :) – Monomeeth♦ Jan 4 '17 at 13:11
  • @3000 The 0 shutdown code is a little ambiguous because it can be caused by either a hardware cause or directly by the user. More specifically, it means a sudden loss of power which is either caused by a hardware failure or user action (of course a power failure such as a blackout would result in a 0 shutdown code too). Now you see my point about it being ambiguous. Since you state you left your iMac for about a half hour, perhaps there was a blackout (or even brownout) in that time? Unless you notice this behaviour repeatedly, I wouldn't assume it's a hardware fault. – Monomeeth♦ Jan 4 '17 at 13:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .