4

As I asked in the title, how can I check if a Mac is rebooting after experiencing a power failure. It would be preferable to check this using terminal or some other script, as I would like to test this automatically in a script upon system startup.

Improve this question

2 Answers 2

Reset to default
6

You can check for the "Shutdown Cause" in the log.

  • 5 is a normal shutdown
  • 3 is pressing the power button
  • 0 is loss of power

In El Capitan and earlier:

cat /var/log/system.log | grep -i "shutdown cause"

In Sierra and newer:

log show --predicate "process == kernel" | grep -i "shutdown cause"

Or....just using awk to get the code:

log show --predicate "process == kernel" | awk '/shutdown cause/ {print $12}'

In Mojave and Catalina, you can issue the command to get a more fine grained approach to the log:

log show --predicate '(process = "kernel") && (eventMessage CONTAINS "shutdown cause")' --last 48h --style compact

This will process only the last 48 hours and output in a nice "compact" layout.

Improve this answer
9
  • I'm running High Sierra, when I run the command it returns "log: invalid predicate: [<OSLogEventProxy 0x7fbd9a50b1e0> valueForUndefinedKey:]: this class is not key value coding-compliant for the key kernel."
    – Matthew
    Commented Nov 24, 2017 at 2:38
  • Then do a more obvious test : remove the power, restore the power and see if it reboots. Results will be obvious....
    – Solar Mike
    Commented Nov 24, 2017 at 6:56
  • Try it without the `--predicate = "process == kernel"
    – Allan
    Commented Nov 24, 2017 at 11:01
  • I get "2017-11-07 17:57:15.707333-0800 0xa5 Default 0x0 0 0 kernel: (AppleSMC) Previous shutdown cause: 5" Is there a command/script I can use to just get the number out of the string?
    – Matthew
    Commented Nov 24, 2017 at 14:16
  • Try log show | awk '/shutdown cause/ {print $12}' That should just give you the number.
    – Allan
    Commented Nov 24, 2017 at 14:33
2

In High Sierra, 10.13.5 I used System Information (alt About this Mac) to examine the Power Management log, under Software/Logs.

This clearly showed I'd had a power cut at or shortly after 02:35:14 am. I originally spotted it when the clock on my microwave showed 00:00. Below you cans see the power off and reboot times.

2018-07-07 02:35:14 +0100 Assertions PID 39(UserEventAgent) Released BackgroundTask "com.apple.backupd-auto" 00:00:34 id:0x0xb00009108 [System: BGTask]

Time stamp Domain Message Duration Delay
========== ====== ======= ======== =====
UUID: (null) 2018-07-07 10:25:13 +0100 Start powerd process is started

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .