How can I find the reason for my Mac's recent “restart”?

Question

My Mac just "restarted" while I was looking away and I'd like to know if it was a crash or a postponed restart due to an update.

My Mac does sometimes crash and restart but hasn't done so for a couple of months.

I installed some OS updates in the past couple of days but chose not to restart yet.

Google Chrome was getting slow and had been displaying the green update arrow for a day or two. I clicked on the update button and wandered off to do something before it responded in any way.

When I turned back to the computer it seemed to be "restarting". I'm using the scare quotes because I don't think it was rebooting from scratch since I didn't see the Apple logo with progress bar, which can be a little slow on my system.

I verified that it had restarted by switching to the Terminal app which showed the Restored text with a timestamp from about a minute ago.

When I check when the last reboot was using uptime or System Information it tells me 32 days.

The App Store is telling me that I still need to restart to complete updates.

---

So how can I check why it just "restarted"? I want to know if my crashing problem came back after such a long time of stability, if asking Chrome to update somehow allowed the other pending upgrades to restart the OS, or if it was some other reason.

Answer 1

I use Terminal a lot, so my answer will include commands used in that application. I know Console provides details, but I rarely see it as more than a GUI to access the logs. Terminal can be found in the Utilities folder which is found in the Applications folder.

On newer macOS (macOS 10.12 and later) with the unified logging system, the processing of the text files doesn't show the whole story, so use the log show command below:

log show --predicate 'eventMessage contains "Previous shutdown cause"' --last 24h

Of course, expand the time if your restart happened more than 24 hours in the past.

After a while, you should see a message which contains a number indicating a reason. To find the meaning of that number, you can use this site: https://georgegarside.com/blog/macos/shutdown-causes/. For example, my last shutdown cause was "-128" which, unfortunately, is "unknown".

On older systems, you should be able to find the text "Previous shutdown cause" in your system log. You can find this by using this command (which you can copy/paste into terminal):

grep "Previous shutdown cause" /var/log/system.log

Answer 2

If there is going to be a message somewhere about a restart, crash or the like it will be found in console.app.

Console.app is your one-stop shop for all of the Unix logs that macOS generates and that most people will never look at or understand. You can find it in /Applications/Utilities.

It usually opens up with a view of the logs from the entire machine (top left pane of the window). You can drill down and see logs generated by specific subsystems, apps and manufacturers.

Though I occasionally have a peek at the logs in console.app I find that a lot of what is displayed is confusing and/or just "noise." However you may find a system message in there that might point to why your system restarted.