24

My Mac just "restarted" while I was looking away and I'd like to know if it was a crash or a postponed restart due to an update.

My Mac does sometimes crash and restart but hasn't done so for a couple of months.

I installed some OS updates in the past couple of days but chose not to restart yet.

Google Chrome was getting slow and had been displaying the green update arrow for a day or two. I clicked on the update button and wandered off to do something before it responded in any way.

When I turned back to the computer it seemed to be "restarting". I'm using the scare quotes because I don't think it was rebooting from scratch since I didn't see the Apple logo with progress bar, which can be a little slow on my system.

I verified that it had restarted by switching to the Terminal app which showed the Restored text with a timestamp from about a minute ago.

When I check when the last reboot was using uptime or System Information it tells me 32 days.

The App Store is telling me that I still need to restart to complete updates.

So how can I check why it just "restarted"? I want to know if my crashing problem came back after such a long time of stability, if asking Chrome to update somehow allowed the other pending upgrades to restart the OS, or if it was some other reason.

Improve this question
4
  • 1
    Just to clarify, am I understanding your details correctly that your Mac itself didn't restart, but that Google Chrome did?
    – Monomeeth ♦
    Apr 5, 2018 at 3:39
  • @Monomeeth Not quite. I asked Google Chrome to restart but the whole OS "restarted" to some degree, including the Terminal. But it seemed to be some kind of "restart" that wasn't counted as a reboot.
    – hippietrail
    Apr 5, 2018 at 3:58
  • 1
    It sounds like you got logged out from your user account, not that your machine restarted.
    – njboot
    Apr 5, 2018 at 5:01
  • @njboot: Is there a way to verify that?
    – hippietrail
    Apr 6, 2018 at 0:58

3 Answers 3

Reset to default
32

I use Terminal a lot, so my answer will include commands used in that application. I know Console provides details, but I rarely see it as more than a GUI to access the logs. Terminal can be found in the Utilities folder which is found in the Applications folder.

On newer macOS (macOS 10.12 and later) with the unified logging system, the processing of the text files doesn't show the whole story, so use the log show command below:

log show --predicate 'eventMessage contains "Previous shutdown cause"' --last 24h

Of course, expand the time if your restart happened more than 24 hours in the past.

After a while, you should see a message which contains a number indicating a reason. To find the meaning of that number, you can use this site: https://georgegarside.com/blog/macos/shutdown-causes/. For example, my last shutdown cause was "-128" which, unfortunately, is "unknown".

On older systems, you should be able to find the text "Previous shutdown cause" in your system log. You can find this by using this command (which you can copy/paste into terminal):

grep "Previous shutdown cause" /var/log/system.log
Improve this answer
4
  • "Previous shutdown cause" does not appear at all in my system log, even right after rebooting. I'm on 10.14.2. I do however get this line: com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system): System shutdown initiated by: shutdown.5496<-sessionlogoutd.5495<-launchd.1
    – Tim MB
    Dec 27, 2018 at 14:06
  • 1
    I don't have easy access to 10.14, so I can't confirm my theory. My best guess is that sessionlogoutd is called for Apple's "logout after x minutes of inactivity" option. You can find this in System Preferences > Security & Privacy > General > Advanced. Here's where I found reference to the feature: osxdaily.com/2013/03/23/…
    – Carl
    Jan 2, 2019 at 14:49
  • 1
    On 10.13.6 I don't find anything with the command mentioned above, but I find it with log show --predicate 'eventMessage contains "Previous shutdown cause"' --last 24h (unfortunately the reason in my case was also 'unknown'...)
    – bug313
    Mar 5, 2019 at 15:01
  • 1
    This only gives a numeric code which isn't helpful when the code is "5" (normal shutdown) to detect which software initiated the shutdown.
    – dolmen
    Mar 7 at 16:24
4

If there is going to be a message somewhere about a restart, crash or the like it will be found in console.app.

Console.app is your one-stop shop for all of the Unix logs that macOS generates and that most people will never look at or understand. You can find it in /Applications/Utilities.

It usually opens up with a view of the logs from the entire machine (top left pane of the window). You can drill down and see logs generated by specific subsystems, apps and manufacturers.

Though I occasionally have a peek at the logs in console.app I find that a lot of what is displayed is confusing and/or just "noise." However you may find a system message in there that might point to why your system restarted.

Improve this answer
2
  • I can't seem to find any way to locate events from approximately 24 hours ago using console.app
    – hippietrail
    Apr 6, 2018 at 1:06
  • 2
    other than sorting by the Time column, I am not aware of any search features that allow you to search by date/time
    – Steve Chambers
    Apr 6, 2018 at 13:03
0

In a terminal, type this command:

$ log show --predicate 'eventMessage contains "System shutdown initiated"' --last 1h
Filtering the log data using "composedMessage CONTAINS "System shutdown initiated""
Skipping info and debug messages, pass --info and/or --debug to include.
Timestamp                       Thread     Type        Activity             PID    
TTL  
2022-03-07 17:10:37.430378+0100 0x1116819  Default     0x0                  
1      0    launchd: [system:] System shutdown initiated by: reboot[84708]<-bash[84578]<-launchd[1]
--------------------------------------------------------------------------- 
-----------------------------------------
Log      - Default:          1, Info:                0, Debug:             0, Error:          0, Fault:          0
Activity - Create:           0, Transition:          0, Actions:           0

This gave me the precise timestamp when the shutdown started and that a shell script started by launchd initiated it (reboot[84708]<-bash[84578]<-launchd[1]).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .