I was in a summer camp. I left my computer behind and had a lengthy discussion with my peers. After I've come back, I found my computer with black screen. I thought that my computer ran out of power and hibernates automatically. To this point, everything looks normal.
I'm in a hurry, so I just close the laptop and put it in my bag. Because I also have an external HDD attached, I take extra care so that nothing is crushed. I didn't disconnect the HDD in fear that when the computer resume the system will complain about sudden removal about it.
When I get home, I immediately connects it to a working charger and connects to a gigabit network through thunderbolt 3 adapter before I open the laptop. After I open the lid and enter the firmware password (for security reasons, I configured the mode to be full). The resume screen does not appear. Instead, a normal boot screen appeared, followed by a normal login screen. After I logged in, apps began launching and showing up. I know it's not a resume because Google Chrome told me that it had been shut down improperly.
The battery is about 10% when I logged in. Plus, I've encountered sleep wake failures (either the SSD is full, or something happened), and it will generate a crash file. I looked in /library/logs/diagnosticreports and found no crash file. I looked in /var/logs/system.log and found no suspicious messages. I looked at my own log file generated by running "log stream --level debug > syslog" that is running before the shutdown and found no related messages.
To try and capture a "snapshot" of the system, I did two sysdiagnose, one on the following startup, and another after another restart.
Question: How could I find out what cause the shutdown and how to prevent it?
macOS High Sierra 10.13.6 (17G65) MacBook Pro (13-inch, 2017, Four Thunderbolt 3 Ports)
df -k /:
Filesystem 1024-blocks Used Available Capacity iused ifree %iused Mounted on /dev/disk1s1 488245288 427684144 56198540 89% 3041607 9223372036851734200 0% /
ls -l /var/vm/sleepimage*:
-rw------T 1 root wheel 1073741824 8 11 13:22 /var/vm/sleepimage
pmset -g custom:
Battery Power: lidwake 1 autopoweroff 1 autopoweroffdelay 28800 standbydelay 10800 standby 1 ttyskeepawake 1 hibernatemode 3 powernap 0 gpuswitch 2 hibernatefile /var/vm/sleepimage displaysleep 15 sleep 15 tcpkeepalive 1 halfdim 1 acwake 0 lessbright 1 disksleep 10 AC Power: lidwake 1 autopoweroff 1 autopoweroffdelay 28800 standbydelay 10800 standby 1 ttyskeepawake 1 hibernatemode 3 powernap 1 gpuswitch 2 hibernatefile /var/vm/sleepimage displaysleep 60 womp 1 networkoversleep 0 sleep 0 tcpkeepalive 1 halfdim 1 acwake 0 disksleep 0