4

I just logged in to my MacBook Pro (2015) running Catalina. While entering my password my desktop background disappeared, leaving a white background. On pressing enter, the machine suddenly rebooted. During the phase with the white loading bar and Apple logo on a black background the loading bar filled up (rather slowly) twice, and then showed an installation dialog:

Installation screen

The text says:

Installing on “Macintosh HD
[loading bar]
27 minutes remaining

It didn’t say what was being installed. It didn’t remotely take 27 minutes.

After that it booted up again, with a very slow loading bar this time, slow enough for it to show a time estimate at around 8 minutes. I have to add that booting has always been lightning fast until today.

Just I logged in normally again, all my files still seem to be there, even my Safari tabs were restored.

I was hoping someone could tell me what happened (what was installed and why) and if there’s anything I should do or check now.

Improve this question
2
  • The first version of this question has the makings of a great blog post. In summary - is there a one line question you’d like answered? If so, editing it at the end of the question will help us help you.
    – bmike ♦
    Jun 6, 2020 at 13:26
  • @bmike I’m sorry, it ended up in the “probably unimportant” section instead of just above the line. Have edited
    – 11684
    Jun 6, 2020 at 13:34

1 Answer 1

Reset to default
0

The simple explanation is a macOS installer was in your Applications folder (or elsewhere) and was run. 30 minutes to install isn’t out of line - especially on a machine with a bit of history or third party apps.

enter image description here

The logical place where running an installer happens is when you enroll / allow automatic updates in System Preferences and then in the Notification Center where options like restart now or update later are presented.

What next? Perhaps look in /var/log/install.log to see if you agree with the recent actions logged. Possibly boot to recovery and install a good clean download of the latest macOS on top of your install if you feel you can’t trace why the installer ran. Make a backup for sure, if your mac is compromised - an erase install and selective restore from backup might be needed. To me, there are very common reasons for this to happen and no particular signs you have any issues unless you can not determine why the installer ran via defaults or someone opening it manually.

Improve this answer
6
  • Thanks for the answer! There’s still one thing I don’t understand: what exactly triggered the installer to run?
    – 11684
    Jun 6, 2020 at 13:59
  • @11684 the logs for that may not be precise enough. There’s three methods I can think of using the open command line tool, clicking in Finder and very unlikely would be another privileged script. You could have selected two items and not realized you opened two apps when you thought you were selecting one.
    – bmike ♦
    Jun 6, 2020 at 15:03
  • I’m not sure what you mean; I didn’t select anything since I never got to log in. The desktop background (which is shown behind the lock screen) changed to white before I finished typing my password and the reboot happened the moment I pressed enter to submit my password. I didn’t select anything since I never got actually log in and the fact that the background disappeared while I was still typing makes me think something was triggered even before I logged in.
    – 11684
    Jun 6, 2020 at 16:43
  • The app ran before the reboot and was waiting to start the process...
    – bmike ♦
    Jun 6, 2020 at 18:13
  • 3
    Looking at /var/log/install.log it seems I clicked "install later" when prompted for an OS update the evening before, but it was supposed to run at 2 AM. In fact, there is a message "Restarting for software update" at 02:48, but then after a few more messages about service connections the next message is from 11:20 and the messages after that from 14:15. These 2PM messages detail the installation of the update, although it occurred around 12. After the install there are boot messages which are indeed timestamped 12:16. Very confusing, but AFAICT nothing malicious.
    – 11684
    Jun 16, 2020 at 13:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .