Fixing a Cranky Macintosh

[ Previous Tip ] [ Mac Tips ] [ Next Tip ]


Contents


Introduction

The Macintosh is marketed with the tagline of "It Just Works." Most of the time, this is true, it does just work and works well. However, sometimes things happen that upset the OS and it doesn't work so well. Certain features may stop working, or the system may hang or crash. This often happens after a software upgrade of some sort and the blame is usually first placed on the upgrade. However, there are been few updates indeed where EVERYBODY has problems. It often takes the interaction of some new software with some pre-existing condition to produce a problem. Also, there can be particular combinations of upgrades and existing software or hardware that do break something. These problems are usually identified and fixed by Apple, often with some delay that seems much too long.

Outright crashes due to software updates are usually the result of local conditions and require individual attention to the particular system impacted. Recovery from system crashes is the primary subject of this page.


Kernel Panics

A Kernel Panic is the Mac OS equivalent to the Blue Screen of Death in the Windows world. It occurs in two forms. One overwrites the existing screen with a gray translucent screen with instructions in several languages to restart the computer. The other is a bunch of white text that scrolls down the screen. Both are serious, but the second one so confused the OS that the system didn't think that it was even safe to display the nicely formatted message. In both cases, a crash report is be generated and a request will be made on the next boot to send the report to Apple. The user can either send the report or cancel out with no report sent.

The fact that a kernel panic occurred indicates a serious problem that will probably need fixing. Kernel panics occur due to some root cause. They do not occur randomly. Unless the root cause is fixed, one kernel panic will usually be followed by another again and again so that they must be dealt with. Kernel panics can be initiated either by hardware problems, corrupted executable files, corrupted directories, or corrupted data files. The system can work around many problems, usually leaving some kind of error report in the system logs. However, some are so severe that the only response the system has is to halt.

If the hardware is at fault, then some physical repairs are probably necessary. Hardware faults tend to produce repeatable kernel panics although RAM problems can seem to occur at random times such as when a bad memory bit is actually used for something important. There are ways of testing the hardware.

Software problems are often hard to pin down to a particular file. There are hundreds of thousands of files in the system. Trying to determine which one might be to blame is a difficult task, but there are tools and methods that allow entire classes of these problems to be fixed en masse, but with varying degrees of effort.


Tools

For the most part, the tools that you will need to solve system crashes are supplied with the computer. You may need:


USB Issues

Do not overlook external devices connected to your computer. Before you dig in anywhere else, unplug all non-Apple USB devices and try it for awhile. Crashes, especially when waking from sleep, are often caused by USB devices and hubs that aren't quite up to snuff. If you find that your computer works properly when some USB device is NOT present, then don't use that device. If you still need that function, find another similar kind of device. Some USB hubs, in particular those made by HP, seem to be problematic.


Hardware Problems

A very common cause of a repeating kernel panic is a hardware problems. In this case, something has gone wrong with the computer itself. Computers are electro-mechanical devices. They can and do physically fail and can do so at any time. Often a hardware failure will result in a totally non-operational computer but sometimes the failure can be insidious. It can occur only at particular times or under particular conditions such as at particular temperatures, altitudes or with pressure applied to a particular spot on the computer case. The most common cause of intermittent hardware caused kernel panics is bad RAM. Hardware test, TechTools and Memtest are useful here. Memtest can be set up to run continuously for days to try to tease out RAM that is just starting to die.

If the computer has hard failed such that it will not boot up at all, it's time to call AppleCare if you still have coverage. If not, then it is time to look up a computer repair shop.


Disk Problems

Another common cause of kernel panics is a problem with the directory structure of the boot disk or bad sectors on the disk. Disk Utility can be used to verify the structure of the disk but it cannot repair the disk that the computer is booted from. To do that, you need to boot the system installer DVD or Recovery Partition that came with the computer or a more recent retail system upgrade disk. Instead of doing a system install, Disk Utility can be run from the Utilities menu. It can then be used to repair most disk directory structure problems.

If the disk has some actual bad sectors, then this can be detected by TechTools, use the Surface Scan. Most modern disk controllers detect bad sectors and try to replace them with spare sectors on the fly. There are only a finite number of spare sectors available and if they are all consumed, then the disk may require reformatting. Then the capacity of the disk will be reduced. The contents of a bad sector may be lost and may be the cause of a kernel panic if the bad sector happened to be in an especially sensitive spot. Recovery may require a disk reformat and system re-installation.


Remedial Actions for Files with Bad Contents

If your hardware tests good and a disk directory verify or repair says that the disk directory is good, and the problem persists, then some more work is required. Try these things in this order proceeding only if the previous step didn't provide satisfaction. These steps tend to replace or repair whole categories of possible problems. If the step is successful, you may never know exactly what caused the problem, just that it is gone.


Routine Maintenance

For those users coming from the Windows world, it can be somewhat of a shock that they DON'T have to do routine maintenance. The Mac OS tends to clean up after itself and there is little that the user really needs to do beyond actually using the computer.


What Died Anyway?

It is usually pretty difficult to figure out why a kernel panic has occurred. If one of the above steps "fixed" it, then all you know is that some part of the software was bad. If the problem is truly gone, then that is likely all you need to know. However, for the curious, there are a few hints that you can take from the behavior of the system itself.

One place to look is in the Console. This is an application, found in the Utilities folder, that cleans up the system logs for easier interpretation by human eyes. Kernel panics are usually so severe that the actual event that caused the panic isn't recorded, however the events proceeding the actual panic may be. Open the Console, press the "Show Log List" icon and select "All Messages." Everything recorded to the various logs will be displayed in chronological order. Look for this message, it is the first one that the system produces after a cold boot.

5/1/08 1:09:20 PM kernel Darwin Kernel Version 9.2.2: Tue Mar 4 21:23:43 PST 2008; root:xnu-1228.4.31~1/RELEASE_PPC

or for an Intel machine

9/23/12 5:18:33.000 PM bootlog[0]: BOOT_TIME 1348445913 0

Depending on your system version and computer configuration, the text of the message may be a little different. Then look at the immediately previous message. This is either the last thing that happened properly or perhaps some precursor message to the event trail that caused the panic. Usually, all you get is what went right but at least you can narrow down the possibilities.

If, after several panics, you keep seeing the same process in the proceeding events, this may be a clue that that process is not quite right. The Sender[PID] column lists the process that sent the message. The number in the brackets isn't particularly important, it is the process ID that the launchd process assigned to the process when it launched. These will change over time as processes quit and respawn.

If your computer is a desktop, it may being impacted by short AC power dropouts. Did you see the room lights flicker at the same time as the panic?

If the computer panics when a USB device is connected, don't use that device. USB problems can also impact the way that a computer wakes from sleep. If the computer appears to try to wake up but the screen backlight never comes on, it probably experienced a panic while waking from sleep. USB problems can cause this. After you restart the computer, it may ask you to send a report to Apple. This is a sure sign that a panic occurred, likely caused by a wonky USB device.

If the problem always occurs when some particular application is running, then suspect that that application installed some driver or helper that is causing the problem. Applications themselves are not supposed to be able to crash the system, but device drivers unfortunately can. Deinstall the suspected application with the uninstaller that came with the application or use a program such as AppZapper to remove everything that a particular application installed. The Archive and Install process will have already removed anything installed in the System but it will leave things behind in the Library. The Erase and Install process will remove, at the expense of some pain, all the cruft and fluff. Be mindful of what might have happened before you reinstall this stuff.


[ Previous Tip ] [ Mac Tips ] [ Next Tip ]


This page has been accessed hit counter times since Apr 19, 2008

© 2008-2009 George Schreyer
Created Apr 19, 2008
Last Updated September 30, 2012