[ Previous Tip ] [ Mac Tips ] [ Next Tip ]
The Macintosh is marketed with the tagline of "It Just Works." Most of the time, this is true, it does just work and works well. However, sometimes things happen that upset the OS and it doesn't work so well. Certain features may stop working, or the system may hang or crash. This often happens after a software upgrade of some sort and the blame is usually first placed on the upgrade. However, there are been few updates indeed where EVERYBODY has problems. It often takes the interaction of some new software with some pre-existing condition to produce a problem. Also, there can be particular combinations of upgrades and existing software or hardware that do break something. These problems are usually identified and fixed by Apple, often with some delay that seems much too long.
Outright crashes due to software updates are usually the result of local conditions and require individual attention to the particular system impacted. Recovery from system crashes is the primary subject of this page.
A Kernel Panic is the Mac OS equivalent to the Blue Screen of Death in the Windows world. It occurs in two forms. One overwrites the existing screen with a gray translucent screen with instructions in several languages to restart the computer. The other is a bunch of white text that scrolls down the screen. Both are serious, but the second one so confused the OS that the system didn't think that it was even safe to display the nicely formatted message. In both cases, a crash report is be generated and a request will be made on the next boot to send the report to Apple. The user can either send the report or cancel out with no report sent.
The fact that a kernel panic occurred indicates a serious problem that will probably need fixing. Kernel panics occur due to some root cause. They do not occur randomly. Unless the root cause is fixed, one kernel panic will usually be followed by another again and again so that they must be dealt with. Kernel panics can be initiated either by hardware problems, corrupted executable files, corrupted directories, or corrupted data files. The system can work around many problems, usually leaving some kind of error report in the system logs. However, some are so severe that the only response the system has is to halt.
If the hardware is at fault, then some physical repairs are probably necessary. Hardware faults tend to produce repeatable kernel panics although RAM problems can seem to occur at random times such as when a bad memory bit is actually used for something important. There are ways of testing the hardware.
Software problems are often hard to pin down to a particular file. There are hundreds of thousands of files in the system. Trying to determine which one might be to blame is a difficult task, but there are tools and methods that allow entire classes of these problems to be fixed en masse, but with varying degrees of effort.
For the most part, the tools that you will need to solve system crashes are supplied with the computer. You may need:
Disk Utility is a program found in the Utilities folder. This program can detect and repair disk directory problems.
Hardware Test Disk. Hardware test is a program that runs at a very low level. It is usually supplied as a separate disk packed with the computer OR it is accessed by pressing the A or D key (instructions printed in very small type on the gray installer disk) while booting from the system installer disk that came with the computer. If your computer didn't come with gray disks, then boot with the D key held down. Apple Hardware Test is in the computer's firmware.
System Installer Disk. This is a disk that comes with each Macintosh. It will reinstall a new operating system. If you have purchased a newer version of the OS at retail, you will use the newer disk instead. If your computer came with Lion or Mountain Lion installed, you didn't get installer disks. The system installer app and utiliies are accessible from the Recovery Partition (boot with cmd-R held down).
Memtest is a freeware program that will continuously test the RAM (Random Access Memory) of a computer to look for intermittent memory problems.
TechTools. The TechTools program is often supplied with the AppleCare extended warranty. Sometimes, but not always, it is supplied as a bootable disk. However, the version supplied may or may not actually be able to boot on the newer hardware.
AppleCare can be very useful. If you have purchased the AppleCare extended warranty, then use this service. Often, AppleCare can and does actually help. Call 1-800-275-2273. If the computer is less than a year old, you can use this service also.
Do not overlook external devices connected to your computer. Before you dig in anywhere else, unplug all non-Apple USB devices and try it for awhile. Crashes, especially when waking from sleep, are often caused by USB devices and hubs that aren't quite up to snuff. If you find that your computer works properly when some USB device is NOT present, then don't use that device. If you still need that function, find another similar kind of device. Some USB hubs, in particular those made by HP, seem to be problematic.
A very common cause of a repeating kernel panic is a hardware problems. In this case, something has gone wrong with the computer itself. Computers are electro-mechanical devices. They can and do physically fail and can do so at any time. Often a hardware failure will result in a totally non-operational computer but sometimes the failure can be insidious. It can occur only at particular times or under particular conditions such as at particular temperatures, altitudes or with pressure applied to a particular spot on the computer case. The most common cause of intermittent hardware caused kernel panics is bad RAM. Hardware test, TechTools and Memtest are useful here. Memtest can be set up to run continuously for days to try to tease out RAM that is just starting to die.
If the computer has hard failed such that it will not boot up at all, it's time to call AppleCare if you still have coverage. If not, then it is time to look up a computer repair shop.
Another common cause of kernel panics is a problem with the directory structure of the boot disk or bad sectors on the disk. Disk Utility can be used to verify the structure of the disk but it cannot repair the disk that the computer is booted from. To do that, you need to boot the system installer DVD or Recovery Partition that came with the computer or a more recent retail system upgrade disk. Instead of doing a system install, Disk Utility can be run from the Utilities menu. It can then be used to repair most disk directory structure problems.
If the disk has some actual bad sectors, then this can be detected by TechTools, use the Surface Scan. Most modern disk controllers detect bad sectors and try to replace them with spare sectors on the fly. There are only a finite number of spare sectors available and if they are all consumed, then the disk may require reformatting. Then the capacity of the disk will be reduced. The contents of a bad sector may be lost and may be the cause of a kernel panic if the bad sector happened to be in an especially sensitive spot. Recovery may require a disk reformat and system re-installation.
If your hardware tests good and a disk directory verify or repair says that the disk directory is good, and the problem persists, then some more work is required. Try these things in this order proceeding only if the previous step didn't provide satisfaction. These steps tend to replace or repair whole categories of possible problems. If the step is successful, you may never know exactly what caused the problem, just that it is gone.
Safe Boot. The Safe Boot process is easy to do, fairly quick and, most important, is safe. You really can't do any additional damage via a Safe Boot. Unplug everything from the computer that you can and restart with the shift key held down. When the spinning gear icon appears, you can release the shift key. The Safe Boot process will take much longer than a normal boot. The system is doing a disk verification as well as other system maintenance activities, just let it run. When the login screen appears, it will say "Safe Boot." At this point, press the shutdown button and let the system shut down cleanly. A Safe Boot can, and often does, solve a variety of problems.
At the very least, a Safe Boot will fix bad directries (if they are fixable at all) without needed to boot from an installer DVD. If you suspect a disk directory problem, run Disk Utility to Verify the disk. Disk Utility won't allow a repair on the disk that the computer is booted from. If there are troubles, restart, Safe Boot and then restart again. Then run Disk Utility to Verify again, the problems will probably be fixed.
Archive and Install. The Archive and Install process places a new System on the disk. The Library remains mostly intact. Users, permissions and applications are not impacted but the process takes some time and you may have to further update the system to bring it back to the most current OS version. You will need a system installer disk for the OS version that you want to install. Boot the installer disk (hold the C key after inserting the installer CD or DVD). After the installer is booted, look for the Options button to appear on one of the screens as you step through the process. Select the Archive and Install option (preserving Users) and let it run. After the installer finishes and the computer restarts, run Software Update (from the Apple menu) and reinstall any software updates that have occurred since the version of the installer that you have. Your old System will be in a folder called "Previous Systems." You won't have need for it and it will use some disk space, so delete it and empty the trash. If you notice that some application no longer work properly, then it probably installed something into the old System which is now gone. Think hard before you reinstall that application, it MAY have been the problem.
Note that in Snow Leopard, there is no "Archive and Install" option, in fact there are no options at all. All installations entirely replace the System. The "archive" part is in Time Machine... you DO USE Time Machine don't you? If not, you should.
Erase and Install. This is a pretty serious option and you'll want to try everything else before you go there. This option does exactly what it says, it will erase the WHOLE disk. You MUST backup all of your data because it will all go away. If you use Time Machine you can restore your disk from your Time Machine backup disk, BUT if the problem was some software configuration or bad data files, then those bad files will be restored in the form that they were in and you might have the same problems again. Do a restore from Time Machine only if your computer was behaving itself before disaster overtook it. If the computer was having problems, it is best NOT to restore from Time Machine completely. If you do and Erase and Install, it is best to start from scratch. You will get a new, completely clean OS. Then run Software Update to bring the OS up the the latest version. Then create a NEW user for yourself and copy only your documents back to the new user. Set everything else up as if you were just starting out. Reinstall only the applications that you actually use from their original installer disks. When you are all done installing, run Software Update again to see if it picks up any changes.
In Snow Leopard, there is no "Erase and Install" option either. If you really want to erase the disk and start over, select Disk Utility from the Utilities menu when booted from the installer disk and use Disk Utility to erase the target disk.
Lion and Mountain Lion. In Lion and Mountain Lion, there isn't even an install DVD. A reinstall is done from the Recovery Partition. Boot with cmd and R held down and you will be presented with a menu of options. Disk Utility is available there as well as an Install option. Install downloads a whole new installer image from Apple's servers. This file is 4+ GB and will take quite a while to download. A 10 MBit/sec connection can download the file in a little more than an hour. Slower connections will take proportionally longer. The installer will run and the system will reboot leaving all user files and applications alone.
Net Boot. If you have a newer Mac with the appropriate firmware or firmware update, the computer will be able to boot from the internet even if there is NOTHING on any accessible boot disk. When a bootable system is not found, the computer will reach out to the internet (it has to have an internet connection) and download just enough to allow it to boot to a memory image of the Recovery Partition. At that point, a full system can be installed with another long download. Your computer will be allowed to do this based on it's serial number. From the serial number, Apple can tell that the computer shipped with a particular version of the OS and that's what you will get. If your computer shipped with Lion, you will get Lion even if you have purchased Mountain Lion. Once Lion is installed, you can go to the Mac App Store, log in with your AppleID and THEN you can download the current version of the Mountain Lion installer app and use that to install Mountain Lion. You will then have to migrate your apps and user data back from some backup disk or another computer.
For those users coming from the Windows world, it can be somewhat of a shock that they DON'T have to do routine maintenance. The Mac OS tends to clean up after itself and there is little that the user really needs to do beyond actually using the computer.
Disk Deframentation is not necessary, the OS defragments itself on the fly. Files smaller than 20 MB are defragmented automatically. There is little to gain in defragmenting files larger than 20 MB because the files are so large that the read and write time are dominated by the file size, not by any residual fragmentation. There are utilities that do defragment Macintosh disks, but they are not very popular because they don't actually produce detectable results. Some of them can actually slow things down.
Cache Cleaners are used to "clean" out system caches, which the Mac OS uses quite a bit, but these utilities should not be used on a routine basis. These programs, such as Leopard (or Snow Leopard, or Lion or Mountain line) Cache Cleaner, can solve some problems that are short of system crashes but should not be used if things seem to be working properly.
Anti-Virus programs are essentially useless on a Macintosh. There is nothing to protect against. The folks that sell this stuff would like you to think that you need these products, but all they really do is scan your mail for incoming viruses so that you don't pass them along to Windows users. These programs are intrusive by their nature and tend to make a Macintosh less stable. You are MUCH better off without them.
Malware Blockers are also useless as there is little malware (adware, spyware or other badware) that impacts a Macintosh. What little Mac malware there is usually attacks via Java and Apple has provided utilities and patches to close off these attacks. Again, as much as the security researchers continue to cry out that disaster is coming, it hasn't come in eight years. Apple finds and patches vulnerabilities faster than the badware writers can find them so that the bad guys have little leverage in actually exploiting the Macintosh. Apple is ahead of the wave, MicroSoft is way behind their wave.
There is a feature built into Mac OS X that knows about some trojans and malware that users tend to install themselves. It will warn you if it sees that you are going to install something that is know to be malware. If you REALLY want to install this stuff, you can, but you have to work at it.
It is usually pretty difficult to figure out why a kernel panic has occurred. If one of the above steps "fixed" it, then all you know is that some part of the software was bad. If the problem is truly gone, then that is likely all you need to know. However, for the curious, there are a few hints that you can take from the behavior of the system itself.
One place to look is in the Console. This is an application, found in the Utilities folder, that cleans up the system logs for easier interpretation by human eyes. Kernel panics are usually so severe that the actual event that caused the panic isn't recorded, however the events proceeding the actual panic may be. Open the Console, press the "Show Log List" icon and select "All Messages." Everything recorded to the various logs will be displayed in chronological order. Look for this message, it is the first one that the system produces after a cold boot.
5/1/08 1:09:20 PM kernel Darwin Kernel Version 9.2.2: Tue Mar 4 21:23:43 PST 2008; root:xnu-1228.4.31~1/RELEASE_PPC
or for an Intel machine
9/23/12 5:18:33.000 PM bootlog: BOOT_TIME 1348445913 0
Depending on your system version and computer configuration, the text of the message may be a little different. Then look at the immediately previous message. This is either the last thing that happened properly or perhaps some precursor message to the event trail that caused the panic. Usually, all you get is what went right but at least you can narrow down the possibilities.
If, after several panics, you keep seeing the same process in the proceeding events, this may be a clue that that process is not quite right. The Sender[PID] column lists the process that sent the message. The number in the brackets isn't particularly important, it is the process ID that the launchd process assigned to the process when it launched. These will change over time as processes quit and respawn.
If your computer is a desktop, it may being impacted by short AC power dropouts. Did you see the room lights flicker at the same time as the panic?
If the computer panics when a USB device is connected, don't use that device. USB problems can also impact the way that a computer wakes from sleep. If the computer appears to try to wake up but the screen backlight never comes on, it probably experienced a panic while waking from sleep. USB problems can cause this. After you restart the computer, it may ask you to send a report to Apple. This is a sure sign that a panic occurred, likely caused by a wonky USB device.
If the problem always occurs when some particular application is running, then suspect that that application installed some driver or helper that is causing the problem. Applications themselves are not supposed to be able to crash the system, but device drivers unfortunately can. Deinstall the suspected application with the uninstaller that came with the application or use a program such as AppZapper to remove everything that a particular application installed. The Archive and Install process will have already removed anything installed in the System but it will leave things behind in the Library. The Erase and Install process will remove, at the expense of some pain, all the cruft and fluff. Be mindful of what might have happened before you reinstall this stuff.
[ Previous Tip ] [ Mac Tips ] [ Next Tip ]
This page has been accessed times since Apr 19, 2008
© 2008-2009 George Schreyer
Created Apr 19, 2008
Last Updated September 30, 2012