MacOS – El Capitan froze and rebooted (Macbook Pro Retina Mid 2012)

macbook promacosNetworkwifi

  • 2.3 Ghz Intel Core i7 8GB DDR3:
    Was running NetAdmin Pro which is monitoring
    my office LAN, processors consumption was at
    ~15 – 20%. Simultaneously I ran WiFI Explorer,
    3.7% no more than 5% CPU usage. And I was
    updating Xcode to v 7.3.1 and was browsing and
    watching video from playground.ru

  • Watch the videos until half of it (20mins) the
    Video froze I moved the mouse and turned out
    the whole OSX is frozen.

  • littleSnitch v 3.7 has no reaction

  • I immediately pull the Ethernet adaptor and
    MacBook just went to black screen. I then
    switch off the wireless router. (My MacBook Pro
    is connected to the network via Ethernet
    adaptor and via WiFi router bearing different IP,
    I was thinking of cutting both network
    communication, in case it was an intrusion)

  • MacBook just restarted itself to login screen,
    after 15-20 sec of black screen and total
    silence)

  • I again restarted and booted into Recovery
    mode use disk utility. After completing disk
    check.

  • Login and previously opened programs resume
    back (NetAdmin Pro, WiFi Explorer, Yandex
    browser, Activity Monitor and AppStore)

  • AppStore doesn't resume the download
    everything else is functioning normally and in
    Addition I have got my calendar open after login
    (I did not launch accidental nor was it set to
    start with system login)

Question 1: Are there any way to know what was happening and what was OS El Capitan last reaction before it froze and rebooted?

Question 2: Are there any software better than "Console" v10.11 to interpret what was going on before it crashes?

P.S. Thank you in advance, I will try to upload the Console messages later from the MacBook Pro


DDT-2:~ Chaleune$ syslog | grep -i "shutdown cause"

Jun 22 14:15:37 DDT-2 kernel[0] <Notice>: Previous shutdown cause: 5

Jun 22 20:34:46 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 23 15:18:23 DDT-2 kernel[0] <Notice>: Previous shutdown cause: 5

Jun 24 17:58:32 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 24 20:09:52 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 24 22:58:15 localhost kernel[0] <Notice>: Previous shutdown cause: 5Jun 25 14:43:36 DDT-2 kernel[0] <Notice>: Previous shutdown cause: 5

Jun 25 21:55:31 localhost kernel[0] <Notice>: Previous shutdown cause: 3

Jun 25 22:20:57 localhost kernel[0] <Notice>: Kext com.apple.driver.AppleOSXWatchdog failed to load (0xdc008012).Previous shutdown cause: 5

Jun 26 10:18:44 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 26 12:09:45 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 26 18:00:31 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 27 13:05:58 DDT-2 kernel[0] <Notice>: Previous shutdown cause: 5

Jun 27 22:56:11 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 28 14:18:27 DDT-2 kernel[0] <Notice>: Previous shutdown cause: 5

*Jun 29 18:56:21 localhost kernel[0] <Notice>: Previous shutdown cause: -128*

Jun 29 23:31:22 DDT-2 kernel[0] <Notice>: Previous shutdown cause: -128

Opensource.apple shows the following

  • dsIllInstErr = 3, /illegal instruction error/
  • dsChkErr = 5, /check trap error/
  • userCanceledErr = -128

macwizard gave the following interpretation:

  • 03 Illegal Instruction
    The computer has a specific vocabulary of machine language instructions it can understand. If a computer tries to execute an instruction that isn't in its vocabulary, you see this error code. It's less likely than error 02, but still very common.
  • 05 Range Check Error
    Programmers can use an instruction in the Motorola 68000 to check if a number is within a certain range. This error indicates that the number tested isn't in the specified range.
  • -128 userCanceledErr User canceled an operation

Best Answer

Run a sysdisgnose. That is how Apple receives feedback from seeding/beta customers. The keyboard shortcut is Cmd Opt Ctrl Shift Period.

You can also run sudo sysdiagnose -f ~/Desktop/ in Terminal. The former will save to /var/tmp and the latter will save to the Desktop.

Sysdiagnose will contain pretty much A to Z.

You should be sure to check the disks.txt, diskutil.txt, errorlog.txt, logs.txt, and the diagnostics folder.