My Mac just "restarted" while I was looking away and I'd like to know if it was a crash or a postponed restart due to an update.
My Mac does sometimes crash and restart but hasn't done so for a couple of months.
I installed some OS updates in the past couple of days but chose not to restart yet.
Google Chrome was getting slow and had been displaying the green update arrow for a day or two. I clicked on the update button and wandered off to do something before it responded in any way.
When I turned back to the computer it seemed to be "restarting". I'm using the scare quotes because I don't think it was rebooting from scratch since I didn't see the Apple logo with progress bar, which can be a little slow on my system.
I verified that it had restarted by switching to the Terminal app which showed the Restored text with a timestamp from about a minute ago.
When I check when the last reboot was using uptime or System Information it tells me 32 days.
The App Store is telling me that I still need to restart to complete updates.
So how can I check why it just "restarted"? I want to know if my crashing problem came back after such a long time of stability, if asking Chrome to update somehow allowed the other pending upgrades to restart the OS, or if it was some other reason.
Best Answer
I use Terminal a lot, so my answer will include commands used in that application. I know Console provides details, but I rarely see it as more than a GUI to access the logs. Terminal can be found in the Utilities folder which is found in the Applications folder.
On newer macOS (macOS 10.12 and later) with the unified logging system, the processing of the text files doesn't show the whole story, so use the
log showcommand below:Of course, expand the time if your restart happened more than 24 hours in the past.
After a while, you should see a message which contains a number indicating a reason. To find the meaning of that number, you can use this site: https://georgegarside.com/blog/macos/shutdown-causes/. For example, my last shutdown cause was "-128" which, unfortunately, is "unknown".
On older systems, you should be able to find the text "Previous shutdown cause" in your system log. You can find this by using this command (which you can copy/paste into terminal):