How can I work out why my MacBook Air wants to spontaneously reboot?
May 21, 2023 3:44 AM Subscribe
Over the last few weeks I've noticed my Mac (Intel MacBook Air mid 2020 running the Ventura 13.4, FWIW) will periodically attempt to close down all open apps and reboot. It's definitely rebooting and not just going to sleep - details inside. I'm looking for some pointers to help me work out why.
I can't spot any pattern in the timing/duration until it attempts to, but usually if I leave untouched for an hour or so, it will have attempted to reboot during that time. Happens regardless of whether the screen is left up or down.
I know it's rebooted and not just waking from sleep because I can use touchID to wake it from sleep - however after a reboot, password entry is required to activate TouchID, and the login screen is asking me for my password. So it has definitely rebooted.
If there are apps running that physically prevent a reboot, for example because they display their own "Do you want to close this app?" dialogs, it will close all other apps but not reboot because it can't; but otherwise, it'll just reboot back to the password-entry login screen. (So my workaround for now is to keep one of those open at all times, but I'd still like to work out what's causing it)
So, my question is - how can I track down what's causing this? As in, what system logs or similar could I check, and (for bonus points) what should I be looking for in them?
I know about Console.app and I can find my way around via the command line so I've been digging around in /var/log but it's a bit of a needle in a haystack - I don't know exactly when it's happening, so I can't search by timestamp, because so far it's never happened while I've been actually using it.
I'm assuming I must have installed something that's causing it, but I can't remember exactly when it started so I can't pin down exactly what. I'd prefer not to have to go down the path of uninstalling or quitting every app one-by-one - I'm really hoping to find the some clues logged somewhere that would let me zero in on something specific.
I can't spot any pattern in the timing/duration until it attempts to, but usually if I leave untouched for an hour or so, it will have attempted to reboot during that time. Happens regardless of whether the screen is left up or down.
I know it's rebooted and not just waking from sleep because I can use touchID to wake it from sleep - however after a reboot, password entry is required to activate TouchID, and the login screen is asking me for my password. So it has definitely rebooted.
If there are apps running that physically prevent a reboot, for example because they display their own "Do you want to close this app?" dialogs, it will close all other apps but not reboot because it can't; but otherwise, it'll just reboot back to the password-entry login screen. (So my workaround for now is to keep one of those open at all times, but I'd still like to work out what's causing it)
So, my question is - how can I track down what's causing this? As in, what system logs or similar could I check, and (for bonus points) what should I be looking for in them?
I know about Console.app and I can find my way around via the command line so I've been digging around in /var/log but it's a bit of a needle in a haystack - I don't know exactly when it's happening, so I can't search by timestamp, because so far it's never happened while I've been actually using it.
I'm assuming I must have installed something that's causing it, but I can't remember exactly when it started so I can't pin down exactly what. I'd prefer not to have to go down the path of uninstalling or quitting every app one-by-one - I'm really hoping to find the some clues logged somewhere that would let me zero in on something specific.
It wants to update the OS.
posted by slkinsey at 6:59 AM on May 21, 2023 [2 favorites]
posted by slkinsey at 6:59 AM on May 21, 2023 [2 favorites]
A couple of ideas:
This could be a kernel panic. Kernel panics will restart the system, and you are supposed to get a dialog when the machine finishes restarting, asking you to report the issue to Apple.
Does this occur if you reboot in safe mode? If it does not, that suggests third party software.
Open the Console.app (in Applications:Utilities) and look at the Crash Reports sidebar. From what you are describing, you should see many crashes of a particular piece of the system, such as WindowServer or loginwindow.
Crashes above kernel panics will involve a particular thread in a process. Look at any of the crash reports, and search for "Crashed:". For example,
Thread 10 is the thread of interest here. Look at the backtrace for that thread and see if anything looks odd or suspicious. Sorry, I can't be more general than that. If it's third party software causing the crash you'll see a name in the backtrace (the libsystem_pthread.dylib above is a standard part of the operating system.)
Have you added any third party software meant to modify system behavior? I had a niece's MacBook which restarted every time she closed the lid. The culprit turned out to be an incompatible extension. Removing the extension (moving it from /Library/Extensions to the Desktop, then rebooting) fixed the restarts. Extensions can live in /System/Library/Extensions, /Library/Extensions, and a couple of other places. Apple's support website can suggest more ideas.
Good luck. These kinds of issues can be very frustrating.
posted by blob at 7:00 AM on May 21, 2023 [7 favorites]
This could be a kernel panic. Kernel panics will restart the system, and you are supposed to get a dialog when the machine finishes restarting, asking you to report the issue to Apple.
Does this occur if you reboot in safe mode? If it does not, that suggests third party software.
Open the Console.app (in Applications:Utilities) and look at the Crash Reports sidebar. From what you are describing, you should see many crashes of a particular piece of the system, such as WindowServer or loginwindow.
Crashes above kernel panics will involve a particular thread in a process. Look at any of the crash reports, and search for "Crashed:". For example,
[...]
Thread 9:
0 libsystem_pthread.dylib 0x7ff80fbddf48 start_wqthread + 0
Thread 10 Crashed:: Dispatch queue: */.Spotlight-V100
0 libsystem_pthread.dylib 0x7ff80fbdd882 pthread_mutex_lock + 4
[...]
Thread 10 is the thread of interest here. Look at the backtrace for that thread and see if anything looks odd or suspicious. Sorry, I can't be more general than that. If it's third party software causing the crash you'll see a name in the backtrace (the libsystem_pthread.dylib above is a standard part of the operating system.)
Have you added any third party software meant to modify system behavior? I had a niece's MacBook which restarted every time she closed the lid. The culprit turned out to be an incompatible extension. Removing the extension (moving it from /Library/Extensions to the Desktop, then rebooting) fixed the restarts. Extensions can live in /System/Library/Extensions, /Library/Extensions, and a couple of other places. Apple's support website can suggest more ideas.
Good luck. These kinds of issues can be very frustrating.
posted by blob at 7:00 AM on May 21, 2023 [7 favorites]
Apple recently rolled out a Rapid Security Response update mechanism starting on MacOS Ventura. It's designed to push fixes for zero-day exploits to machines as quickly as possible without waiting for you to acknowledge it.
This MacRumors article may have some information about what's going on and how to turn it off.
If RSR is on for you and you're in a reboot loop it could be RSR is malfunctioning, or something else on your machine (e.g. low disk space) is interfering.
posted by JoeZydeco at 8:53 AM on May 21, 2023 [1 favorite]
This MacRumors article may have some information about what's going on and how to turn it off.
If RSR is on for you and you're in a reboot loop it could be RSR is malfunctioning, or something else on your machine (e.g. low disk space) is interfering.
posted by JoeZydeco at 8:53 AM on May 21, 2023 [1 favorite]
Another vote to boot once into Safe Mode and then reboot normally. Does that help?
posted by wenestvedt at 5:52 AM on May 22, 2023
posted by wenestvedt at 5:52 AM on May 22, 2023
This thread is closed to new comments.
posted by hydropsyche at 4:30 AM on May 21, 2023 [2 favorites]