Resolved (SOLVED!) Kernel panic leaves no kernel log

[Diogones]

Hey all,

I'm helping a friend with a recurring kernel panic issue she has with a 13" Macbook Pro 2012 2.5Ghz i5. The kernel panic happens at random, and the computer will usually just shut down or reboot immediately. Sometimes there are black spots or artifacts that appear on the screen. The kernel panic screen doesn't always appear, but when it does, it's not the full black screen, but simply the light grey kernel panic screen. However, the kernel panic never leaves any logs in the /System/Logs/DiagnosticReports folder. I do have evidence of one kernel panic however, after running the nvram -p command in Terminal. I do see the raw data from AAPL,PanicInfoº002</key> entry. I might have had more, but I reset the NVRAM in an attempt to resolve the panics, but this most recent kernel panic occurred after the reset, which is why it is present in the nvram log.

Is there a way to parse this log, or to convert it to a readable format? If so, I'd be happy to post the output so that another knowledgeable user could assist me with this.

My other question is, what kind of kernel panics do not dump logs in the DiagnosticReports directory? Does that signify a hardware error? I haven't found any issues with the OS itself, and there are no third party drivers or kexts installed. A random system restart did occur even in Safe Mode as well.

 

[keysofanxiety]

This is a tricky one as it's either the HDD, RAM, or MLB/GPU (so practically everything).

So let's go through each thing seperately.

We'll start by checking the HDD SMART data by downloading SMART Utility here. Anything other than 'Passed' means it's the hard-drive that's corrupted.

If that comes out clean, run a volume verification in Disk Utility. If there are any corruptions there, that's likely the issue, so we can repair the disk through recovery partition.

If that's still good, download and install MemTest here. Then boot into Single User Mode by holding CMD+S on startup. When you see the :/ root# prompt, type in memtest all 10. This will do 10 passes on the RAM. It may take a while so feel free to change that number to something else.

Please keep me posted! Speak with you soon.

 

[DeltaMac]

Does your MBPro pass the hardware test?
Run both the standard and extended tests.

If you go into the console, there is much more than just Diagnostic Reports. Look for CrashReporter. Look in the logs for specific apps that YOU use, and are probably always open when a crash occurs. When you next have a crash, note the exact time, then look in the system.log for any information. It will be listed by date and time as it records various system events. You should find something like "shutdown code 5" or something similar, maybe within 10 lines after the time of a restart. You can copy/paste 20 or 30 lines around that time, and someone may help with interpreting what you might have.

 

[Diogones]

Thank you keysofanxiety and deltamac for your prompt and helpful replies!

Ok, I did download and run SMART Utility, and everything was in the green, so no issues with SMART data. I also did a volume verification with Disk Utility, which reported both the boot volume and the actual disk as ok. I also hooked up her Macbook to my troubleshooting iMac and ran DiskWarrior 5 via Firewire, and rebuilt the directory. It had a rating of 9 out of 10, so it wasn't in such bad shape. I also have a copy of Techtool Pro 8 that I ran using the Protogo tool to make a bootable USB drive. I ran the whole battery of tests, and the RAM passed, as well as the SMART and surface scan tests.

I decided to go all out and purchased the 4.23 version of Memtest, simply because it's the latest version and supports Yosemite installations. I ran the test in Single User Mode with each stick installed for 10 passes, and then one stick at a time in each slot, to rule out the possibility of a bad module or a bad RAM slot. According to the memtest user guide, it can be helpful to run memtest when booted up normally as it can help detect processor cache memory in all of the CPU cores, so I ran it logged in normally as well with separate sticks, but everything passed without issue. I can upload the memtest log if it's necessary.

To really rule out the possibility of bad memory, I ran the Apple Hardware Test from the Internet Recovery option at startup, since I didn't have a local Hardware Test partition. I ran the test eight times, once in standard and once in extended mode for each stick in each slot, swapping them out as needed and rebooting. Nothing was reported as a problem and the test passed without errors each time, taking about 2m43s for the short test and almost 30m for the long test.

I also download and installed the trial version of ClamXav and ran a full hard drive scan, but no malicious files were found.

I did check the CrashReporter logs, but unfortunately they were empty in both Console as well as in the /Library/Logs/CrashReporter file. However, I did note the time that the last crash occurred, which was around 5:00 this morning. I checked the system.log and lo and behold I found an entry with "previous shutdown cause: -62." I have been googling around for that error, and it seems it has something to do with the Watchdog timer, which is a Mac program that checks for hanging applications. I'm wondering if it could be a software problem.

I'm copying and pasting the output around the previous shutdown cause -62 error as Deltamac suggested. Hopefully someone has some insight into this.

[ProcessBluetoothTransportShowsUpActionWL] -- Connected to the transport successfully -- 0x5300 -- 0xc000 -- 0xe800 ****

Aug 18 05:01:35 localhost com.apple.xpc.launchd[1] (com.apple.audio.coreaudiod): Unknown key for array: seatbelt-profiles

Aug 18 05:01:35 localhost hidd[91]: void __IOHIDPlugInLoadBundles(): Loaded 0 HID plugins

Aug 18 05:01:35 localhost fseventsd[41]: event logs in /.fseventsd out of sync with volume. destroying old logs. (795 36 865)

Aug 18 05:01:35 localhost hidd[91]: IOHIDService compatibility thread running at priority 63 and schedule 2.

Aug 18 05:01:35 localhost watchdogd[51]: [watchdog_daemon] @( wd_watchdog_open) - IOIteratorNext failed (kr=0)

Aug 18 05:01:35 localhost watchdogd[51]: [watchdog_daemon] @( wd_daemon_init) - could not initialize the hardware watchdog

Aug 18 05:01:35 localhost watchdogd[51]: [watchdog_daemon] @( main) - cannot initialize the watchdog service

Aug 18 05:01:35 localhost com.apple.xpc.launchd[1] (com.apple.auditd): The TimeOut key is no longer respected. It never did anything anyway.

Aug 18 05:01:35 localhost com.apple.SecurityServer[73]: Session 100000 created

Aug 18 05:01:35 localhost wirelessproxd[67]: updateScanner - central is not powered on: 0

Aug 18 05:01:35 localhost distnoted[100]: # distnote server daemon absolute time: 38.169300250 civil time: Tue Aug 18 05:01:35 2015 pid: 100 uid: 241 root: yes

Aug 18 05:01:35 localhost com.apple.usbmuxd[72]: usbmuxd-345.70 on Jan 26 2015 at 16:55:11, running 64 bit

Aug 18 05:01:35 localhost com.apple.xpc.launchd[1] (com.apple.autofsd): This service is defined to be constantly running and is inherently inefficient.

Aug 18 05:01:35 localhost com.apple.xpc.launchd[1] (com.apple.backupd-status): The HideUntilCheckIn property is an architectural performance issue. Please transition away from it.

Aug 18 05:01:36 localhost kdc[81]: krb5_kdc_set_dbinfo: failed to create root node: /Local/Default

Aug 18 05:01:35 localhost com.apple.xpc.launchd[1] (com.apple.backupd.status.xpc): The HideUntilCheckIn property is an architectural performance issue. Please transition away from it.

Aug 18 05:01:35 localhost com.apple.xpc.launchd[1] (com.apple.bsd.dirhelper): The TimeOut key is no longer respected. It never did anything anyway.

Aug 18 05:01:35 localhost com.apple.xpc.launchd[1] (com.apple.cmio.AVCAssistant): ThrottleInterval set to zero. You're not that important. Ignoring.

Aug 18 05:01:35 localhost com.apple.xpc.launchd[1] (com.apple.cmio.IIDCVideoAssistant): ThrottleInterval set to zero. You're not that important. Ignoring.

Aug 18 05:01:35 localhost com.apple.xpc.launchd[1] (com.apple.cmio.VDCAssistant): ThrottleInterval set to zero. You're not that important. Ignoring.

Aug 18 05:01:35 localhost com.apple.xpc.launchd[1] (com.apple.configd): This service is defined to be constantly running and is inherently inefficient.

Aug 18 05:01:35 localhost com.apple.xpc.launchd[1] (com.apple.coreduetd): This service is defined to be constantly running and is inherently inefficient.

Aug 18 05:01:35 localhost iconservicesagent[58]: iconservicesagent launched.

Aug 18 05:01:35 localhost com.apple.xpc.launchd[1] (com.apple.CoreRAID): The HideUntilCheckIn property is an architectural performance issue. Please transition away from it.

Aug 18 05:01:35 localhost iconservicesd[57]: iconservicesd launched.

Aug 18 05:01:35 localhost com.apple.xpc.launchd[1] (com.apple.CoreRAID): The ServiceIPC key is no longer respected. Please remove it.

Aug 18 05:01:36 localhost com.apple.xpc.launchd[1] (com.apple.Kerberos.kdc[81]): Service exited with abnormal code: 1

Aug 18 05:01:36 localhost com.apple.xpc.launchd[1] (com.apple.Kerberos.kdc): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.

Aug 18 05:01:36 localhost hidd[91]: ____IOHIDSessionScheduleAsync_block_invoke: thread_id=0x1063f3000

Aug 18 05:01:36 localhost hidd[91]: HID Session async scheduling initiated.

Aug 18 05:01:36 localhost hidd[91]: HID Session async root queue running at priority 63 and schedule 2.

Aug 18 05:01:36 localhost iconservicesd[57]: Cache path: /Library/Caches/com.apple.iconservices.store

Aug 18 05:01:36 localhost kernel[0]: Previous shutdown cause: -62

Aug 18 05:01:36 localhost kernel[0]: DSMOS has arrived

Aug 18 05:01:36 localhost kernel[0]: IO80211Controller::dataLinkLayerAttachComplete(): adding AppleEFINVRAM notification

Aug 18 05:01:36 localhost kernel[0]: IO80211Interface::efiNVRAMPublished():

Aug 18 05:01:36 localhost kernel[0]: bpfAttach len 64 dlt 12

Aug 18 05:01:36 localhost hidd[91]: HID Session async scheduling complete.

Aug 18 05:01:36 localhost hidd[91]: Successfully opened the IOHIDSession

Aug 18 05:01:36 localhost kernel[0]: PPGTT is enabled

Aug 18 05:01:36 localhost com.apple.SecurityServer[73]: Entering service

Aug 18 05:01:36 localhost powerd[47]: Activity changes from 0xffff to 0x1. Assertions:1 HidState:0

Aug 18 05:01:36 localhost iconservicesagent[58]: Starting service with cache path: /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/com.apple.iconservices

Aug 18 05:01:38 localhost systemkeychain[135]: done file: /var/run/systemkeychaincheck.done

Aug 18 05:01:38 localhost thermald[43]: Waiting for OSTT support notification

Aug 18 05:01:38 localhost loginwindow[87]: Login Window Application Started

Aug 18 05:01:38 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system): Service "com.apple.ManagedClient.startup" tried to hijack endpoint "com.apple.ManagedClient.agent" from owner: com.apple.ManagedClient

Aug 18 05:01:38 localhost UserEventAgent[37]: Failed to copy info dictionary for bundle /System/Library/UserEventPlugins/alfUIplugin.plugin

Aug 18 05:01:38 localhost digest-service[96]: label: default

Aug 18 05:01:38 localhost digest-service[96]: dbname: od:/Local/Default

Aug 18 05:01:38 localhost digest-service[96]: mkey_file: /var/db/krb5kdc/m-key

Aug 18 05:01:38 localhost digest-service[96]: acl_file: /var/db/krb5kdc/kadmind.acl

Aug 18 05:01:38 localhost mDNSResponder[83]: mDNSResponder mDNSResponder-576.30.4 (Jul 22 2015 00:26:56) starting OSXVers 14

Aug 18 05:01:38 localhost UserEventAgent[37]: Captive: CNPluginHandler en1: Inactive

Aug 18 05:01:38 localhost com.apple.xpc.launchd[1] (com.apple.appkit.xpc.sandboxedServiceRunner): The JoinExistingSession key is only available to Application services.

Aug 18 05:01:38 localhost com.apple.xpc.launchd[1] (com.apple.lakitu): The JoinExistingSession key is only available to Application services.

Aug 18 05:01:38 localhost com.apple.xpc.launchd[1] (com.apple.accounts.dom): The _DirtyJetsamMemoryLimit key is not available on this platform.

 

[campyguy]

I can't offer help directly with the "previous shutdown cause: -62" at issue, however, one of my two Macs (a late-2013 rMBP) started experiencing random crashes with the 10.10.5 update while the other Mac (a 2012 Mini Server) has been rock solid (on the same OS). I know that the "-62" issue goes back years...

The difference? I waited a couple of days with the Mini Server and downloaded/installed the Combo update installer. After my last kernel panic on my rMBP, I ran the Combo installer and haven't had any issues since. I recommend finding the latest Combo installer update for your friend's Mac, install it, then use Disk Utility to repair permissions. Good luck!

 

[Diogones]

I can't offer help directly with the "previous shutdown cause: -62" at issue, however, one of my two Macs (a late-2013 rMBP) started experiencing random crashes with the 10.10.5 update while the other Mac (a 2012 Mini Server) has been rock solid (on the same OS). I know that the "-62" issue goes back years...

The difference? I waited a couple of days with the Mini Server and downloaded/installed the Combo update installer. After my last kernel panic on my rMBP, I ran the Combo installer and haven't had any issues since. I recommend finding the latest Combo installer update for your friend's Mac, install it, then use Disk Utility to repair permissions. Good luck!

Thanks for your help campyguy!

Well I do have an update on the situation that provides more troubleshooting information.

My friend's laptop was actually still running Yosemite 10.10.3 when I got ahold of it. Since it hadn't been updated for awhile since the 10.10.5 update, the App Store/Software Update app provided me with the Combined 10.10.5 update, which I believe is what you suggested installing campyguy. I downloaded and installed that, but the issue has continued.

However, I don't believe it is limited to her specific OS X installation or software! Just to rule out the possibility of faulty OS files, I removed her hard drive and installed a known good backup hard drive, and then installed Yosemite on that HDD. The Yosemite installer was the latest version downloaded from the App Store, so the fresh install was already at version 10.10.5. I used the computer with the clean install for a couple of days, doing stress tests and general tasks. Lo and behold, on the second day the Mac froze and the trackpad and keyboard were unresponsive. After about 20-30 seconds, the Mac shut itself off.

Just yesterday, I continued using the fresh install HDD, and while working with FileZilla, the Mac restarted itself, hung at the grey startup screen with no Apple logo, restarted again, and booted normally.

I think this could mean that it's the hard drive cable going out. I haven't seen the prohibitory sign or question mark folder icon at startup yet, but these issues seem to suggest a bad HDD flex cable.

Also, I noticed her power adapter was 85W instead of the 60W used with 13" pros. I asked her about it, and it seems that the original adapter had worn out and she had gotten the 85W adapter from a friend. She'd been using it for at least four months. I'm not sure if the adapter would have anything to do with the freezing and crashing, but I figured it was worth mentioning.

 

[campyguy]

Thanks for your help campyguy!

Well I do have an update on the situation that provides more troubleshooting information.

And, I have an update to your update...

First, this is the Combo installer I was alluding to: https://support.apple.com/kb/DL1833?viewlocale=en_US&locale=en_US - and AFAIK, the latest Yosemite installer is version 1.67 which installs 10.10.3. I also want to restate something - I had kernel panics with the 10.10.5 update that was provided by the MAS, and running/installing the linked-to Apple download (the Combo installer) has led to no further crashes/hangs; I almost always wait for Apple to post the Combo installer (generally later on the same day an update shows up on the MAS) and by installing a Combo installer I very rarely experience issues that others report after an update, so, to be clear about this the Combo update install has apparently "cured" my Mac's ills. FYI, I'd be in a non-admin user account using an app and my Mac would just quit and (after several seconds) I'd be returned to the Login screen - I'd see a report most of the time telling me about the panic; I no longer have those issues.

At a minimum, I recommend DLing and installing that Combo update, which also included a firmware update for my rMBP, and there were a couple of reboots. Do that first, then worry about the rest.

As to the higher-power adapter, I have no opinion on the matter. I use my iPad's 10W adapter for my iPhone - it just charges much faster than the adapter that shipped with my iPhone. I have this bookmarked in case one of ours dies: https://support.apple.com/en-us/HT201700

 

[Diogones]

Thanks again for your response campy.

OK, I'll download the Combo installer and run it on her system. At this point I'll try anything!

By the way, the latest Yosemite installer is no longer 1.67; it's 1.6.43, which does install 10.10.5, as I confirmed with my spare hard drive installation.

Additionally, I have yet more updates to share. When I booted up the Macbook this afternoon, I held down the Option key to select an external hard drive to boot up from in order to run more tests. While I was at the Startup Selector screen, which shows the available disks to boot from, the screen suddenly displayed several black and blue artifacts, and then rebooted. This tells me that the issue may lie elsewhere than the hard drive cable or my friend's OS X installation.

Sadly I didn't get a screenshot of this aberration, but I'll keep my eyes peeled in case I encounter it again. Since I still want to provide a visual aide to help describe this incident, I googled for a similar image and I'm embedding a youtube video of another Macbook Pro whose screen artifacts looked like what I encountered:

I also checked the crash logs after the screen artifacts reboot, and I found another previous shutdown cause: -128.

I'm going to do some more research and find out if that error code means anything. I also think you're right about the adapter there campy: other reports online have revealed that there doesn't seem to be an issue with using a higher wattage adapter with a lower power computer.

Additionally, I read that sometimes memtest will not always pick up bad RAM no matter how many passes you run. Since some of the symptoms this computer is experiencing could point to bad RAM or a bad RAM slot, I decided to swap out the 4GB pair with 2GB sticks for a total of 4GB. I'll report back if this or the Yosemite Combo Update installation fixes the issue.

 

[Diogones]

Well it turns out that I was able to locate and discover the issue! It wasn't the memory after all, as the errors continued even after swapping out the 8GB for 4GB. The problem was in fact the RAM slot! The lower one, closer to the keyboard, not the upper slot. I discovered this after I found a helpful Youtube video that describes the RAM slot tap test:

First, I removed the back cover of the Macbook Pro. Second, I took out one of the RAM sticks, so only one is installed. Third, I booted up the Mac to the desktop. Finally, I gently tapped the actual RAM slot, not the module itself. While the slot is tapped on, I check the screen to see if there are any artifacts or system lockups. The exact same artifacts like in the screenshot above appeared when I tapped the bottom slot with a stick installed! In a few instances, the system would lock up and either reboot or just remain stuck, with no response from either the keyboard or trackpad.

As the Youtube video mentions, it seems that the bottom RAM slot is more likely to failure than the top slot. I'm not sure why that is, but it definitely applied to my friend's laptop. When I put the RAM stick in the top slot and tapped, nothing happened at all and the system continued to run without issue. I did this test several times with the different RAM sticks just to rule out a bad RAM issue.

I wanted a second opinion as well, because although the tap test did replicate the issues my friend and I had been experiencing with the machine, I still wanted to be absolutely sure that there wasn't something else causing the problem.

So I took the MBP to my local Apple repair shop and had them run diagnostics on it for a week. They ran brutal stress tests and benchmarks to punish the graphics and other system components to help rule out overheating or defective graphics or CPU. They also ran several diagnostic tests, including some of the ones I had already tried, such as memtest. Even after running the computer full blast for a week they were unable to replicate the issue I was experiencing. When I suggested they use the tap test, the screen artifacts and system lockups and restarts occurred.

As a result of the repair shop's work on the Mac, the techs there and I agreed that it had to be a bad RAM slot. They suggested simply using a single 8GB stick in the upper working slot, as a motherboard replacement would be a little pricey (around $400 to $500) and possibly out of my friend's budget.

I've replaced the two 4GB sticks that she had in the machine when she gave it to me with a single 8GB Crucial module I bought from Amazon, and so far the machine has been problem free for a week. Hopefully this is the last we've seen of this problem and my friend can go back to using it all the time.

I hope that the Youtube link and my experience troubleshooting this issue will help others who may run into this problem. It can be difficult to diagnose because the system lockups, freezes, and screen artifacts never left any kernel panic logs. Additionally, Apple Hardware Test, Techtool Pro, and other diagnostic programs were unable to identify the bad memory slot as an issue. Even memtest, which can show errors related to a faulty RAM slot came up clean every time it was run on the system. The only error messages that seemed relevant were the cryptic "previous shutdown cause: -62 and -128" entries I found under the system.log inside Console. Perhaps those error codes relate to a memory issue such as bad RAM slots.

In any event, I'd like to thank everyone again who offered their advice to me and my friend! I'm marking the thread as solved.