Your Mac is probably pretty much trouble free, at least most of the time. But occasionally you may experience a system, process, or app crash that stops you in your tracks, and prevents you from continuing to work. These crashes are usually fleeting in nature, and resolved by simply relaunching the app or restarting your Mac.
And while an occasional crash can be frustrating, it’s generally not something to worry too much about. Stuff happens, and you can think of it as one of the many reasons you have a good backup system in place. (You do, don’t you?)
Now, when a crash starts occurring on a more regular basis, or you notice it always happens when x event occurs, it may be time to start delving into the crash and discover what may be causing the problem.
In this Rocket Yard Guide, we’re going to take a look at using the Console app to track down the cause of a system or app crash. With any luck, the Console app will be able to help you resolve the problem that’s causing the crash, or at least give you a good idea of what’s going on.
What is the Console App?
Back in the early years of computing, the console was a terminal that was attached to a computer to monitor the status of the system. If you go back even further, the console may have been a bank of meters, lights, and switches that indicated how well the computer was operating.
The Console app included with the Mac is a modern-day version of the old computer console; its primary job is to help you monitor how well your Mac is operating. It can do this because of its ability to display logs, status, and error files your Mac’s operating system and individual apps generate as they’re running.
Log Files
There are a number of different types of files that apps, processes, and the system generate as they work; you can think of them as a journal or diary of what’s going on at any point in time. While there are diagnostic files, crash files, log files, and a few other types, we’re going to refer to them collectively as log files. And for the most part, they can all be read by the Console app.
The Console app can also look at process messages, and a few other real-time events, but we’re going to concentrate on looking at log files to discover what happened in the past, such as when the system or an app crashed.
Introduction to Console
Even if you haven’t experienced a recent system or app crash, or an unexpected restart, go ahead and launch the Console app, so you can become familiar with the interface.
Launch Console, located at /Applications/Utilities.
Console may look a bit different, depending on the version of the Mac operating system you’re using. Most changes from system to system are cosmetic, such as a few name changes here and there, although there was a significant change going from OS X El Capitan to macOS Sierra. The primary change was the removal or relocation of some troubleshooting tools used when looking at real-time events. Since we’re not developers trying to track down bugs, that shouldn’t have much effect on our use of Console to review log files.
With the Console app open, you’ll see a multi-pane interface, with a sidebar used to select either real-time messages or log files for display, a toolbar across the top, and in new versions of Console, a search bar and tab bar just below the toolbar.
Accessing Log Files
Log files you may be interested in reviewing for information about what caused a crash are found in the Console sidebar under the heading:
- User Reports (User Diagnostic Reports in earlier versions of Console): Crash reports for user processes and applications.
- System Reports (System Diagnostic Reports in earlier versions of Console): Analytics, diagnostics, and crash reports for system processes.
- System log: A log of current system events and messages.
- ~/Library/Logs: Application logs for the current logged in user.
- /Library/Logs: Application and process event logs for all users.
- /var/logs: Log files for maintenance scripts used by the system.
To access a log file, select the category in the sidebar you’re interested in. If the category has a chevron next to its name, expand the chevron by clicking or tapping on it.
A list of log files will be displayed, either within the sidebar or in the main viewing pane, depending on the Console version you’re using.
Select one of the listed files to view its content.
The log file names usually contain the process or app name that generated the file, the date, the name of the Mac, and finally, the file type, such as crash, diag, or analytics.
For the most part, the crash logs will be the ones you’ll be interested in for troubleshooting system or app crashes, but the diag ones are also interesting to review, since they may contain information about unusual memory usage or high levels of CPU usage.
Understanding Reports
Crash reports are broken into multiple sections, with the first section containing all the information about what process crashed:
- Process: Lists the name of the process, such as TextEdit.
- Path: The process location.
- Identifier: The unique process name, such as com.apple.textedit.
- Version: The version of the app or process.
- Code Type: The processor type the code is meant to run under.
- Parent Process: If the process that crashed was spawned by another process, it will be listed here.
- Responsible: Usually the app or process name or developer.
- User ID: The user ID in use by the app or process.
The next section tells you when the app or process crashed:
- Date/Time: The date and time when the process or app terminated.
- OS Version: The version of the Mac OS that was running at the time of the crash. An interesting side note: Console still uses OS X as the operating system name, although the version number is correct.
- Report Version: The version number of the crash report style in use.
- Anonymous UUID: This is a long string of numbers and letters that are a unique identifier of the process.
- Time Awake Since Boot: How long the system has been running, displayed as the number of seconds.
- System Integrity Protection: Shows status of SIP.
And finally, the meat of the problem: what caused the crash.
- Crashed Thread: Which process thread was running when the crash occurred.
- Exception Type: This is the actual event that caused the crash.
- Exception Codes: Additional details about what caused the exception type.
- Exception Note: Message, if any, generated by the crash.
- Termination Signal: The name of the signal type used to tell the process to quit.
- Termination Reason: The category for why the termination signal was initiated.
- Termination Process: Which process initiated the termination.
The next long section of the report lists what led to the crash in reverse chronological order, starting with the thread listed as the cause. This may seem like a goldmine for discovering what caused your crash, and it is. This section and the next, which is called a backtrace, can be very helpful for the developer to troubleshoot a system or app crash. However, it’s usually not very helpful for most users.
What Can I Do With This Information?
One of the best things you can do is contact the developer, open a support ticket, and send in this crash report. Developers need this type of information to troubleshoot and refine their apps or code.
Depending on the version of Console you’re using, you can either:
Use the Save As command under the File menu to save a copy of the crash report, which you can then send to the developer. Or, if you’re using a later version of Console, you can use the Share button in the toolbar to attach the crash report to an email.
You can also right-click on the crash report name and select Reveal in Finder from the popup menu. You can then use the Finder to make a copy to send along to the developer.
If you’re trying to resolve the crash on your own, pay attention to the exact time the crash occurred, then check the diagnostic logs and analytics logs for unusual events that may have occurred at or near the same time. You’re looking for excessive memory or CPU usage, as an example. You may find, for example, that WebKit, a core component of Safari, was using a great deal of RAM when the crash occurred, something you may be able to correct by adding more RAM. Or, perhaps CPU usage was so high that on a hot summer day, your Mac couldn’t cope with the high temperatures.
Another thing to look at is the app version that was crashing. Many times an app crash can be caused by an out-of-date version. Check with the app developer to see what the current version is, and which version, if any, is recommended to run on your version of the Mac OS.
For more information about using the Console app, you can find details on advanced usage at Apple’s support site for Console Help.
This is a gr8 interpretation of a crash process and its constotutive elements. Do you have a ‘blueprint’ for any log files, e.g. how each line of log output is structured (PID, service name, error code level, etc)?
But what if the app that is crashing is an application component of OS X system software itself??? For example I have an app called lockoutagent which launches automatically and relaunches and recrashes. Once I click Ignore on the “quit unexpectedly” notice, it launches and crashes again. How to even find out what keeps launching the task repeatedly to shut it up long enough to be able to deal with solving the crash without the stupid crash notice popping up interrupting what you are doing taking focus off your current window so you can’t type anything unless you leave the cr5ash report on the screen which blocks an annoying amount of screen space. Curiously I also found in Console that there system.log is “unreadable”.. huH?
If you find a suspicious error message, try entering it into a search engine. Others may have faced and solved that problem. About six weeks ago doing that provided me with enough information to solve a problem that was leaving my Mac mini almost paralyzed.