El Capitan froze and rebooted (Macbook Pro Retina Mid 2012)

• 2.3 Ghz Intel Core i7 8GB DDR3: Was running NetAdmin Pro which is monitoring my office LAN, processors consumption was at ~15 - 20%. Simultaneously I ran WiFI Explorer, 3.7% no more than 5% CPU usage. And I was updating Xcode to v 7.3.1 and was browsing and watching video from playground.ru

• Watch the videos until half of it (20mins) the Video froze I moved the mouse and turned out the whole OSX is frozen.

• littleSnitch v 3.7 has no reaction

• I immediately pull the Ethernet adaptor and MacBook just went to black screen. I then switch off the wireless router. (My MacBook Pro is connected to the network via Ethernet adaptor and via WiFi router bearing different IP, I was thinking of cutting both network communication, in case it was an intrusion)

• MacBook just restarted itself to login screen, after 15-20 sec of black screen and total silence)

• I again restarted and booted into Recovery mode use disk utility. After completing disk check.

• Login and previously opened programs resume back (NetAdmin Pro, WiFi Explorer, Yandex browser, Activity Monitor and AppStore)

• AppStore doesn't resume the download everything else is functioning normally and in Addition I have got my calendar open after login (I did not launch accidental nor was it set to start with system login)

Question 1: Are there any way to know what was happening and what was OS El Capitan last reaction before it froze and rebooted?

Question 2: Are there any software better than "Console" v10.11 to interpret what was going on before it crashes?

P.S. Thank you in advance, I will try to upload the Console messages later from the MacBook Pro

DDT-2:~ Chaleune$ syslog | grep -i "shutdown cause"

Jun 22 14:15:37 DDT-2 kernel[0] <Notice>: Previous shutdown cause: 5

Jun 22 20:34:46 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 23 15:18:23 DDT-2 kernel[0] <Notice>: Previous shutdown cause: 5

Jun 24 17:58:32 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 24 20:09:52 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 24 22:58:15 localhost kernel[0] <Notice>: Previous shutdown cause: 5Jun 25 14:43:36 DDT-2 kernel[0] <Notice>: Previous shutdown cause: 5

Jun 25 21:55:31 localhost kernel[0] <Notice>: Previous shutdown cause: 3

Jun 25 22:20:57 localhost kernel[0] <Notice>: Kext com.apple.driver.AppleOSXWatchdog failed to load (0xdc008012).Previous shutdown cause: 5

Jun 26 10:18:44 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 26 12:09:45 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 26 18:00:31 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 27 13:05:58 DDT-2 kernel[0] <Notice>: Previous shutdown cause: 5

Jun 27 22:56:11 localhost kernel[0] <Notice>: Previous shutdown cause: 5

Jun 28 14:18:27 DDT-2 kernel[0] <Notice>: Previous shutdown cause: 5

*Jun 29 18:56:21 localhost kernel[0] <Notice>: Previous shutdown cause: -128*

Jun 29 23:31:22 DDT-2 kernel[0] <Notice>: Previous shutdown cause: -128

Opensource.apple shows the following

• dsIllInstErr = 3, /illegal instruction error/
• dsChkErr = 5, /check trap error/
• userCanceledErr = -128

macwizard gave the following interpretation:

• 03 Illegal Instruction The computer has a specific vocabulary of machine language instructions it can understand. If a computer tries to execute an instruction that isn't in its vocabulary, you see this error code. It's less likely than error 02, but still very common.
• 05 Range Check Error Programmers can use an instruction in the Motorola 68000 to check if a number is within a certain range. This error indicates that the number tested isn't in the specified range.
• -128 userCanceledErr User canceled an operation

Solution 1:

Run a sysdisgnose. That is how Apple receives feedback from seeding/beta customers. The keyboard shortcut is Cmd Opt Ctrl Shift Period.

You can also run sudo sysdiagnose -f ~/Desktop/ in Terminal. The former will save to /var/tmp and the latter will save to the Desktop.

Sysdiagnose will contain pretty much A to Z.

You should be sure to check the disks.txt, diskutil.txt, errorlog.txt, logs.txt, and the diagnostics folder.

Solution 2:

Shutdown cause numbers are different from Error Codes. For example, a shutdown cause of 0 means that your Mac lost power. An error code of 0 (in Bash, for example) means that the function or command exited normally with no error. Apple has this backward.

Using this case as an example, *Error code -128" in software means user canceled, while shutdown cause -128 is undefined.

So, in the output you provided, you have 3 error codes: 3, 5, and -128.

• cause 3 is a "dirty" shutdown meaning that something was force quit and/or the power button was held down to power off the system

• cause 5 is a clean exit and there is nothing to worry about

• cause 128 is "undefined." However, most of the time that I have run across this has been either memory or the logic board

  • Shutdown Cause -128
  • MBP Retina 15 inch, late 2013 shuts down randomly

The best way to diagnose this is to run Apple Hardware Test (AHT) with one of your memory modules removed (Mid-2012 and earlier. 2013 and newer models have modules that cannot be removed). Hold D while booting from a powered off state with the AC adapter plugged in. If your test comes out clean, shutdown, remove the module and replace it with the first one that you removed. Re-run AHT.