Cauldron Caller Mac OS

One of Yosemite’s best features is its ability to make calls and send texts via the iPhone. This is not done through iMessage and Facetime (though it still c. MacOS Big Sur elevates the most advanced desktop operating system in the world to a new level of power and beauty. Experience Mac to the fullest with a refined new design. Enjoy the biggest Safari update ever. Discover new features for Maps and Messages.

Resolving Kernel Panics

The 'You need to restart your computer' alert indicates a kernel panic. This FAQ, based on the 'Kernel Panics' chapter of our book Troubleshooting Mac® OS X, provides a set of procedures which should resolve most kernel panics.

Additional information, including how to use and interpret panic logs for troubleshooting, can be found in the 'Kernel Panics' chapter of Troubleshooting Mac OS X.

Before you begin...

The procedures defined herein constitute a testing road map and should be followed in the order specified. Read this FAQ thoroughly before proceeding in order to familiarize yourself with the steps and assure you have the necessary resources available.

WARNING:

Some of the testing procedures defined herein may require that you:

  • Connect and disconnect peripheral devices.
  • Work inside your computer.

Follow all safety instructions specified in the Apple® manual which accompanied your Mac.

In particular:

  • Shut down your Mac and disconnect external power before working inside your Mac.
  • Where feasible, remove the battery before working inside a laptop or portable computer.

Consult the manual that shipped with your Mac for all safety procedures.

Always follow all Apple-recommended safety procedures without fail.

Causes of kernel panics

General causes of kernel panics

Kernel panics are often caused by one or more of the following issues.

  • Defective or incompatible RAM often causes of kernel panics. Despite being a highly-reliable product, RAM can fail. Modern operating systems, like Mac OS X, are sensitive to RAM. Purchase additional RAM from either Apple or third parties who guarantee their RAM is compatible with Mac OS X, offer a liberal exchange policy, and provide a lifetime warranty should the RAM become defective or a later version of Mac OS X introduce incompatibilities.
  • Incompatible, obsolete, or corrupted kernel extensions. If a third-party kernel extension or one of its dependencies is incompatible or obsolete with respect to the version of Mac OS X you are using, kernel panics may occur when the kernel executes such extensions. Likewise, if a kernel extension or one of its dependencies is corrupted, such as the result of hard disk corruption, kernel panics are likely to occur when the kernel attempts to load or execute such.
  • Incompatible, obsolete, or corrupted drivers. Similar to kernel extensions, drivers for third-party hardware which are incompatible with the version of Mac OS X you are using, or which have become corrupted, will cause in kernel panics.
  • Hard disk corruption, including bad sectors, directory corruption, and other hard-disk ills.
  • Incorrect permissions on System-related files or folders.
  • Insufficient RAM and available hard disk space.
  • Improperly installed hardware or software.
  • Defective hardware or software. Hardware failures, including a defective CPU, or programming errors can result in kernel panics.
  • Incompatible hardware. While rare, this is generally the result of a third-party hardware vendor’s product failing to properly respond to the kernel or a kernel extension in an expected way.

Specific causes of kernel panics

The follow specific issues, including a variety of Mac OS X bugs, are known to cause kernel panics. If none of the following issues apply, proceed to the 'Troubleshooting kernel panics' section.

  • A Mac that is incompatible with Mac OS X or is missing the System folder. If you receive a No driver for this platform message along with a kernel panic:, then:
    • Your Mac may be incompatible with Mac OS X.
    • Your Mac’s System folder may be missing or damaged.
  • See the AppleCare® Knowledge Base document “Mac OS X: ‘No Driver for this platform’ Message.”
  • Outdated firmware. Firmware-related bugs have been known to cause kernel panics. Firmware updates for your Mac may not appear in Software Update. Check for updates to your Mac's firmware by searching Apple Downloads for firmware updates for your specific model of Mac. For example, if you have an iMac®, use the search criterion iMac firmware to search for iMac-related firmware updates. Download and install applicable firmware updates.
  • To determine the current version of firmware installed on your Mac:
    • Open System Profiler, located in the Macintosh HD > Applications > Utilities folder.
    • In the Contents pane — the left pane of the System Profiler window — select Hardware.
    • The Hardware Overview for your Mac appears in the right pane of the System Profiler window.
      • Your Mac's current Boot ROM firmware version is shown in the Boot ROM Version field. The Boot ROM firmware loads the operating system when you start up your Mac.
      • Intel®-based Macs have a second firmware element specified in the SMC Version field. The SMC is the System Management Controller, which is responsible for the computer's power-management functions. See also the AppleCare Knowledge Base document 'EFI and SMC firmware updates for Intel-based Macs.'
  • Improperly installed or loose AirPort® or AirPort Extreme® card. The card may have been installed upside-down or become dislodged. Consult the manual that came with your Mac for instructions on properly installing the AirPort or AirPort Extreme card. If your manual isn't handy, you can download a copy from the 'Apple Manuals' page.
  • Incorrect version of AirPort software with an AirPort Extreme card. Running an incorrect version of AirPort software with an AirPort Extreme card will result in a kernel panic. See the AppleCare Knowledge Base document “AirPort Extreme: Computer Doesn’t Start After Installing Card.”
  • Corrupted sleepimage file on Mac portable computers employing safe sleep.
  • Corrupted Time Machine® backup disk or backing up a corrupted disk or corrupted files with Time Machine.
  • Journaling-related kernel panic. If the panic log begins with:
    • panic(cpu 0 caller 0x0nnnnnnn): jnl: transaction too big...
  • where nnnnnnn is a number representing a memory address, then see our 'Journal-related kernel panic under Tiger' FAQ.
  • Other Mac OS X bugs. Search the AppleCare® Knowledge Base for 'kernel panic' (including the quotes), specifying the following additional search criteria:
    • Restrict by product: Choose your version of Mac OS X.
    • Restrict by document type: Choose Troubleshooting.

Troubleshooting kernel panics

General advice for resolving kernel panics and other startup problems can be found in the following AppleCare Knowledge Base documents:

Mac OS X versionAppleCare Knowledge Base document
Mac OS X 10.5 & 10.6'You need to restart your computer' (kernel panic) message appears (Mac OS X v10.5, 10.6)'
Mac OS X 10.4:'You need to restart your computer' message appears.'
Mac OS X 10.3 and earlier:'Your Mac won't start up in Mac OS X (Mac OS X 10.3.9 or earlier).'

If the instructions in these AppleCare Knowledge Base document do not resolve the issue, try the following steps:

1. Rule out incompatible third-party kernel extensions, Startup Items, and Login Items.

Start up in Safe Mode and use your Mac normally for a time to see if the panic recurs. Third-party kernel extensions, Startup Items, and Login Items are not loaded in Safe Mode. Note that running in Safe Mode may prevent you from using third-party hardware that depends upon associated third-party kernel extensions.

If the problem does not recur, then this implies a third-party kernel extension, Startup Item, or Login Item may be the cause.

  • You can identify third-party kernel extensions by examining the panic log and then troubleshooting them by process of elimination. You may also be able to identify the culprit by following steps 5 and 6 below.
  • To rule out corrupted or incompatible Startup Items or Login Items, follow the procedure specified in our 'Troubleshooting Startup and Login Items' FAQ to ascertain if these are causing kernel panics.

2. Rule out major hardware problems

Kernel panics frequently result from major hardware problems with your Mac. To rule these out, follow the instructions in our 'Apple Hardware Test' FAQ to run the Apple Hardware Test distributed with Macintosh® computers manufactured in recent years. In particular, consider the instructions for running the test in Loop Mode which, if supported, is often effective in identifying hardware-related causes of intermittent kernel panics.

If you Mac predates the distribution of the Apple Hardware Test, our 'Apple Hardware Test' FAQ also recommends third-party utilities for hardware testing.

If the Apple Hardware Test or your third-party hardware-testing utility identifies problems with RAM, remove the RAM DIMMs (Dual Inline Memory Modules, colloquially known as 'sticks') indicated as having failed the hardware test.

If the Apple Hardware Test or your third-party hardware-testing utility identifies problems other than RAM, have these repaired.

Notes about RAM testing
  • If kernel panics have occurred immediately after installing new RAM, assure the DIMMS are properly installed and correctly seated in their expansion slots, the sockets into which the DIMMs are installed.
  • While the Apple Hardware Test will almost invariably find defective RAM, there have been situations where defective RAM has been missed. As RAM problems are the leading cause of kernel panics, you may wish to perform additional RAM tests. Additional methods of testing RAM include third-party RAM tests and testing by process of elimination.
    • Third-party RAM tests. Third-party utilities which provide RAM testing include:
      • Micromat TechTool® Pro and TechTool Deluxe, the latter provided with an AppleCare Service Plan prior to March 2011.
      • The freeware command-line utility Memtest. The freeware utility Rember provides a graphical user interface (GUI) to Memtest.
    • Testing RAM by process of elimination. You can test individual RAM DIMMs by process of elimination:
      • If your Mac has multiple RAM DIMMs, you can remove all but one and retest your Mac to see if kernel panics recur. If kernel panics do not recur, reinstall a second RAM DIMM and retest. Repeat this process until you have tested all of your RAM. If kernel panics recur at any point, the last DIMM you reinstalled is probably defective and should be replaced.
      • You can also test a known, good DIMM in different expansion slots to help rule out the possibility of a defective slot.
  • Some Macintosh computers, including iBook® and iMac models, have factory-installed RAM, either directly installed on the logic board or in a factory-only accessible memory slot. This RAM cannot be removed for testing purposes. If this RAM proves to be defective, your Mac must be taken in for service. You can only test RAM by process of elimination if that RAM is installed in the user-accessible memory slots in your Mac. Consult the manual which came with your Mac for details and instructions concerning installing and removing RAM.

3. Repair disk and permissions on your Mac OS X startup disk

Run Steps 1-3 of our 'Resolving Disk, Permission, and Cache Corruption' FAQ to assure that your Mac OS X startup disk is free of problems.

4. Assure you have sufficient RAM and available disk space

See our 'Problems from Insufficient RAM and Free Hard Disk Space' FAQ.

5. Rule out an incompatible, defective, or corrupted third-party application

If kernel panics consistently occur when using a specific application:

  • Check the Web site of the application’s developer, publisher, or vendor for updates to the application. Install updates if available.
  • Uninstall, then reinstall the application and any available updates.
  • Contact the application’s developer, publisher, or vendor for further advice.

6. Eliminate other potential hardware problems

6.1. Assure drivers and kernel extensions for third-party hardware are current

If you have installed third-party hardware or peripherals that required you to also install specific, vendor-provided software, such as drivers or kernel extensions, to support that hardware under Mac OS X, check the vendor's Web site to assure you have the latest version of the required software. If the version of the required software installed on your Mac is not current, install the latest version.

Examples of such vendor-provided software include:

  • Drivers or customization utilities for third-party mice or keyboards.
  • Drivers for third-party broadband modems, such as USB-attached cable or DSL modems.
  • Drivers for third-party expansion cards.
  • Drivers for the retail versions of third-party video cards.
6.2. Verify connections, cables, and proper installation

Following all of the safety instructions documented in the Apple manual which accompanied your Mac, assure all connections and cables associated with peripherals or internal hardware additions you have installed are good.

If you have installed new hardware inside your computer, such as a new video card, hard disk, or AirPort card assure that these devices are properly installed.

6.3. Remove peripherals and third-party hardware additions
Cauldron caller mac os download

Incompatible hardware -- peripherals and hardware additions -- or vendor-provided software related to such -- such as kernel extensions -- can cause kernel panics. Ruling out these items by process of elimination is required if testing to this point has not resolved kernel panics.

  1. Following all of the safety instructions documented in the Apple manual which accompanied your Mac, remove all hardware additions that you have made to your Mac:
    1. Remove all peripherals -- USB, FireWire®, and related devices -- except the Apple mouse, Apple keyboard, and monitor.
    2. If you have added other internal devices, such as third-party expansion cards, remove these as well.
    3. Note: Some hardware or peripherals you have added to your Mac may have also required you to install vendor-supplied software, such as drivers or kernel extensions, to support that hardware under Mac OS X. If you are removing hardware that required associated software to be installed, you should also uninstall that software. Consult the documentation that came with the third-party hardware and its software for instructions on uninstalling the associated software.
  2. Start up your Mac and see if the kernel panic recurs. If the panic does not recur, the cause was likely a problem related to one of the hardware additions, or its associated software, you removed in step (1).
  3. Shut down your Mac. Reconnect or reinstall one of the removed hardware components, again following all of the safety instructions documented in the Apple manual which accompanied your Mac. If vendor-provided software is required for this component, install the latest available version of that software as well.
  4. Restart your Mac. If the kernel panic recurs, the last hardware component you added, or its associated software, if any, is the culprit. Remove this component and uninstall any associated vendor-provided software.
  5. Repeat steps (3)-(4) until you have reconnected or reinstalled all of the hardware components and any associated vendor-provided software removed in step (1) exceptthose which caused kernel panics.
  6. Contact the manufacturer of the component(s) responsible for the panics, or check their Web sites, for updated drivers or further advice.

If all else fails...

If you have followed all of the troubleshooting steps above and none of the steps have either uncovered a cause or resolved the kernel panics, the following are your remaining options:

  1. Reinstall Mac OS X:
    • If you are running Mac OS X 10.6, see the AppleCare Knowledge Base document 'Mac OS X 10.6 Help: Reinstalling Mac OS X.'
    1. If you are running Mac OS X 10.5 or earlier, use the Archive and Install process. See our 'General advice on performing an Archive and Install' FAQ.
  2. Perform an Erase and Install of Mac OS X:
    • If you are running Mac OS X 10.6, see the AppleCare Knowledge Base document 'Mac OS X v10.6 Snow Leopard: How to Erase and Install.'
    • If you are running Mac OS X 10.5 or earlier:
    1. Backup your personal data using your comprehensive backup and recovery solution.
    2. Start up from your Mac OS X Install disc and erase the Mac OS X startup disk using Disk Utility. Use the Security Options to 'Zero Out Data' or 'Zero All Data' depending on the version of Mac OS X you are using. See our 'Resolving Disk, Permission, and Cache Corruption' FAQ for instructions on running Disk Utility from your Mac OS X install disc.
    3. Reinstall Mac OS X using the Erase and Install option.
    4. Reinstall your third-party applications, omitting the following:
      1. Third-party interface modifications, hacks, or 'haxies.'
      2. Third-party Menu Extras.
    5. Restore the data you backed-up in step (a).
  3. Take your Mac in for service. If there is an Apple Retail Store in your area, we recommend taking your Mac there. Otherwise, you may be able to find an Apple Authorized Service Provider (AASP) in your area. To locate an AASP:
    1. In the US, search this page.
    2. If you are outside the US, see this page or contact Apple for assistance.

Using and interpreting panic logs

Comprehensive advice on using and interpreting panic logs can be found in the 'Kernel Panics' chapter of Troubleshooting Mac® OS X.

Obtaining help with kernel panics

Kernel panics usually generate a file called a panic log. The structure and location of this file depends on the version of Mac OS X you are using:

  • Under Mac OS X 10.6, panic logs are saved in the Macintosh HD > Library > DiagnosticReports folder. Every panic log is saved in a unique file with a name conforming to the format Kernel_timestamp_computername.panic where timestamp is the date and time of the panic in YYYY-MM-DD-HHMMSS format and computername is the name specified in the Computer Name field of Sharing preferences.
  • Under Mac OS X 10.5, panic logs are saved in the Macintosh HD > Library > PanicReporter folder. Every panic log is saved in a unique file with a name conforming to the format timestamp.panic where timestamp is the date and time of the panic in YYYY-MM-DD-HHMMSS format.
  • Under Mac OS X 10.4 and earlier, panic logs are saved in the panic.log file in the Computer > Macintosh HD > Library > Logs folder. The panic.log file contains the logs from all panics, the most recent at the end of the file.

Note that there are three exceptions which prevent automatic panic logging:

  • If a kernel panic occurs immediately after the startup tone sounds, a panic log may not be written as the file system has yet to be mounted.
  • If remote debugging has been enabled via the debug parameter in boot-args, automatic panic logging is disabled.
  • If the kernel panic is the result of corrupted components of the kernel itself, such as code associated with writing to hard disks or other I/O (Input/Output) peripherals.

If you have performed all of the troubleshooting steps specified above in the Troubleshooting kernel panics section of this FAQ, and the source of the kernel panics remains unidentified, then you can post recent panic logs to the appropriate forum on the Apple® Discussions for analysis. The appropriate forum is the one corresponding to the version of Mac OS X you are using.

We recommend that you do not post the panic log until after you have performed all of the tests recommended above in the Troubleshooting kernel panics section. Otherwise, you will probably be referred back to this FAQ to perform the tests.

If you are using Mac OS X 10.5 or later, post the contents of the most recent panic log.

If you are using Mac OS X 10.4 or earlier, copy and paste the most recent panicfrom the end of the panic.log file to a post. If your Mac has experienced multiple kernel panics, remember that the panic.log file contains a panic log for each kernel panic. Post only the most recent panic logs, which will be at the end of the panic.log file. For example, post just the panic logs from kernel panics which occurred today.

If any of the tests revealed problems, be sure to note that in your post. Likewise, if the panics consistently occur when using a specific application, be sure to note that application in your post, including its name and the version of the application you are using.

Related links

Linux

Tracing system calls on Linux is straightforward. The ptrace API letsone process trace all system calls made by another process, and thecommand-line program strace uses ptrace to allow a user to do thesame.

Cauldron

Mac OS X

Tracing system calls on Mac OS X is a little harder, but more powerful.The dtrace system ships with Macs starting with Mac OS X 10.5. Unlikestrace, however, support for dtrace has to be built in to programs. MacOS X ships with several thousand probes (the attachment points), and mostnormal monitoring is covered. Brendan Gregg’s blog has a Mac OS X-specificdtrace page, as an example, and there are other useful tutorials

Apple added ptrace to Mac OS X, maybe. There’s a man page for it, but nostrace program for user-level use. I’ll have to try writing some code.

There are ways to hook/override program and system functions at runtime.These work but aren’t truly supported, so are of most use for debuggingsituations.

Amit Singh went the kernel extension approach to get access to system calls

While there are definitely nefarious uses for this stuff, it can be used fordevelopers too. For example, this paper talks about rootkits, but the techniquesalso make for great developer tools.

BSD

The equivalent to ptrace on BSD is ktrace. Unfortunately, ktrace is notavailable on Mac OS X. That’s annoying, because it is complementary toDTrace, which is an awesome sysop-level tool, but does not give completeaccess to all system calls. Mac OS X had ktrace in 10.4 and earlier.

Windows

There is the amazing Process Monitor, which traces all file and registryactions. However, this is strictly a user-level program, you work with it throughits GUI. It’s very useful, but does not give you system-call level access fromyour own source code.

There is a fairly new project called StraceNT. It comes with source code.

Dr. Memory comes with “strace for Windows” called drstrace.

Event Tracing for Windows (ETW) is the Microsoft official technique, and hasseveral programs layered on top.

There is Logger and LogView, also Microsoft tools

There is NtTrace

An article

fabricate

This is a python build tool that watches for files that have changed as a resultof running a command. It uses strace on Linux but does filetime watching onWindows, so maybe look for how to get Python on Windows to use one of the otherfile monitoring solutions?

tup

The tup build tool uses DLL injection on Windows to detect file I/O.

ninja

The ninja tool also does filesystem watching, I think.

Cauldron Caller Mac Os 11

Google “building in the cloud”

Cauldron Caller Mac Os Catalina

This is a FUSE-based approach, so not exactly tracing system calls.