Spinning beachballs which some people may confuse for kernel panics are rarely related to kernel panics!
Resolving kernel panics may take steps which require you have a backup in place first. If you don't have a
backup, look over
backup FAQ before proceeding!
For more on things which may cause the system to become sluggish enough to have a spinning beachball cursor
read this FAQ unless one of these other clear signs of a kernel panic is happening.
The kernel panic FAQ is divided into the following sections:
Kernel panics sometimes are visible, and other times are not directly visible:
Sometimes Mac OS X may tell you it needs to restart the computer with one of these two kinds of screens:
Mac OS X 10.0 to 10.1.5 will show the above type of response on your display
Mac OS X 10.2 will show the above image transparently over your display
Some have mentioned these images may be hard to read on a laptop screen.
I would also look at the Panic.log file with the Console program on your machine
to see what may have caused the kernel panic if you get one.
Migrating from PowerPC to Intel Macs may create a situation where a kernel panic can
happen. The drivers are different enough between both platforms, and the Migration Assistant
program may not always be sensitive enough to detect an issue.
Additionally, if you use Guest accounts in Snow Leopard, a bug has been that
wipes the guest account contents entirely. Currently being researched
by some people on Apple Discussions as to the cause. It may related to an earlier
10.4 bug that I indicated below, about using the Migration Assistant between PowerPC
and Intel Macs. Instead if you have done so, be sure to
backup at least twice
and if necessary, rename the Guest account something else and give it admin access until
the issue has been resolved. You can also migrate from PowerPC to Intel Macs using the user tip on:
https://discussions.apple.com/docs/DOC-2295
Directory failures and kernel panics
The directory may fail, due to an accident caused by Norton Utilities or Systemworks, which may at random
corrupt a directory even when trying to repair it. If the directory is corrupted, some files may become missing
to the operating system, and that triggers a kernel panic if those files are related to the operating system's own drivers.
Norton Anti-Virus will not do this, but Disk Doctor and Speed Disk have a history of doing this.
An uninstaller has been made
available here. To fix your directory
first backup your data to an external Firewire or SCSI hard disk, and make sure it is bootable using
Carbon Copy Cloner or
Retrospect Express.
Make sure you have at least two backups of all necessary data if you are using Panther (Mac OS X 10.3), as
there is an issue with some
Firewire drives, including some Oxford 911 drives not listed in the link that may cause the drive to lose all data if
it is mounted during shutdown, restart, sleep, or startup.
For more on the directory visit the
Mac OS X directory FAQ.
Drivers and Preference Panels Peripheral drivers that aren't Mac OS X native may cause a kernel panic, and you should check the
Mac OS X native software directories and search engines, and any hardware
manufacturer's website for more recent drivers that are known to be compatible with your version of Mac OS X. With the new Intel Macs, this poses a
new problem as
not all drivers are compatible with the Rosetta environment that are Mac OS X native. Three special
cases are Apple hardware related that may give some peripherals difficulty, namely Mac OS X 10.2.5 has been known to kernel panic at certain USB hubs,
and it is recommended you
upgrade to 10.2.8 to avoid this issue.
The other is on the Flat Panel iMacs that are 700 Mhz and 800 Mhz. These iMacs have a USB port right next to the modem port
that is unable to work properly with USB devices that require power from the computer. And in some cases
it also means the mouse has to be plugged in the USB port on the right side of the keyboard and not the left side of the keyboard.
Also under some circumstances, it has been found that using a disk utility disk with a bootable volume older
than your computer may cause a kernel panic. This is related to the driver issue in that each new Mac can only boot the system that was
available at the time of its release or a newer model. To find out where your Mac fits in this, see Apple
Article 25517 and
1159.
A third party software may be running that starts a kernel panic. Look carefully at your
Apple menu -> System Preferences -> Login Items, and look for startup items in a Library -> StartupItems folder.
Sometimes a font may be trying to address the system wrong. Try to pin it down, and report it to Apple at:
Mac OS X feedback, or
Apple Developer's Bugreporter (free registration required).
A friend of mine discovered a third party preference pane (a software which installs into Apple menu -> System Preferences a control),
that is untested may sometimes cause a kernel panic. He used
Appzapper
to remove it while in
safe mode to eliminate the preference pane. The name's suffix of such files is prefpane.
In his case it was a beta version of Little Snitch, which in previous tested versions caused no kernel panic.
The lesson learned here, is that like what my
Upgrade FAQ says,
always backup your software before installing an unknown software with unknown compatibility, and
when you install new software verify it is known to be compatible with the system you are going to use it in.
A freeware called
SideTrack which enhances the shortcuts
capable from Apple's Powerbook and iBook trackpads installs its own kext file. It appears that my Apple System Profiler's Logs
tab showed that was what panicked on my new 17" Powerbook with 10.2.7 while it was running on battery.
At the time this software was beta version 0.7 it triggered a kernel panic.
It is not surprising something like this happened. Hopefully a newer version fixed the problem. But it goes to show installing any third party kext file
not tested with a new operating system may cause a kernel panic since Apple changes features with each new release of its operating system.
Double check with Find in the file menu that there are no third party kext files installed on your system as any of those may be
causing a kernel panic on your system if installed.. Moving kext files from their installed location without
removing the peripheral it is calling could also cause a kernel panic. Also check with any software vendors for updates
you buy software from if they install any kernel extensions to achieve their tricks, so that you can know whether or not you want
to uninstall it first before applying an operating system update to prevent a kernel panic, and then wait till
the developer tests it with the new operating system. If you experience a kernel panic with a specific software,
be sure to inform the developer what version of their software you are using and with which operating system it happened.
The software called
Covenant Eyes
may cause a kernel panic with Snow Leopard if its version is too old.
In addition, if you intentionally move a kext file to isolate a malfunctioning piece of hardware, you probably should keep a copy of it to move back to its
prior location before you upgrade the operating system or the software it runs. Otherwise in attempting to locate the kernel extension (which is what a kext file is), the
update may kernel panic upon installation or right after the installation. That would be the first suspect if you've been moving those kext files.
Related to this fact is that the drivers for one Mac model and even vintages of Macs may not match another.
Some people have tried to avoid having to pay the retail price for a Mac OS X operating system by using the
Mac OS X install CD that came with another computer. Don't do that! First off, unless you got a multiple user
license of that computer, what you have done is illegal! This means that for instance an iMac G3/700 may not be able
to use the same system disks as an iMac G3/600, and definitely won't be able to use the same system disks as a Powerbook, PowerMac, eMac,
or Cube. To get the best prices on Mac OS X retail in the U.S., see this page:
http://www.pcprices.net/macosx.shtml
Do not use the installer/restore disks that came with another Mac. Similarly, cloning from one Mac to another Mac over target disk mode or ethernet should not
be done as you will face the same potential driver issues. Only clone the data files, and applications you have multiple licenses for. Do not
clone the operating system unless the Macs are of the model and vintage, and you have multiple licenses for them,
otherwise you may end up with kernel panics galore. You can clone to an external hard drive for purpose of backup, but not another Mac model or vintage of Mac.
One commenter mentioned that they had a Zio! Compact Flash Reader that would only kernel panic if the
Compact Flash Card was already inserted when the computer was woken from sleep. Many third party devices
are not Energy Saver aware, and this could cause a kernel panic because of that issue. Another user found that a slightly damaged
Apple mouse could in fact cause a kernel panic because it was only partially working.
In some cases the kernel panic will alert you "There is no driver for this platform", and Apple has made a knowledgebase article about this issue in
Article 106403.
Also known to happen is a machine that won't restart because the third party USB device that was connected to it does not get sufficient power
to work again when the machine wakes from sleep (energy saver). If you suspect you have this problem, repair the directory, and set all
Energy Saver preferences to Never in the Apple menu -> System Preferences -> Energy Saver, and only manually use Energy Saver from the Apple menu after
dismounting (throwing the icon in the trash), and disconnecting USB devices. Some USB devices don't mount any icon on the desktop, though
camera media, keychain drives, and USB hard drives do.
A similar problem was reported on Apple Discussions that kernel panics were being caused by the
power outlet not giving the computer sufficient power. If you think you may have this problem
you may want to invest in an uninterruptable power supply. Remember though, these do not
protect you against a direct lightning strike. If you think there might be risk for one,
shut down, and unplug all wires leading to your computer.
If you suspect your drivers are corrupted, and want to backtrack to the last known working version of the operating system, follow the steps of
Archive and Install on Apple's website. Ignore warnings you have something newer installed.
If you have Update CDs, install the last full retail or the disk that came with the computer first (whichever is newer) before using the Update CDs.
For people who got Macs with 10.1.5 or older, there is no Archive and Install option, and the best option is to backup any data you can before erase
and installing 10.1 first. Or you could use 10.2 or 10.3 to Archive and Install over 10.1.
Some poorly written widgets for Mac OS X 10.4 access memory in ways that the system was not designed to accept. One such widget that has
since been updated to avoid kernel panics is Ministat. If you recently downloaded a widget, try disabling it to see if it makes a difference. To disable
a widget under Mac OS X 10.4 and 10.4.1 you can use
Widget Manager. With Mac OS X 10.4.2,
Apple has created a special widget called Manage Widgets which can be activated by enabling the widget toolbar (hit the + with the circle around it in the bottom left corner).
Data corruption
At this point a few instinces have been pinned down to data corruption, which I can't yet explain. Isolating it is sometimes as simple
as creating a second user account in Apple menu -> System Preferences -> Accounts, and logging out and logging back in via the Apple menu into that new account.
My
directory FAQ discusses what happens if there is data corruption in the directory, and that can create issues with the kernel as well. This
section will be updated at a later time.
PermissionsIt was reported on Apple's Discussions board was someone who received a KERN_PROTECTION_FAILURE causing
both Internet Explorer and Netscape to unexpectedly quit. What turned out to be the solution to their problem in their 10.3.4 system
was repairing permissions. You wouldn't think the permissions could mess up the kernel, but in some cases it appears they do. To repair
permissions, simply go to Applications -> Utilities -> Disk Utility -> First Aid -> select hard disk in Disk Utility, and click repair permissions.
Mind you, KERN_PROTECTION_FAILURES, despite their similar sounding names are not kernel panics.
Note, this not available to Mac OS X 10.1.4 or earlie (10.1.3, 10.1.2, 10.1.1, 10.1, 10.0.4, 10.0.3, 10.0.2, and 10.0 are earlier), though is
available to 10.1.5 not in Disk Utility, but in the
Repair Priviliges Utility download.
Do not repair permissions from the installer disk's Disk Utility unless the exact same version down to the second decimal point of the operating system is on
the CD as on the hard drive you are trying to repair. Permissions frequently get altered on operating system upgrades, or switching
between applications of different operating systems on the same computer, whether running Classic and then using X, or booting back into X after
having booted in 9. System level utilities that are installed frequently also change permissions. Any installer which asks for your password
potentially could change permissions. In addition, moving files around in Mac OS 9 that are related to the kernel extensions may leave
the kernel extensions wiht the wrong permissions. If you think you may have inadvertantly affected the .kext files in the System or Library folders from Mac OS 9, you can
attempt to repair permissions with the Disk Utility found in the Applications -> Utilities folder of Mac OS X 10.2.x, or if you have Mac OS X 10.1.5,
use the
Repair Privileges utility. If you have moved the .kext files,
it will be necessary to
Archive and Install the operating system
to get it to run properly again and apply the
Mac OS X combo update to get back
up to the last known working version of the operating system.
RAM and motherboards
These hardware items are the least likely suspect in kernel panics, but if you just got a new system, and or just installed
new memory and you get a kernel panic, that's the most likely place to start looking. If your RAM is not to
specifications
you may get a kernel panic. Apple recently released this very interesting article
Q & A 1344 in its developer forum.
It may explain why RAM that previously functioned no longer does under newer releases of Mac OS X. To make sure it is to specifications on the Flat Panel iMac, you need to use the Hardware Test CD
that came with your Flat Panel iMac, as the Apple System Profiler doesn't accurately report the kind of RAM that is installed.
Otherwise use the Apple System Profiler to check the kind of RAM that is installed, especially if your computer is not
one that normally came with a Hardware test CD. When installing or removing RAM, be sure you know how to install it
without breaking the clips, as Apple may not cover the break of the clips under warranty, and only install RAM
that is listed as
customer installable for your model Mac, otherwise
take it to an authorized service technician to install. Make sure before going to purchase new RAM that it is properly seated in its slot.
Some RAM that isn't seated properly may register, yet cause a kernel panic. Third party RAM can only be installed by third party authorized
service technicians that are Apple authorized as the official
Apple Stores don't install third party RAM.
If replacing the RAM with
lifetime warranty memory from a good RAM dealer
does not fix the kernel panic problem, then I would take it in to Apple repair to have the motherboard looked at.
Motherboards can be more expensive than buying AppleCare, thus it is recommended you buy AppleCare within the
first year of your computer's ownership in case you have to replace the motherboard. You can run the hardware test that came with your machine (Instructions for
Intel Macs,
PowerPC Mac with hardware test on system Restore disk to run hardware test) to find out quickly if
hardware is the issue, though a negative result doesn't always mean the RAM is good.
Additional ways of testing RAM are found on
my RAM portion of my Mac OS X speed FAQ.
Many kernel panics can be isolated by reading the /Library/Logs/panic.log file
on your hard drive with the Console application. Look for specific hardware and/or driver references
to attempt to isolate it from the log that you may have installed that may not be compatible, or are showing signs of issues.
Three similar FAQs developed independently from this one offers many of the same suggestions on: