Home Forums Mac Software Mac Operating Systems Kernel Panic?

I think I may have had one of those kernel panics but I don't know how to fix it. Here's the scoop.

Yesterday evening, as my machine was booting up, I clicked on Eye TV, a device that takes a cable feed and converts it to USB. Then the TV feed appears in a "monitor" on screen with the ability to select channels et cetera. Usually I am fully booted before I turn it on.

Anyway,....the Eye TV provided a feed but, when my machine finished booting up, I did not have all the items in the menu bar at the top of the screen. I had everything on the left side but only the Sophos Icon on the right side.

Everything was working fine but I wanted the right side items and decided to do a reboot. After Restart I got the Grey screen and rotating clock hand for quite a long time before the machine changed to the blue screen. After quite a few minutes, nada. I did a forced shutdown holding the AC switch.

Another boot attempt generated the same result....except I timed things. The grey screen was 1.5 minutes and the blue screen was 7 minutes. The blue screen would have gone longer except I pulled the Eye TV USB plug out.

With Eye TV unplugged, the log-in window appeared. However, it was "locked" and did not respond to any input.

I rebooted using my IMac Disk and did a "Startup Disk" restart to my backup drive. It took longer than I expected but it did have a working Log In screen. I did Permissions Repair and a full Disk Warrior directory rebuild on my main drive.

The only difference from other times was that the Permissions Repair ended with a message I've never seen before: "ACL found but not expected on "Users/Shared"."

An attempt to reboot the main drive simply resulted in the same interminable waits although, when I touched the AC switch, the Log In window appeared. However, it wasn't functioning.

I needed to boot again from my iMac Disk and use "Startup Disk" to get to my backup drive. I do note that, although it works, when I Log Out from this drive, it has a very long blue screen before it gets to the Log In window....although the window does work.

I am currently operating from my backup drive and don't plan to do any "back to log in window" moves.

Edit: I use the moving mosaic screensaver. It is now showing large blocks of white - something it's never done before.

Edit: I forgot....in the midst of all the things I was doing I also tried a Safe Boot but that didn't generate a working Log In window either.

Edit: Getting dozy in my old age....at one point I also tried removing these two plists but that didn't resolve anything. I have since put them back.
com.apple.loginitems.plist
com.apple.loginwindow.plist

Yet another edit: I think I've solved it. I did a bit of poking around and found that there are two sets of the above plists - the second being in my Admin Account. I removed both and did a restart, using Opt to get Startup Disk, and the machine booted from my main drive. Whew!!

I will now replug Eye TV and see what happens.

Hopefully final edit (Cross my heart and spit in a circle): I shutdown and plugged Eye TV back into the USB port. On reboot, and waiting to ensure everything was loaded, I opened Eye TV successfully. Everything seems to be working.

However, I still don't know what actually happened. It would be good to know so I don't do it again.

ryck

OSX 10.6.7.

Can you retrieve those plists from a backup so we can read their (former) contents?

I don't know how to attach the plists here. However, using TextEdit, I tried copying and pasting the contents (two tries) but cannot get anything more than this to appear in the post.

bplist00—
^privilegedlist“ZController_CustomListItems°‘
TIcon_CustomItemPropertiesTNameUAliasO
"ImgR

ryck

In Terminal, you could paste this command

defaults read ~/Library/Preferences/com.apple.loginitems

and then hit Return; the Terminal output will be something like



(In the interest of economy, I snipped out most of my output; what you see above represents a single login item.)

Done......here's the result....although it's sure different from the stuff in textedit. it seemed to be mostly, well, prose.

ryck


Last login: Sat Jun 11 12:37:48 on console
firstname-lastnames-imac:~ firstnamelastname$ defaults read ~/Library/Preferences/com.apple.loginitems
{
SessionItems = {
Controller = CustomListItems;
CustomListItems = (
{
Alias = <00000000 00ce0003 00010000 c752ba30 0000482b 00000000 00043eb7 00043eb8 0000c5e4 4d740000 00000920 fffe0000 00000000 0000ffff ffff0001 000c0004 3eb70004 34550004 3415000e 00220010 00450079 00650054 00560020 00480065 006c0070 00650072 002e0061 00700070 000f001a 000c004d 00610063 0069006e 0074006f 00730068 00200048 00440012 00324c69 62726172 792f4170 706c6963 6174696f 6e205375 70706f72 742f4579 6554562f 45796554 56204865 6c706572 2e617070 00130001 2f00ffff 0000>;
CustomItemProperties = {
"com.apple.loginitem.HideOnLaunch" = 1;
"com.apple.loginitem.legacyprefs" = {
Hide = 1;
Path = "/Library/Application Support/EyeTV/EyeTV Helper.app";
};
};
Icon = <496d6752 00000108 00000000 4642494c 000000fc 00000002 00000000 00000000 00ec0003 00000000 c752ba30 0000482b 00000000 00043ec1 000b3282 0000c74e c3f40000 00000920 fffe0000 00000000 0000ffff ffff0001 00180004 3ec10004 3eb90004 3eb80004 3eb70004 34550004 3415000e 0016000a 00650079 00650074 0076002e 00690063 006e0073 000f001a 000c004d 00610063 0069006e 0074006f 00730068 00200048 00440012 00504c69 62726172 792f4170 706c6963 6174696f 6e205375 70706f72 742f4579 6554562f 45796554 56204865 6c706572 2e617070 2f436f6e 74656e74 732f5265 736f7572 6365732f 65796574 762e6963 6e730013 00012f00 ffff0000>;
Name = "EyeTV Helper.app";
},
{
Alias = <00000000 00fa0003 00010000 c752ba30 0000482b 00000000 0002c700 0002c701 0000bdc6 d06a0000 00000920 fffe0000 00000000 0000ffff ffff0001 00100002 c7000002 c6fe0002 c6fd0000 00f0000e 00300017 004d0069 00630072 006f0073 006f0066 00740020 00410055 00200044 00610065 006d006f 006e002e 00610070 0070000f 001a000c 004d0061 00630069 006e0074 006f0073 00680020 00480044 0012004c 4170706c 69636174 696f6e73 2f4d6963 726f736f 66742041 75746f55 70646174 652e6170 702f436f 6e74656e 74732f4d 61634f53 2f4d6963 726f736f 66742041 55204461 656d6f6e 2e617070 00130001 2f00ffff 0000>;
CustomItemProperties = {
"com.apple.loginitem.legacyprefs" = {
Hide = 0;
Path = "/Applications/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft AU Daemon.app";
};
};
Icon = <496d6752 00000136 00000000 4642494c 0000012a 00000002 00000000 00000000 011a0003 00000000 c752ba30 0000482b 00000000 00069fa5 0006a018 0000c696 debb0000 00000920 fffe0000 00000000 0000ffff ffff0001 00180006 9fa50006 9f750006 9f740006 89a30006 22a40006 22a1000e 0038001b 00470065 006e0065 00720069 00630041 00700070 006c0069 00630061 00740069 006f006e 00490063 006f006e 002e0069 0063006e 0073000f 001a000c 004d0061 00630069 006e0074 006f0073 00680020 00480044 0012005b 53797374 656d2f4c 69627261 72792f43 6f726553 65727669 6365732f 436f7265 54797065 732e6275 6e646c65 2f436f6e 74656e74 732f5265 736f7572 6365732f 47656e65 72696341 70706c69 63617469 6f6e4963 6f6e2e69 636e7300 00130001 2f00ffff 0000>;
Name = "Microsoft AU Daemon.app";
},
{
Alias = <00000000 01060003 00010000 c752ba30 0000482b 00000000 0057ae71 0057ae72 0000c8eb a0410000 00000920 fffe0000 00000000 0000ffff ffff0001 00100057 ae710057 a8560057 a8550000 00f0000e 003c001d 00410064 006f0062 00650052 00650073 006f0075 00720063 00650053 0079006e 00630068 0072006f 006e0069 007a0065 0072002e 00610070 0070000f 001a000c 004d0061 00630069 006e0074 006f0073 00680020 00480044 0012004c 4170706c 69636174 696f6e73 2f41646f 62652052 65616465 722e6170 702f436f 6e74656e 74732f53 7570706f 72742f41 646f6265 5265736f 75726365 53796e63 68726f6e 697a6572 2e617070 00130001 2f00ffff 0000>;
CustomItemProperties = {
"com.apple.loginitem.HideOnLaunch" = 1;
"com.apple.loginitem.legacyprefs" = {
AliasData = <00000000 01060003 00010000 c752ba30 0000482b 00000000 0057ae71 0057ae72 0000c8eb a0410000 00000920 fffe0000 00000000 0000ffff ffff0001 00100057 ae710057 a8560057 a8550000 00f0000e 003c001d 00410064 006f0062 00650052 00650073 006f0075 00720063 00650053 0079006e 00630068 0072006f 006e0069 007a0065 0072002e 00610070 0070000f 001a000c 004d0061 00630069 006e0074 006f0073 00680020 00480044 0012004c 4170706c 69636174 696f6e73 2f41646f 62652052 65616465 722e6170 702f436f 6e74656e 74732f53 7570706f 72742f41 646f6265 5265736f 75726365 53796e63 68726f6e 697a6572 2e617070 00130001 2f00ffff 0000>;
Hide = 1;
Path = "/Applications/Adobe Reader.app/Contents/Support/AdobeResourceSynchronizer.app";
};
};
Icon = <496d6752 0000001c 00000000 5359534c 00000010 00000000 4150504c>;
Name = AdobeResourceSynchronizer;
}
);
};
}
firstname-lastnames-imac:~ firstnamelastname$

Neither these two plists nor anything else in any user's home folder can be the cause of the problem. The system won't look in any user's home folder until after you log in, because until then it doesn't know which user is relevant.

But you're hanging before that, in the LoginWindow. The problem has to be with something encountered much earlier in the boot sequence than the things you're looking at.

Try unplugging all peripherals (except mouse and keyboard) before rebooting. USB devices, in particular, are known for causing bizarre startup problems. That includes USB hubs, so unplug those, but don't overlook FireWire devices.

If that lets you boot up, try adding things back a few at a time to narrow down the offending device.

A dead battery in a wireless keyboard would make a LoginWindow seem locked. Just a thought.

But then, why did the problem go away with the removal of the plists? Coincidence?

My USB peripherals are:

Keyboard
with iPod Nano attached
Eye TV
Belkin 7 outlet hub with:
Printer
Digital Camera
Kensington Trackball

I have one Firewire going to my back-up drive and a loop through it to my TimeMachine backup.

Anyway, I've done what you suggested and, since it's only a few items, I re-attached them one at a time with shutdowns between. Almost nothing changed....except that....from the start I got a faster start-up and faster load of the menu bar and the dock. They have both been a bit sluggish since the incident.

Update Edit: Several hours later everything continues completely normal with good speed, no incidents and no harm done....except losing a few more hairs I couldn't afford.


Would that be the Eye TV starting and providing the on-screen feed before the machine had completely loaded?

Edit for question clarification: Although the boot sequence with the Eye TV was separate from the sequence that resulted in the locked Log-In window, I wondered if they are related.

That is, the Eye TV and the Log-In window do similar things. They both create a window in which instructions are given. Therefore, during the first boot (Eye TV) could the Eye TV software have done something that affected the boot sequence (instructions?) for the window creation?

Then, in the second boot, the altered instructions (if that's a possibility) would be wrong for creation of the Log-In window.

Caveat: My questions are never from the point of technical knowledge (mine is limited) but from simple-minded logic.

ryck

Here's one way to see (some of the) stuff which loads early on...

kextstat |grep -v com.apple

That terminal command will give info about non-Apple extensions.

For example, here's my current output:

i.e., Little Snitch and Air Display (by Avatron, to use my iPad as a 2nd display).

How about yours?


Edit...

Hmm, something tells me we got a flakey (intermittent) hardware problem here.

This is what I got just now. If it's not helpful, is there a way to ask Terminal to come up with a log-in from another occasion?


Last login: Sun Jun 12 12:40:39 on console
firstname-lastnames-imac:~ firstnamelastname$ kextstat |grep -v com.apple
Index Refs Address Size Wired Name (Version) <Linked Against>
97 0 0x15be000 0x5000 0x4000 com.hzsystems.driver.CDSDAudioCaptureSupport (1.5) <95 5 4 3 1>
129 0 0x3644d000 0x4000 0x3000 com.sophos.kext.sav (7.3.0) <5 4 1>
firstname-lastnames-imac:~ firstnamelastname$


Uh oh.....if so, I hope we're talking about a piece of USB attached hardware.

ryck

That is easy enough to prove or disprove. Simply disconnect all USB devices, including USB hubs, and see if the problem goes away. If it does go away then start swapping out the USB devices beginning with the least expensive, the USB cables, going from there to any hubs, and keep going until the only thing left is the logric board. If Hal's "Hmm" is on target, and it sounds reasonable to me, this type of error is notoriously hard to pin down so have patience.

Well i see Sophos is an early riser (and also mentioned in post #1).
I would say disabling AV until the current mystery is solved might be wise.
[we Macsters don't need it that badly.]

Interestingly enough, a google on your "com.hzsystems.driver" there finds a few threads about KPs.




The only thing along those lines i can think of is: sudo dmesg
...which gets us a look at some very early system messages.

Done.



Below is what sudo dmesg just generated. It's too back I couldn't get a list by entering a specific time, as I know the boot time...17:59 on Friday (I was in a hurry to catch the lead story on the news).

ryck

Last login: Sun Jun 12 16:03:37 on console
firstname-lastnames-imac:~ firstnamelastname$ sudo dmesg
Password:
ID 5901 built-in now active, GUID 002332fffe011862; max speed s800.
Warning - com.olympus.CamFWSerialBusProtocolTransport declares no kernel dependencies; using com.apple.kernel.6.0.
AppleYukon2: Marvell Yukon Gigabit Adapter 88E8055 Singleport Copper SA
AppleYukon2: RxRingSize <= 1024, TxRingSize 256, RX_MAX_LE 1024, TX_MAX_LE 768, ST_MAX_LE 3328
USBMSC Identifier (non-unique): 000A27001D39685E 0x5ac 0x1263 0x1
yukon: Ethernet address 00:23:32:95:1e:c4
AirPort_Brcm43224: Ethernet address 00:22:41:fa:ac:5b
IO80211Controller::dataLinkLayerAttachComplete(): adding AppleEFINVRAM notification
Waiting for DSMOS...
systemShutdown false
AirPort: Link Down on en1. Reason 8 (Disassociated because station leaving).
Previous Shutdown Cause: 5
DSMOS has arrived
IPv6 packet filtering initialized, default to accept, logging disabled
** Device in slot: SLOT--1 **
Ethernet [AppleYukon2]: Link up on en0, 1-Gigabit, Full-duplex, Symmetric flow-control, Debug [796d,af08,0de1,0200,cde1,2800]
jnl: disk2s2: journal start/end pointers reset! (jnl 0x54a1d08; s 0x1a1000 e 0x1a1000)
0 [Time 1307881074] [Message System Sleep
Wake reason = EHC2
System Wake
Previous Sleep Cause: 5
The USB device Keyboard Hub (Port 2 of Hub at 0xfa000000) may have caused a wake by issuing a remote wakeup (2)
The USB device Apple Keyboard (Port 2 of Hub at 0xfa200000) may have caused a wake by issuing a remote wakeup (3)
Ethernet [AppleYukon2]: Link up on en0, 1-Gigabit, Full-duplex, Symmetric flow-control, Debug [796d,af08,0de1,0200,cde1,2800]
0 [Time 1307892210] [Message System Sleep
Wake reason = EHC1
System Wake
Previous Sleep Cause: 5
The USB device USB2.0 Hub (Port 1 of Hub at 0xfd000000) may have caused a wake by issuing a remote wakeup (2)
The USB device USB2.0 Hub (Port 3 of Hub at 0xfd100000) may have caused a wake by issuing a remote wakeup (3)
The USB device Kensington Eagle Trackball (Port 3 of Hub at 0xfd130000) may have caused a wake by issuing a remote wakeup (3)
Ethernet [AppleYukon2]: Link up on en0, 1-Gigabit, Full-duplex, Symmetric flow-control, Debug [796d,af48,0de1,0200,cde1,2800]
USBMSC Identifier (non-unique): 000A27001D39685E 0x5ac 0x1263 0x1
jnl: disk2s2: journal start/end pointers reset! (jnl 0x54a1d08; s 0x1e6000 e 0x1e6000)
0 [Time 1307898132] [Message System Sleep
Wake reason = EHC2
System Wake
Previous Sleep Cause: 5
The USB device Keyboard Hub (Port 2 of Hub at 0xfa000000) may have caused a wake by issuing a remote wakeup (2)
The USB device Apple Keyboard (Port 2 of Hub at 0xfa200000) may have caused a wake by issuing a remote wakeup (3)
Ethernet [AppleYukon2]: Link up on en0, 1-Gigabit, Full-duplex, Symmetric flow-control, Debug [796d,af48,0de1,0200,cde1,2800]
0 [Time 1307905122] [Message System Sleep
Wake reason = EHC2
System Wake
Previous Sleep Cause: 5
The USB device Keyboard Hub (Port 2 of Hub at 0xfa000000) may have caused a wake by issuing a remote wakeup (2)
The USB device Apple Keyboard (Port 2 of Hub at 0xfa200000) may have caused a wake by issuing a remote wakeup (3)
Ethernet [AppleYukon2]: Link up on en0, 1-Gigabit, Full-duplex, Symmetric flow-control, Debug [796d,af48,0de1,0200,cde1,2800]
0 [Time 1307909214] [Message System Sleep
Wake reason = EHC2
System Wake
Previous Sleep Cause: 5
The USB device Keyboard Hub (Port 2 of Hub at 0xfa000000) may have caused a wake by issuing a remote wakeup (2)
The USB device Apple Keyboard (Port 2 of Hub at 0xfa200000) may have caused a wake by issuing a remote wakeup (3)
Ethernet [AppleYukon2]: Link up on en0, 1-Gigabit, Full-duplex, Symmetric flow-control, Debug [796d,af08,0de1,0200,cde1,2800]
0 [Time 1307910382] [Message System Sleep
Wake reason = EHC2
System Wake
Previous Sleep Cause: 5
The USB device Keyboard Hub (Port 2 of Hub at 0xfa000000) may have caused a wake by issuing a remote wakeup (2)
The USB device Apple Keyboard (Port 2 of Hub at 0xfa200000) may have caused a wake by issuing a remote wakeup (3)
Ethernet [AppleYukon2]: Link up on en0, 1-Gigabit, Full-duplex, Symmetric flow-control, Debug [796d,af08,0de1,0200,cde1,2800]
firstname-lastnames-imac:~ firstnamelastname$

Sorry, seems i was wrong about dmesg. (i always thought it retained a view the startup chatter... but i guess not, unless we run it shortly after initially booting up and logging in).

Not to worry......I'm quite pleased about two things. I'm up-and-running again without any apparent hitches (although I am watching for signs) and, secondly, I've learned a couple more things about Terminal - both from you and dkmarsh - so I'm ahead of the game.

ryck

So that "com.hzsystems.driver" item never panned out to be anything relevant? (as i indicated, teh google on that string produced several threads about kernel panics for me [but i never followed them to see what was there]).

I did Google it, and looked through quite a few of the results, but didn't see anything that was meaningful to me.

I have also entered the Terminal command again and com.hzsystems.driver still shows. However, everything seems to be going okay.

ryck

So, I've been back to the "com.hzsystems.driver" Google list and spent a bit more time. It seems that "com.hzsystems.driver" is a non-Apple kernel extension. The second part of the name "CDSDAudioCaptureSupport 1.5 indicates that it belongs to Spin Doctor.

Spin Doctor is a program that comes with Roxio Toast Titanium and is used for digitizing analogue audio. I don't use Spin Doctor (preferring Amadeus Pro) but I do keep all the Toast software up to date.

I looked in Library/Application Support/Roxio and only saw one Kernel extension "TDIXController.kext", so I have no idea where "com.hzsystems.driver" is located. Even Spotlight doesn't see it.

Sorry for the delays in responding but I've been dealing with a City Council and they aren't the brightest bunch....about as thick as two short planks.

ryck

For what it is worthm, I have SpinDoctor on my system and as far as I can discern there is no file by that name on my system.

I am not terribly surprised Spotlight did not find it since kernel extensions are by definition drivers you have to intentionally include system files before Spotlight will find them and Spotlight will not find package contents. However EasyFind, which uses an entirely different search mechanism and will find both system files and package contents did not find it either. I also used EasyFInd to search the contents of the files in the system and the applications folders for a reference to com.hzsystems.driver with no result.

Condolences on having to deal with a city council. Been there, done that, burned the t-shirt.

Since it turned up for the kextstat command, its location is bound to be inside: /System/Library/Extensions/

[yes... there.]

I looked there but there isn't anything called "com.hzsystems.driver.CDSDAudioCaptureSupport (1.5) <95 5 4 3 1". However, there is one with only some of the second part of the name, and it is called: "CDSDAudioCaptureSupport.kext"

I did an experiment and entered the Terminal command without the "|grep -v com.apple".

Entering only "kextstat" generated a list of 125 items and each of them, except one, begins with "com.apple. "

The one that does not is: "com.hzsystems.driver.CDSDAudioCaptureSupport (1.5) <101 5 4 3 1>"

ryck

The full name 'com.com.hzsystems.driver.CDSDAudioCaptureSupport" is the bundle identifier, as specified in the Info.plist from inside the kext.

Enter the command:

defaults read /System/Library/Extensions/CDSDAudioCaptureSupport.kext/Contents/Info

and you should see (among other things)

CFBundleIdentifier = "com.hzsystems.driver.CDSDAudioCaptureSupport";

The "(1.5)" is coming, I would guess, from

CFBundleShortVersionString = "1.5";

but that's not important. The important thing is that the matching bundle identifier confirms that you're looking at the right file.

I do see the full name and "1.5" appears four times.

Note to all: I'm not sure what I'm tossing on the table here so, if it isn't helpful and just occupying space, don't be bashful about saying so.

ryck

Last login: Tue Jun 14 09:16:39 on console
firstname-lastnames-imac:~ firstnamelastname$ defaults read /System/Library/Extensions/CDSDAudioCaptureSupport.kext/Contents/Info
{
CFBundleDevelopmentRegion = English;
CFBundleExecutable = CDSDAudioCaptureSupport;
CFBundleGetInfoString = "Version 1.5";
CFBundleIdentifier = "com.hzsystems.driver.CDSDAudioCaptureSupport";
CFBundleInfoDictionaryVersion = "6.0";
CFBundleName = CDSDAudioCaptureSupport;
CFBundlePackageType = KEXT;
CFBundleShortVersionString = "1.5";
CFBundleSignature = "????";
CFBundleVersion = "1.5";
IOKitPersonalities = {
CDSDAudioCaptureSupport = {
AudioEngines = (
{
BlockSize = 8192;
Description = "CD Spin Doctor Capture Support";
Formats = (
{
IOAudioStreamAlignment = 1;
IOAudioStreamBitDepth = 32;
IOAudioStreamBitWidth = 32;
IOAudioStreamByteOrder = 0;
IOAudioStreamDriverTag = 0;
IOAudioStreamIsMixable = 1;
IOAudioStreamNumChannels = 2;
IOAudioStreamNumericRepresentation = 1936289396;
IOAudioStreamSampleFormat = 1819304813;
}
);
NumBlocks = 2;
NumStreams = 1;
SampleRates = (
44100,
48000,
96000
);
}
);
CFBundleIdentifier = "com.hzsystems.driver.CDSDAudioCaptureSupport";
IOClass = "com_hzsystems_driver_CDSDAudioCaptureDevice";
IOMatchCategory = "com_hzsystems_driver_CDSDAudioCaptureDevice";
IOProviderClass = IOResources;
IOResourceMatch = IOBSD;
IOUserClientClass = CDSDUserClient;
};
};
OSBundleLibraries = {
"com.apple.iokit.IOAudioFamily" = "1.5";
"com.apple.kpi.bsd" = "8.0";
"com.apple.kpi.iokit" = "8.0";
"com.apple.kpi.libkern" = "8.0";
"com.apple.kpi.mach" = "8.0";
};
}
firstname-lastnames-imac:~ firstnamelastname$

No surprise(s) there.



No surprise(s) there.

So, I'll take that as a "time to stop worrying about the software side of things" and thank everyone for the time spent. Everything is working fine and totally back to normal but I will:

1. Keep an eye out for a hardware issue.

2. Avoid loading Eye TV until the boot cycle is finished.

ryck

No... i just meant that i wasn't surprised that kextstat didn't list the exact filename in a clear format. Nor were the results of that experiment (omitting grep -v) of an unexpected nature.

TBH, i have no clue what zapped your Mac that day. (stuff happens... randomly and singularly sometimes)

BTW, is Sophos still on the disabled list... or is it back in the mix?