An unwarranted login: things that go bump in the night

I have always advised users that the most precious sense is that of the unusual. When you first go to use your Mac in the day, if it behaves oddly, suspect that something has happened to it: it could be malware, software, or hardware, but don’t ignore it, find out what is wrong.

For years, when I was using networked Windows XP systems in my old day job, I struggled with this. Each evening I shut my PC down, but then many mornings it was up and running again, prompting me to log in. This was invariably because the system maintainers had scheduled it for automatic updating or whatever, but their maintenance routines had failed to shut it down properly. Every time I went through the arguments about my suspicion that someone had been accessing that PC inappropriately, I was told to ignore it.

So we learned to ignore the unusual. Some users got so good at this that they ignored a serious virus infection which came close to bringing the whole network to collapse, and took weeks of intensive cleansing to restore normal function.

I normally leave my iMac running, and after my problems getting it to put the system to sleep but not the hard drive, only the display goes to sleep now. So when I sit in front of it first thing in the morning, I tap on the Magic Trackpad 2, the display wakes up, and I am off to a flying start for the day.

Yesterday morning, it didn’t work like that. I had to tap a couple of times, and when it did awaken, it was at the login prompt, as if my Mac had restarted sometime during the small hours.

Once I had logged in, everything looked fine, but there was no reason apparent for a restart. I checked the installer receipt log at /Library/Receipts/InstallHistory.plist, and although there had been a silent security update early the previous afternoon, there were no other clues. I checked the logs, and sure enough at 0218, the Mac had restarted. The reason given was
Previous shutdown cause: -128

Needless to say, finding a list of such codes is not easy. For a regular error code, -128 means the user cancelled, which does not make any sense as, at that time in the morning, the user was more deeply asleep that his Mac. There was, I suppose, our crazy cat…

I checked my Fusion Drive out using DriveDx, which gave both components a clean bill of health. I had a long and careful look at what was running using TaskExplorer, and nothing suspicious was to be found.

So I am left with a mystery: what caused my Mac to shut down and/or start up in this way? It is powered from a UPS and set to shut down automatically after just 5 minutes running on the UPS battery power. If it had switched over to battery power but not shut down properly, then my RAID would also have been affected, but that apparently ran happily through the night.

Unfortunately the logs are becoming decreasingly useful because of the sheer volume of messages which get written out to them. Maybe we need an Important Log into which serious warnings and errors are written, and a Junk Log for all the other dross.

If this becomes a habit, I will investigate further and let you know what it all means. Hopefully tonight will be uninterrupted, both for my sleep, and my Mac’s.