Kernel panics, and how to know when they occur

In a kernel panic, something happens in your Mac which is so injurious to the kernel code running at its heart, that the kernel has to be halted: it then issues a panic.

Panics used to be quite common in early versions of Mac OS X, and had become very infrequent by Yosemite (10.10), unless your Mac had a hardware problem. Defective memory always has been a likely cause. The kernel shipped with El Capitan (10.11) is notoriously unstable on some models of Mac, particularly from 10.11.4 onwards, and panics once again became not uncommon as a result. My own iMac17,1 panicked every few days until it was upgraded to Sierra (10.12), which for most users and Macs has been a great improvement.

Over various releases of OS X and macOS, Apple has changed the way in which kernel panics are handled. Prior to OS X 10.8, they were usually marked by the display of a special panic screen, shown below.

panic
A traditional kernel panic prior to OS X 10.8. It is an interesting exercise to get your own screen shot of one.

If you ever see this, the only way ahead is to press and hold the power button of your Mac, which will force it to shut down. After a few seconds, you can press that button more briefly to start it up again.

Since 10.8, as documented in Wikipedia’s excellent potted history of kernel panics in OS X, Macs have behaved differently: they automagically restart themselves, sometimes displaying a kernel panic dialog when next starting up, for “a few seconds”. If your luck has really run out and there are five kernel panics within three minutes of the first, a prohibitory sign should be shown on the display for thirty seconds, and the Mac shuts down and doesn’t attempt to restart again: that’s a ‘recurring kernel panic’, or more like a whole month of Friday 13ths.

Apple’s account of these issues is now quite different. They’re not kernel panics any more, but unexpected restarts, which makes them seem as innocuous as unexpected quits, perhaps; they’re not – no Mac should ever experience a single panic.

In El Capitan and Sierra, you are unlikely to see any of the informative dialogs which Apple shows in that article. In El Capitan, chances are that your Mac will freeze for a while, restart, then re-open all the apps and windows just as they were when the panic occurred, and you might then be none the wiser of the event.

In Sierra, instead of forcing a restart, some models may simply shut down, leaving you to start them up again in the usual way.

Apple also claims that kernel panic logs are located in /Library/Logs/DiagnosticReports, although that seems to have been superceded by El Capitan and Sierra.

Apple provides more information in Technical Note TN2063, Understanding and Debugging Kernel Panics, although that has not been updated for over two years, and is no longer an accurate reflection of what happens in El Capitan or Sierra.

Apple’s documentation also does not cover the worst type of kernel panic of all: one which occurs early during startup. In that case, if the panic forces a restart, your Mac can become locked in a cycle of panics and forced restarts which can only be broken by your intervention. These have occurred when there is significant hardware failure (memory again), the firmware has become damaged perhaps by a partially-applied update, or a hard disk is damaged or failing, particularly if it hosts the startup volume.

Because your first kernel panic is quite likely to result from a hardware problem, disconnect all non-essential peripherals apart from its network connection, any displays, the keyboard and input device (mouse or trackpad), then start up in Diagnostics or Hardware Test.

If you’re confident that hardware is not the cause, consider starting up in Recovery mode, running Disk Utility, and applying First Aid to your startup drive. This can fix any corruption which might have occurred during the panic.

It is also worth considering starting up in Safe mode, which should prevent any rogue kernel extensions and similar components from loading. This could provide the opportunity to check for those, and remove them if necessary.

If you have other diagnostic software, such as TechTool Pro or EtreCheck, you may find that they can identify the most likely cause, so that you can deal with it.

A kernel panic which has occurred soon after a macOS software update may well be the result of a problem with that update, and is considered in this article.

Sometimes, the problem causing a kernel panic can be fixed by performing an SMC or NVRAM reset, which is detailed here.

If you cannot find a cause, and your Mac continues to suffer occasional kernel panics, then do not become complacent and just accept them: it should not do that, you need to get to the bottom of the problem, and fix it.