Having suggested, from a close reading of their man
pages, that the shutdown
command is preferable to plain reboot
, the only way of finding out is to examine what happens during system restarts. Both commands are small but not negligible executable files in the /sbin directory, and there is no suggestion that reboot
is just a front end for shutdown
.
The following tests were performed on a MacBook Pro running High Sierra 10.13.4, with Security Update 2018-001 installed, booted from its internal SSD in APFS. When each action was initiated, Terminal was open, Documents and Desktop folders were in iCloud, and one RTFD document from ~/Documents was open in TextEdit. Logs were captured using Consolation 3, and times are given in seconds after initiation of the reboot.
Menu Restart
A normal Restart initiated from the Finder’s Apple menu occurs in two main phases. The first sequences are run by loginwindow
, and handle shutting down all the GUI and higher-level processes. These are announced step by step in the following sequence, between which are long runs of entries recording the shutdown of various parts of macOS:
00.000 loginwindow -[SessionStateMonitor setLogoutState:] | ************* logout state: StartGUIAppsQuit
00.212 loginwindow -[SessionStateMonitor setLogoutState:] | ************* logout state: AllGUIAppsQuit
00.213 loginwindow -[SessionStateMonitor setLogoutState:] | ************* logout state: StartFinderQuit
00.369 loginwindow -[SessionStateMonitor setLogoutState:] | ************* logout state: StartDockQuit
00.377 loginwindow -[SessionStateMonitor setLogoutState:] | ************* logout state: StartPrivateProcessQuit
00.652 loginwindow -[SessionStateMonitor setLogoutState:] | ************* logout state: FinalItemsBeforeSessionLogoutd
00.745 loginwindow -[SessionStateMonitor setLogoutState:] | ************* logout state: Startsessionlogoutd
00.745 loginwindow -[SessionStateMonitor setLogoutState:] | ************* logout state: LogoutComplete
00.745 loginwindow -[SessionStateMonitor logSessionStateForLoginwindowExit] | *************Login Window exit - StartSessionState************
00.745 loginwindow -[SessionStateMonitor logSessionStateSummary] | * LoginState: LoginComplete
00.745 loginwindow -[SessionStateMonitor logSessionStateSummary] | * OverallSessionState: Logout - past point of no return
00.745 loginwindow -[SessionStateMonitor logSessionStateSummary] | * LogoutState: LogoutComplete
00.745 loginwindow -[SessionStateMonitor logFullStateInfo] | *************State Sequences************
00.745 loginwindow -[SessionStateMonitor logFullStateInfo] | * LoginStates: * Login States: InitialStartup, WindowServerConnectionMade, FinishLaunchingStart, StartedAuthCopy, LoginwindowUIShown, ReturnFromAuthCopy, KeychainUnlocked, KeybagUnlocked, CreateAndSwitch, MountedServers, DeletedUserFolders, TALLaunchStart, FinderEtcLaunched, ContinueAfterDesktopReady, ContinueAfterTALCheckin, LoginItems, LoginComplete,
00.745 loginwindow -[SessionStateMonitor logFullStateInfo] | * LogoutStates: * Logout States: RestartConfirmation, StartGUIAppsQuit, AllGUIAppsQuit, StartFinderQuit, FinderQuit, PointOfNoReturn, StartUIElementsQuit, StartDockQuit, StartPrivateProcessQuit, FinalItemsBeforeSessionLogoutd, Startsessionlogoutd, LogoutComplete,
00.745 loginwindow -[SessionStateMonitor logSessionStateForLoginwindowExit] | *************EndSessionState************
There are typically more than 400 other log entries made in the 0.75 seconds or so between the first and last of those entries, which gives an indication of the other processes which are involved.
Once those are complete, macOS calls shutdown -r now
, and its sequence starts:
00.780 shutdown reboot by hoakley:
00.780 kernel Kext loading now disabled.
00.780 kernel Kext unloading now disabled.
00.780 kernel Kext autounloading now disabled.
00.780 kernel Kernel requests now disabled.
00.782 kernel Process launchd [1] disabling system-wide I/O Throttling
00.782 kernel Process launchd [1] disabling system-wide CPU Throttling
There are then around 800 or more log entries over the next 0.2 seconds or so detailing the shutdown of various services, etc., before the final two entries:
00.964 opendirectoryd SystemCache Deregistered for Kernel Identity Service requests
01.449 === system wallclock time adjusted
The system has then been shut down, and starts up again with the announcement:
09.500 === system boot: 00000000-0000-0000-0000-000000000000
(I have blanked out the UUID given for the boot.)
The shutdown cause is given slightly later:
10.129 AppleSMC Previous shutdown cause: 5
shutdown -r now
This sequence of log entries is essentially the same as a menu Restart, from the point that loginwindow
has completed shutting down all the higher-level processes, and the log entry which starts these is made by shutdown
, in a format identical to that appearing in a menu Restart:
00.000 shutdown reboot by hoakley:
00.000 kernel Kext loading now disabled.
00.000 kernel Kext unloading now disabled.
00.000 kernel Kext autounloading now disabled.
00.000 kernel Kernel requests now disabled.
00.000 kernel Process launchd [1] disabling system-wide I/O Throttling
00.000 kernel Process launchd [1] disabling system-wide CPU Throttling
Over the next 0.22 seconds, more than 700 messages detail the shutdown of services, etc., then the final two entries are:
00.221 opendirectoryd SystemCache Deregistered for Kernel Identity Service requests
01.021 === system wallclock time adjusted
The following startup is identical:
11.625 === system boot: 00000000-0000-0000-0000-000000000000
12.230 AppleSMC Previous shutdown cause: 5
reboot
The sequence of log entries is essentially the same as with shutdown -r now
, throughout, although the initial announcement comes from reboot
and contains a slightly different message:
00.000 reboot rebooted by hoakley
00.000 kernel Kext loading now disabled.
00.000 kernel Kext unloading now disabled.
00.000 kernel Kext autounloading now disabled.
00.000 kernel Kernel requests now disabled.
00.019 kernel Process launchd [1] disabling system-wide I/O Throttling
00.019 kernel Process launchd [1] disabling system-wide CPU Throttling
Over the next 0.21 seconds, around 900 messages detail service shutdown before the final entries:
00.233 opendirectoryd SystemCache Deregistered for Kernel Identity Service requests
01.040 === system wallclock time adjusted
The subsequent startup is identical again:
08.811 === system boot: 00000000-0000-0000-0000-000000000000
09.429 AppleSMC Previous shutdown cause: 5
Conclusions
The two commands shutdown -r now
and reboot
appear, from the log entries which result, functionally identical. The big difference occurs between those two commands and the normal menu Restart command, as the latter devotes a significant period of time to shutting down GUI apps, the Finder and Dock, effectively logging the current user out before invoking shutdown -r now
to complete the restart.
Which should you use? Although there shouldn’t be any difference, it is worth noting that the Finder’s own restart routine calls shutdown -r now
, which is the more flexible command in any case. But if you can perform a shutdown or restart through the Finder, that is clearly preferable for its preliminary actions to log the current user out.