Existing users, log in.  New users, create a free account.  Lost password?


MacFixIt Logo
 
Contact Us | About MacFixIt | Who's Online  

Topic Options
#456672 - 12/02/08 08:23 PM check all system.log files near shutdowns
Hal Itosis Offline
MacWizard

Registered: 08/23/99
Posts: 7032
Loc: 10.5.7 (build 9J61)
Here's a shell script i wrote that will look at *all* system.log files
near where shutdowns have occurred... grabbing the final 22 lines
by default. If called with an integer argument, it will instead read
that many lines. (i set a totally arbitrary maximum of 511 lines...
since the *less* the better, really).

It works by looking for a certain keyword which appears at startup
(different in both Tiger and Leopard)... and then gets the lines that
fall just before that keyword. This has been tested and works fine
on both Tiger and Leopard. (Panther? Perhaps. Snow Leopard? I hope so).

Code:
#!/bin/bash -
# csd  :::  Check ShutDown
#(c)EF/-HI-2008.Dec.02
IFS=$' \t\n'
PATH=/bin:/usr/bin
export PATH

declare -i XCOD=0 v=0 default=22 max=511
x=${1//-/}; lines=${x:-$default}
v=`sw_vers -productVersion |awk -F. '{ print $2 }'`
t=npvhash; k=bzgrep; [ $v -lt 5 ] && t=quantum && k=zgrep

if [ -n "$(echo $lines |sed 's/[0-9]//g')" ] ||
	[ $lines -lt 1 ] || [ $lines -gt $max ]
then
	printf 'check system logs near shutdown\n' >&2
	printf 'Usage: \e[1m%s\e[0m [\e[4mN\e[0m]\n' \
		"`/usr/bin/basename $0`" >&2
	printf '# where 0 < N < %d\n' $(( max+=1 )) >&2
	printf '# N = %d by default\n' $default >&2
	exit 1
else
	for f in `ls -r /var/log/system.log*`
	do
		printf '\n\n\e[1m%s\e[0m >> \n' $f
		eval $k --color -B $lines -e $t $f
		(( XCOD+=$? ))
	done
	echo
fi
[ $XCOD -ne 0 ] && echo "$XCOD file(s) had no match" >&2
exit $XCOD

-HI-

___

For further assistance, see the "Unix FAQ" at macosxhints, noting these 3 sections:

Top
#457402 - 12/11/08 10:54 PM Re: check all system.log files near shutdowns [Re: Hal Itosis]
Hal Itosis Offline
MacWizard

Registered: 08/23/99
Posts: 7032
Loc: 10.5.7 (build 9J61)
It has come to my attention that the text 'npvhash' doesn't appear in
the system.log file of all machines running Leopard. Until I research
this a bit more, if anyone running the script comes up with all nine
logs looking empty... then, change the word 'npvhash' on line 11 to

quantum

I will repost an improved script once i find a better alternative.

--

Also, for anyone who prefers copy/pasting short clips of code over getting a shell script
up and running, there are two such examples in: >this post<
(the same npvhash/quantum substitution may still be necessary for some Leopard users).


Edited by Hal Itosis (12/11/08 11:37 PM)

Top
#457486 - 12/13/08 09:47 AM Re: check all system.log files near shutdowns [Re: Hal Itosis]
MicroMat Tech3 Offline
MacGuru

Registered: 10/08/99
Posts: 16666
Hal,

npvhash=4095 also appears in my All Messages log during a normal, user-inititated restart:

12/12/08 10:04:12 PM shutdown[23268] Notice reboot by MMT3:
12/12/08 10:04:12 PM shutdown[23268] Notice SHUTDOWN_TIME: 1229137452 734510
12/12/08 10:04:12 PM com.apple.loginwindow[24] Notice Shutdown NOW!
12/12/08 10:04:12 PM com.apple.loginwindow[24] Notice System shutdown time has arrived
12/12/08 10:04:12 PM mDNSResponder mDNSResponder-176.2 (Aug 15 2008 14:58:54)[23] Error stopping
12/12/08 10:04:13 PM com.apple.SystemStarter[17] Notice Stopping Cisco Systems VPN Driver
12/12/08 10:04:13 PM com.apple.SystemStarter[17] Notice kextunload: unload kext /System/Library/Extensions/CiscoVPN.kext succeeded
12/12/08 10:04:31 PM kernel Debug npvhash=4095
12/12/08 10:04:30 PM com.apple.launchctl.System[2] Notice launchctl: Please convert the following to launchd: /etc/mach_init.d/dashboardadvisoryd.plist
12/12/08 10:04:31 PM com.apple.launchd[1] Warning (org.cups.cupsd) Unknown key: SHAuthorizationRight
12/12/08 10:04:31 PM com.apple.launchd[1] Warning (org.ntp.ntpd) Unknown key: SHAuthorizationRight
12/12/08 10:04:31 PM kextd[10] Notice 407 cached, 0 uncached personalities to catalog
12/12/08 10:04:31 PM kernel Debug hi mem tramps at 0xffe00000
12/12/08 10:04:31 PM kernel Debug PAE enabled
12/12/08 10:04:32 PM kernel Debug 64 bit mode enabled
12/12/08 10:04:32 PM kernel Debug Darwin Kernel Version 9.5.0: Wed Sep 3 11:29:43 PDT 2008; root:xnu-1228.7.58~1/RELEASE_I386
_________________________
MicroMat Inc
Makers of TechTool

Top
#457496 - 12/13/08 02:20 PM Re: check all system.log files near shutdowns [Re: MicroMat Tech3]
Hal Itosis Offline
MacWizard

Registered: 08/23/99
Posts: 7032
Loc: 10.5.7 (build 9J61)
Originally Posted By: MicroMat Tech3
npvhash=4095 also appears in my All Messages log during a normal, user-inititated restart:
12/12/08 10:04:31 PM kernel Debug npvhash=4095

Hey MMT3... thanks!

Hmm, interesting how yours has that "Debug" word there.
Mine simply says:
Dec 13 14:41:48 localhost kernel[0]: npvhash=4095

--

Well, apparently this 'check shutdowns' script is still a work in progress. And -- although
originally intended as being for shutdown checking exclusively -- my most recent revision
[see below] can be *optionally* used to search system.log for any user-specified string.
Hopefully these additions will make it an even handier troubleshooting tool...

Change history:
  • instead of accepting an integer-only argument, the line count must be preceded by a -l flag (that's an l as in "line")
  • script still defaults to npvhash for Leopard and quantum for Tiger... but *any* text can be specified using the -t flag (t for "text")
  • the default line count is now 15 (instead of 22)

So -- for basic shutdown checks -- we can still type just "csd" to have it run with default settings.
But now, stuff like this is also possible:

csd -l 22 # increase line count to 22
csd -t 'Darwin Kernel Version' # search for the phrase 'Darwin Kernel Version'
csd -t error # search for the word 'error' instead (searches are case-sensitive)
csd -t [Ee]rror # search for either 'Error' or 'error'
csd -t '([Ee]rror|[Ff]ail)' # search for lines containing either 'Error' or 'error' or 'Fail' or 'fail'
csd -l 3 -t $USER # set line count to 3 and search for your username

Perhaps not all examples above are useful... just illustrating some possibilities.
(The "line count" principle works the same: find a keyword (or phrase) and include that number of lines *before* it).


Code:
#!/bin/bash -
# csd  :::  Check ShutDowns
#(c)EF/-HI-2008.Dec.02 [rev:2008.Dec.12]
IFS=$' \t\n'
PATH=/bin:/usr/bin
export PATH
PROG=`basename $0`
declare -i XCOD=0 v=0 default=15 max=511
x=; v=`sw_vers -productVersion |awk -F. '{ print $2 }'`
t=npvhash; k=bzgrep; [ $v -lt 5 ] && t=quantum && k=zgrep

QuitMess ()
{
	printf '\n \e[7mCheck ShutDowns\e[0m\n \e[1m'
	printf 'search for text in all system.log files'
	printf '\e[0m\n optionally set line count & grep '
	printf 'string\n Usage: \e[1m%s \e[0m [' $PROG
	printf '\e[1m -l\e[0m \e[4mN\e[0m ] [\e[1m -t'
	printf '\e[0m "\e[4msome\e[0m \e[4mtext\e[0m" ]'
	printf '\n where 0 < N < %d and' $(( max+=1 ))
	printf ' N = %d by default\n\n' $default
	exit 1
}

[[ $1 = --* ]] && QuitMess >&2
while getopts :l:t: opshun
do
	case $opshun in
	l)	x=$OPTARG ;;
	t)	t=$OPTARG ;;
	?)	[[ $OPTARG != [hH]* ]] &&
			echo "invalid option '-$OPTARG'"
		QuitMess >&2 ;;
	esac
done

lines=${x:-$default}
if [ -n "$(echo $lines |sed 's/[0-9]//g')" ] ||
	[ $lines -lt 1 ] || [ $lines -gt $max ]
then
	echo "improper value for -l argument: $lines" >&2
	QuitMess >&2
else
	for f in `ls -r /var/log/system.log*`
	do
		printf '\n\e[1m%s\e[0m >> \n' $f
		eval $k --color -B $lines -e \""$t"\" $f
		(( XCOD+=$? ))
		echo
	done
fi
[ $XCOD -ne 0 ] && echo "$XCOD file(s) had no match"
exit $XCOD




Edited by Hal Itosis (12/13/08 02:35 PM)
Edit Reason: 'cause ;)

Top
#457513 - 12/13/08 08:21 PM Re: check all system.log files near shutdowns [Re: Hal Itosis]
MicroMat Tech3 Offline
MacGuru

Registered: 10/08/99
Posts: 16666
Hal,

You are welcome.

It appears that the term before the message depends on which log is read. Here is the corresponding text from my system.log file (which uses military time at the start of each line, unlike the A.M./P.M. used by the All Messages log):

Dec 12 22:04:12 MMT3sMBPC2D shutdown[23268]: reboot by MMT3:
Dec 12 22:04:12 MMT3sMBPC2D shutdown[23268]: SHUTDOWN_TIME: 1229137452 734510
Dec 12 22:04:12 MMT3sMBPC2D com.apple.loginwindow[24]: Shutdown NOW!
Dec 12 22:04:12 MMT3sMBPC2D com.apple.loginwindow[24]: System shutdown time has arrived^G^G
Dec 12 22:04:12 MMT3sMBPC2D mDNSResponder mDNSResponder-176.2 (Aug 15 2008 14:58:54)[23]: stopping
Dec 12 22:04:13 MMT3sMBPC2D com.apple.SystemStarter[17]: Stopping Cisco Systems VPN Driver
Dec 12 22:04:13 MMT3sMBPC2D com.apple.SystemStarter[17]: kextunload: unload kext /System/Library/Extensions/CiscoVPN.kext succeeded
Dec 12 22:04:31 localhost kernel[0]: npvhash=4095
Dec 12 22:04:30 localhost com.apple.launchctl.System[2]: launchctl: Please convert the following to launchd: /etc/mach_init.d/dashboardadvisoryd.plist
Dec 12 22:04:31 localhost com.apple.launchd[1] (org.cups.cupsd): Unknown key: SHAuthorizationRight
Dec 12 22:04:31 localhost com.apple.launchd[1] (org.ntp.ntpd): Unknown key: SHAuthorizationRight
Dec 12 22:04:31 localhost kextd[10]: 407 cached, 0 uncached personalities to catalog
Dec 12 22:04:31 localhost kernel[0]: hi mem tramps at 0xffe00000
Dec 12 22:04:31 localhost kernel[0]: PAE enabled
Dec 12 22:04:32 localhost kernel[0]: 64 bit mode enabled
Dec 12 22:04:32 localhost kernel[0]: Darwin Kernel Version 9.5.0: Wed Sep 3 11:29:43 PDT 2008; root:xnu-1228.7.58~1/RELEASE_I386
_________________________
MicroMat Inc
Makers of TechTool

Top
#457516 - 12/13/08 08:40 PM Re: check all system.log files near shutdowns [Re: MicroMat Tech3]
Hal Itosis Offline
MacWizard

Registered: 08/23/99
Posts: 7032
Loc: 10.5.7 (build 9J61)
Cool... that looks exactly like mine now (except the Cisco VPN stuff, natch).

Gotta love this one:
Dec 12 22:04:30 localhost com.apple.launchctl.System[2]: launchctl:
Please convert the following to launchd: /etc/mach_init.d/dashboardadvisoryd.plist


That's an Apple version of "Note To Self". grin

Top
#457545 - 12/14/08 10:16 AM Re: check all system.log files near shutdowns [Re: Hal Itosis]
MicroMat Tech3 Offline
MacGuru

Registered: 10/08/99
Posts: 16666
The oversight was probably caused by the dearth of the no-longer-available Susan Kare icon magnets.
_________________________
MicroMat Inc
Makers of TechTool

Top


Moderator:  dkmarsh, MacManiac 

VersionTracker: Software Updates and Downloads | iPhone Atlas: iPhone Help, News, Tutorials, and Tips