4

As I asked in the title, how can I check if a Mac is rebooting after experiencing a power failure. It would be preferable to check this using terminal or some other script, as I would like to test this automatically in a script upon system startup.

bmike
  • 235,889
Matthew N
  • 1,141
  • 3
  • 14
  • 27

2 Answers2

6

You can check for the "Shutdown Cause" in the log.

  • 5 is a normal shutdown
  • 3 is pressing the power button
  • 0 is loss of power

In El Capitan and earlier:

cat /var/log/system.log | grep -i "shutdown cause"

In Sierra and newer:

log show --predicate "process == kernel" | grep -i "shutdown cause"

Or....just using awk to get the code:

log show --predicate "process == kernel" | awk '/shutdown cause/ {print $12}'

In Mojave and Catalina, you can issue the command to get a more fine grained approach to the log:

log show --predicate '(process = "kernel") && (eventMessage CONTAINS "shutdown cause")' --last 48h --style compact

This will process only the last 48 hours and output in a nice "compact" layout.

Allan
  • 101,432
  • I'm running High Sierra, when I run the command it returns "log: invalid predicate: [<OSLogEventProxy 0x7fbd9a50b1e0> valueForUndefinedKey:]: this class is not key value coding-compliant for the key kernel." – Matthew N Nov 24 '17 at 02:38
  • Then do a more obvious test : remove the power, restore the power and see if it reboots. Results will be obvious.... – Solar Mike Nov 24 '17 at 06:56
  • Try it without the `--predicate = "process == kernel" – Allan Nov 24 '17 at 11:01
  • I get "2017-11-07 17:57:15.707333-0800 0xa5 Default 0x0 0 0 kernel: (AppleSMC) Previous shutdown cause: 5" Is there a command/script I can use to just get the number out of the string? – Matthew N Nov 24 '17 at 14:16
  • Try log show | awk '/shutdown cause/ {print $12}' That should just give you the number. – Allan Nov 24 '17 at 14:33
  • @allan Ive tried cat /var/log/system.log | grep -i "shutdown cause" on a machine running 10.11.6 and it just gives me blank new prompt line, same if i run it sudo. Any ideas ? – sam Nov 10 '18 at 20:22
  • @sam - is there anything in the log itself? – Allan Nov 10 '18 at 21:00
  • @Allan its strange, i just re ran the 10.11 terminal command and it gave me a 5 response in the log for about half an hour ago, but nothing for any previous days, im trying to diagnose somthing that happened on 9/Nov, but its not showing up – sam Nov 11 '18 at 12:53
  • Not strange. After a certain amount of time, your log get's "archived" as it will only hold so much. They will be named /var/log/system.log.XX.gz. You will have to unzip them first to be able to view them. – Allan Nov 11 '18 at 18:30
2

In High Sierra, 10.13.5 I used System Information (alt About this Mac) to examine the Power Management log, under Software/Logs.

This clearly showed I'd had a power cut at or shortly after 02:35:14 am. I originally spotted it when the clock on my microwave showed 00:00. Below you cans see the power off and reboot times.

2018-07-07 02:35:14 +0100 Assertions PID 39(UserEventAgent) Released BackgroundTask "com.apple.backupd-auto" 00:00:34 id:0x0xb00009108 [System: BGTask]

Time stamp Domain Message Duration Delay
========== ====== ======= ======== =====
UUID: (null) 2018-07-07 10:25:13 +0100 Start powerd process is started

David Watson
  • 21