Macintosh Troubleshooting 101

From Provider Wiki

Jump to: navigation, search


This page was made in conjunction with a March 8th presentation at MacNET. The slides from which can be found here: Media:TroubleshootingMacOSX.pdf

Contents

Introduction

Background Information

PPC vs. Intel and Rosetta vs. Universal Apps

Staring in January of 2006 and ending in August of that same year Apple transitioned from the PowerPC (PPC) architecture of CPUs to Intel's Core (x86) line of processors. This is important because normally binary applications compiled for one architecture cannot run on another architecture. So there is a major difference that LSPs should be aware of. But this migration was remarkably low-impact for most users because Apple introduced two technologies it calls "Rosetta" and "Universal Applications".

Rosetta is a technology that allows Intel Macintoshes to run applications that were complied for the PowerPC. It works by translating the instructions that make up the application as it is running. As you can imagine this slows things down. For many applications users won't notice because the computer they are running it on is that much newer (and thus faster), but for some applications (such as Photoshop) this can be a limiting factor.

There is also a second consideration about Rosetta: Because it has to translate things as it goes there are a few limitations. Most importantly if your application uses libraries or plugins all of them must be either PowerPC or Intel native. You cannot mix-and-match. The largest impact this has is that you can't use older plugins on newer versions of Apps. An example was that as the first Intel Macintoshes came out the Flash plugin did not work with Safari running as an Intel-native application. You could force Safari to run as a PPC application, but that made it noticeably slower. This example has since been corrected.

Universal Applications on the other hand are native to both PowerPC and Intel at the same time. Most commercial applications that are coming out now fall into this category. They run at full speed on both platforms, and you can carry the application back-and-forth between platforms without any worries. There are some notable exceptions to this though, the highest profile being Adobe Photoshop CS2. Photoshop CS3 will be a Universal Binary on the Macintosh platform, but CS2 and earlier are PPC only. They run in Rosetta, but with a noticeable performance hit.

MacOS 9 vs MacOS X and Classic

Classic, Carbon, Cocoa, and others

Classic

Classic is a complete copy of MacOS 9 running inside MacOS X. There are a few modifications made to MacOS 9 to allow it to use the same networking and disks, but for the most part you can run most MacOS 9 (and prior) applications within Classic. The easiest way of telling if you are in a Classic application is if the Apple icon in the upper-left-hand-corner of the screen is rainbow colored or solid blue. The former means Classic.

Classic does not function at all on Intel Macintoshes, and there is no reason to believe that Apple will ever support it.

Classic applications should be seen as old legacy applications, and we will not be going into troubleshooting for them in this document.

Carbon

Carbon is one of the two "native" programming environments for MacOS X. It is a modernized version of the MacOS 8/9 API. In fact there were even extensions that allowed MacOS 8.5 and 9 to run a large subset of the Carbon Applications. The main programming language for writing Carbon applications is C++ and until recently many of the main Carbon Applications were developed using Metroworks CodeWarrior (no longer available).

Many of the largest applications out for MacOS X are written in Carbon. As a short list of examples the following applications are all Carbon: Adobe Photoshop, Micorsoft Office for Macintosh, MacOS X's Finder, QuickTime (in transition in 10.4). Carbon is a first-class citizen on MacOS X and can access all of the features the the OS provides.

Aside: Cabon apps can be written as either Mach-O or CFM applications, this refers to the ABI (Application Binary Interface). Mach-O is the form that Cocoa uses and can access many of MacOS X's more powerful features. This is one of the things that decides if an application can work on MacOS 9, the other being the use of the QuickDraw libraries vs. CoreGraphics for drawing. All Universal Binary Applications must be Mach-O, which is causing a massive change in practices at companies such as Adobe.

Cocoa

Cocoa is arguably the most "mac-like" programming environment. It is hard to create a Cocoa application that does not feel and behave like a Macintosh application. Cocoa has its roots in the programing environment for the NeXT operating system, and is based on the concept of frameworks.

For system troubleshooters Cocoa applications often are the easiest to troubleshoot as they tend to be built on systems that are pretty good at reporting problems, if you know where to look.

Others

There are a variety of other languages and environments that are semi-native on MacOS X. As a quick overview here are some of them:

  1. X-11: Apple has a nice implementation of the XWindows system that operates much as it would on linux/*bsd/Solaris systems.
  2. perl/python/ruby/php/bash: all of these languages are included (at least from 10.3 onward) and function much as you would expect them to from other platforms. The first three even have bridges that allow them to be used to develop GUI applications using Cocoa.
  3. Java: There is a Apple-provided Java Runtime. For faceless Apps the performance is great, the GUI is a little slower. There is a software bridge that allows developers to make Cocoa applications using Java.

General Troubleshooting Skills

The Troubleshooting Cycle

Behind the Scenes

Apple's way of thinking

Before going any further it is valuable to get a feel for how Apple likes things to be laid out. Apple does not strictly enforce things along these lines (and occasionally breaks them itself), most applications respect and use these layouts, and so they for a general rule when you are looking for things.

Apple recognizes three (or five) "zones" for things: System, Computer, and User. In some cases there can be two additional layers before and after "Computer", those are Network and Group, but you will not generally see those unless you are working with managed computers. Those are outside the scope of this document.

For each of these three zones Apple repeats the same pattern of folders:

KEEP WORKING HERE

Application Preferences

Apple has long been a proponent of keeping all preferences in a single place. For MacOS 9 this location was <Hard Disk>:System Folder:Preferences (Classic is set to keep preferences in the same place now). In MacOS X this has become just slightly more complicated because MacOS X is a multi-user OS from the start.

Application preferences for a single user naturally go into <user folder>/Library/Preferences. Apple encourages developers to use the "reverse internet naming convention", so for an application like iCal the preferences file is named: "com.apple.iCal.plist". Since each user's preferences are stored separately, each user can have separate preferences for most things.

However, there are some things that need to configured on a system-wide basis. An example of this is the network firewall.

The "plist" format

Developer's are free to do anything they wish to do along these lines, but Apple makes it very easy to use their convention, and to use their "plist" format.

The "plist" format is similar to XML, and can even be represented in XML format (it usually is), but has more limitation put on it. In 10.0 through 10.3 the default format for plists is XML, but in 10.4 the default format has changed to a binary format.

For more information about the plist file please see Wikipedia's entry on the subject.

Anatomy of an Application

How Users are Stored

Directory Services

Directory Services is a framework that allows users to come from multiple sources. If you set it up properly you can use a mix of users who authenticate as local users, ActiveDreictory users, Kerberos users, from a MacOS X Server (OpenDirecory), or Novel's system. And you can set the order that they are checked (local is always first).

Rather than going into a lot of detail about how this system works, if you want to explore this a little bit, go into /Applications/Utilities and look at "Directory Access".

NetInfo

Local users are stored in NetInfo. NetInfo is a hierarchical database that originally comes from the NeXT operating system, and can actually form complex trees of cascading servers. Nowadays this behavior is ignored and NetInfo is only used to store local users, and cached copies of users from other methods for offline use.

There are two main ways of accessing NetInfo as a system administrator: the GUI application at /Applications/Utilites/Netinfo Manager and a set of command line applications.

The GUI application comes in handy for things like removing the cached copy of a AD account (so that it can re-build), or examining the details of a user (like where there home directory should be). I would advise caution wile using it, as you can render your computer unbootable in NetInfo.

The command line applications include:

  • nicl - an interactive browser for examining and changing values (uses commands like ls, cd, and rm)
  • nidump - allows you to dump out the entire NetInfo database, or a specific path to a file
  • niload - allows you load the data you dumped out using nidump back into a NetInfo database

For really adventurous system administrators you can do some interesting things with scripting and NetInfo, including adding local users to a system, or changing the path of home directories. But I would advise a lot of testing on machines you can afford to break before attempting this in a production environment.

Important Tools

Console.app

Terminal.app

Single User Mode

Hardware

How to use AppleCare

If you have a computer that you think needs warranty service from Apple the first thing to do is to see if the computer is registered with Apple.

  1. You can do this yourself online, but to do so you will have to get the computer's serial number. Apple puts the serial number on a label on every single computer they make, but sometimes it can be a little hard to find. Apple does have a page with instructions on finding your serial number that should make this easy.
  2. Once you have the serial number in hand you can check the AppleCare status on Apple's support page. There is a place to put your serial number under the "About Your Support Coverage" section on the right hand side. This will tell you what model you have, whether it is registered with Apple for Applecase, and if so then how much time you have left on your coverage.
  3. If you do have AppleCare, then you just need to call Apple at 1-800-275-2273, and walk through the phone system. They will ask you for your serial number, walk you through some troubleshooting steps, and then get you setup to repair the computer.
    • If you have a desktop computer then they will send a technician to see you with the parts to repair your computer. The local company that is contracted for the service in this area is very good, and will usually call the same day to check in with you. They then have to wait for Apple to ship them the part (typically overnight), and then they will contact you to setup a time to do the repair (typically the next day).
    • If you have a laptop they will send you a box (typically overnight) to put the computer in that has pre-paid labels on it to send it back. Then you call the service that brought the box to pick it up. Typically you will get the computer back within a four or five days.
  4. If you bought AppleCare but did not register it, and it has been longer than 90 days (sometimes a year) since you bought the computer, then you have a little work on your hands.

CREATE APPLECARE PAGE

Troubleshooting Techniques

Checking the log files

Using Console.app

Useful locations

  1. /var/log/
  2. /Library/Logs

Launching from the Command Line

Running as a different user

If you are having problems with programs or after you have logged in it is often a good idea to try logging in as another user and see if the problem persists. This can help you isolate a problem very quickly. If you find that logging in as another user solves the problem here are a few things to look for:

  • a problem with a preference file in ~/Library/Preferences
  • problems with the cache or "Application Support" files in ~/Library
  • font issues with fonts in ~/Library/Fonts
  • the user has installed haxies of one sort of another or input managers

Boot in Safe Boot Mode

Apple does have a safe mode, and at times it can help you troubleshoot what is going wrong. Here is a link to Apple's documentation on the subject:

TIL: What is Safe Boot, Safe Mode?

Single User Mode

Kernel Panics

What is a Kernel Panic

When a problem occurs within a regular program the Operating System can usually catch the problem before it goes to far. However, if the problem happens in the OS itself, or in parts of software that touch hardware directly, this problem can get around the defenses and start messing up the OS. When the OS detects that things are going bad its final resort is to declare a Kernal Panic, and stop everything.

Older versions of MacOS X had white text on black backgrounds running down the left side of the screen. Newer versions grey out the background information and have a window asking the user to restart in a number of different languages.

Possible Causes

Kernel panics are usually caused by one of a few things: bad memory, bad peripherals, bad drivers, or bad hardware. Usually you should try to check them in that order. Note that most of the things on this list are hardware, or hardware related.

Troubleshooting Possibilities

List of Problematic Hardware

  1. Memory
    • Memory that is bad, or even just slightly out-of-spec can cause a wide variety of problems. Memory that is truly bad will cause a computer to not boot, or frequent Kernel Panics (often when you load more programs, and finally reach that bit of memory). RAM that is just slightly bad more often causes applications to do weird things, or crash.
  2. Many people will suggest that you use s software memory tester, such as the one that comes on the AppleCare CD, or Remember can sometimes verify that it is a memory problem. But just because the memory passes those tests does not mean that memory is not responsible. The only true test for RAM is a hardware RAM tester.
  3. Old SCSI cards
    • Old SCSI cards that people have left in computers as they were upgraded (especially from 10.2 to 10.3) are another source of problems. Some of these cards will work partially with newer versions of the OS, but cause crashes, others will not allow the computer to properly go to sleep, and another group will not allow the computer to even boot. If you are not using a card like this it is worth taking out of the computer.
  4. External Peripherals
    • External peripherals can also be an easy-to-diagnose source of problems. If you are getting regular crashes with a peripheral plugged in, but none without it plugged in then you have probably isolated the problem. Examples of problems you might run into:
    • FireWire drives with old firmware. There were a number of upgrades for the firmware for the bridge chip in external FireWire drives. If you have an external drive it is worth checking to see that it has the latest firmware applied to it. Those can be found through the manufacturer.
    • USB devices with frayed or kinked cables. If a USB cable has enough damage to it it can start to send really weird signals to the USB ports on a computer. In some cases this can cause the computer to crash, or behave oddly. Other symptoms might be periodic freezes, or the device only working periodically.

Software that can cause issues

  • Haxies

Places to look for information

  1. MacEnterprise and the MacEnterprise mailing list - focused somewhat on large deploments.
  1. MacOS X Talk and MacOS X Admin - High-volume mailing lists that cover a lot of ground. There is a lot of traffic, but these sites generally are some of the first to track and solve problems.
  1. AFP548 and the AFP548 Forums - In-depth articles about MacOS X depoyment questions.
  2. MacOsXHints - A great repository of user-submited information. Pay attention to the user comments on the site, they are often bette sources of information.
  3. Apple's Discussion Forums - Sometimes Apple Employees post some great information here. But it tends to be spotty.
  4. The Apple Knowledge Base - There is a lot of good information here about Apple-sccnoledged issues. This is especially helpfull when you suspect bad hardware.
  5. MacWorld UK - A good source a Macintosh related news.
  6. MacUpdate and VersionTracker - Two places to watch for updates.
  7. LowEndMac - A great resource for finding specs on older computers.
  8. Mac Fixit - A little reactionary, but a good canarry in the coal mine. Take it with a large grain of salt.

Difficult to diagnose problems

PRAM Battery Issues

Font Corruption

Symptoms of Bad Fonts

There are a number of problems that can crop up if you have bad fonts on your system:

  1. Applications randomly quiting
    • Microsoft Word is especially venerable to this problem. Usually it will fail to even startup or take a long time to do so if this is a big issue.
  2. Random pauses where applications will not respond.
    • These are typically about 30 seconds long
  3. On 10.2 and 10.3 you will see a lot of error messages is the System Log about "reserved range exhausted"
  4. The system takes longer to startup and log in
    • This is a really hard one to diagnose, but sometimes bad fonts can be involved.

How to check for Bad Fonts

  1. With the introduction of 10.4 Apple added the FontBook program to /Applications/Utilities. While it is not a professional-level font management solution it does have the nice feature of being able to check font files for corruptions. It is not very good a fixing those problems, but does give you a free tool to check font files for problems. For most users simply deleting the font is ok, or replacing it with a known-good copy from somewhere else.
  2. Another option is to use one of the professional-level tools that can not only find bad fonts, but has a good chance of repairing them. Two good examples are:

Locations to look for Fonts

There are four places you need to look for fonts in MacOS X:

  1. /System/Library/Fonts
    • This is where the OS stores its fonts. You should really not ever do anything with the files in this location. However, occasionally one of these files goes bad. In that case you should replace it with a known-good copy from another MacOS X computer.
  2. /Library/Fonts
    • This is where most of your custom fonts probably live, and should be where most of your troubleshooting effort should go into.
  3. /System Folder/Fonts
    • This is where MacOS 9 (Classic) stores its fonts. They are also made available to Cocoa and Carbon applications, so don't ignore this location.
    • If the user upgraded or migrated from MacOS 9, there is a chance that they have a large number of fonts here, and a good chance that many of them are old and possibly bad. Fonts that come from non-big-name font foundries (such as the $10 for a 1000 font CD's) often have a number of problems with them.
  4. In each user's folder in ~/Library/Fons
    • These fonts are only loaded for the user that owns them.
    • In many cases the only fonts you will see here are the ones the Microsoft Office installs. You can delete these, and Office will notice that they are gone and attempt to recopy them into this location. If the computer has a number of users on it you might want to move these fonts to /Library/Fonts and then delete them from all of the users' folders. Office is smart enough to not put them in the individual folders if you do.

Hard Drive Dying

Retrieved from "http://prowiki.isc.upenn.edu/wiki/Macintosh_Troubleshooting_101"
Personal tools