By Graham K. Rogers

This is the article I have tried to delay writing, partly because a solution was so long in coming. In more than 10 years of using OS X, I have been pleased with the stability, even of beta versions run under test programs. In the last month, my previously stable version of Yosemite has become unpredictable, although I now have a solution, in part. I think.

I started taking notes in the middle of November after Kernel Panics (KP) started to appear with some frequency. I have been running OS X Yosemite since it was released (and before), but had experienced nothing that would particularly make me worry. Suddenly, I was seeing kernel panics several times a week. The lack of regularity - it may be a couple of days between these forced shutdowns - and the different actions that appeared to cause them, made analysis a little difficult.

I went through a number of repair processes, but still could not find a specific cause. I had intended this initially as the basis for one of my columns in the Life section of Bangkok Post, but the difficulty in finding a resolution, along with stability problems being reported by others, suggested the problems may be deep-seated. And the technical nature would not have been suitable for the newspaper audience.

While a KP used to be something of a disaster in earlier versions of OS X, the way the system now works means that most data is unaffected. Aperture and iPhoto needed repairs if they were open when a forced shutdown occurred, but in the main, I was able to pick up where I left off within a minute or two. Without intending to sound complacent, however, the KP is a sure sign that something is wrong and needs to be fixed.

The last few Macs I have owned have been the most stable I have ever used. Even when I was running a pre-release version of the latest OS X 10.10, Yosemite, it did not let me down. When the Gold Master of Yosemite was released I continued to enjoy that stability.

When a new version of OS X arrives, there are always problems while some developers play catch-up. Although one or two applications had been playing up for a while, two specific events took place at the end of one week in the middle of November: the arrival of my iPhone 6 on a Thursday (13 November); and a project deadline the next day.

Each semester I ask my students to create a short movie. They bring them into my office on external media: flash drives or hard disks. Usually, there are no problems, but this year three of the files (all of which, the students told me, had been made using Sony Vegas) were difficult to handle.

These files would not open in the Finder, or in QuickTime. I did manage to open them using VLC. One of the files caused more problems by asking for Admin privileges. I did not allow this, but had vague memories of the infamous Sony Root-kit. I have not bought any Sony product since then. This file problem, however, ended up a red herring.

That Friday evening, I had the first KP in a long time. And in the couple of weeks that followed there were a whole lot more. The way that OS X works these days means that there is less chance of losing data when such an unexpected shutdown occurs, but my instinct is to find the cause and fix it as soon as I can.

I started with basic disk repairs from startup, but even shutting down sometimes caused a KP, suggesting it might be either a problem at the Root level; or perhaps hardware. My approach was to use the Single-User Mode: starting the computer with the Command and S keys pressed. Once started, I am able to use a UNIX utility (fsck -fy) to check and repair the disk. Anyone worried about working at the command line should avoid this.

An alternative I also used is the Rescue partition that all OS X installations have. Start the computer with the Command + R keys and there is a selection of repair tools available. Using this, it is also possible to install a new version of OS X, as well as having access to a number of other utilities available to make repairs.

As well as that quick attempt at a fix, I also ran Disk Warrior. I have a bootable flash drive with a version of this installed on it, so I can start the computer from the external disk and effect repairs on the main disk. I now have a Yosemite installation on an external disk. Disk Warrior found a few minor file problems which were fixed. The KPs continued.

I began to suspect hardware, but only because I could find nothing else. Apple includes a hardware test as part of the installation: it is in the processor, not on the disk and can be activated by starting the computer with the D key pressed. The tests found nothing.

With the KPs continuing on average once a day, I was able to carry on working - albeit warily - with the occasional maintenance checks; but still I could find nothing. I reinstalled OS X over the top of my current system and all seemed stable for a few hours; but it was not fixed. When the 10.10.1 update arrived, I tried that, but again - often when I was away from the computer - it would crash and restart.

A new Safari version arrived and that seemed to restore stability, at least for a couple of days. The same with other applications or utilities I thought might be involved:

• Little Snitch (this appears in crash logs as a loaded kext), so when I installed an update offered, I cleaned out preferences;

• iStat Server was reported to be a possible cause by some users in online forums, but when I disabled it, there was no significant improvement.

The same unpredictability was evident when a KP occurred, although sometimes this pointed at a possible Wi-Fi problem, (exactly what was still almost impossible to pinpoint). Clicking on a photograph in Facebook or Aperture, might cause the screen to go black, then the KP warning would appear. Both of these use Internet links, and hence Wi-Fi (Aperture connects to Facebook, Flickr and iCloud).

At other times I experienced a KP when restarting the computer, or shutting down - essential steps for some maintenance processes. This was new. As I had also experienced KPs when unmounting external media, I wondered if this was a final step in the shutdown process and the installation was at fault. Most of the KPs with external media were with disks connected via Thunderbolt ports, but once or twice (as if to confound me) a USB drive would also press the KP button.

This, of course, would not suggest a Wi-Fi problem was the cause of these KPs. Inevitably, I was moving towards the idea of reformatting the hard disk and reinstalling OS X.

I needed to find someone with the skills to read crash logs in the Console utility, so posted a message in the Apple User Forums asking if anyone could help. Soon after I was asked to post a System Diagnostic Report

While in the forums I looked for other threads with users discussing similar problems and in one found a link to an app that creates a report on the disk installation: EtreCheck.

Using this, I found that a lot of files on the Mac are redundant: some left over from software that was deleted; or no longer used by later versions of OS X. This is a good argument for a clean installation rather than using a backup.

The simple answer that came back from the forums was that, as I had already suspected, Little Snitch was a probable cause. On the one hand I was dismayed by this as this utility is quite important for Mac users as a way to monitor (and stop when needed) connections to the outside world. It has also been no problem in the several years I have been using it. But all it takes is just a minor conflict to be introduced and the whole house of cards can come tumbling down.

On the other hand, this was updated - Little Snitch 3.5.1 nightly (4231) - just after the last KP on 3 December and (so far) stability has returned, despite me trying a couple of unusual activities, like running a scanner and its software for a couple of hours, editing watermarking software as well as the same Facebook, backup, USB and Thunderbolt activities - including a restart or two - that might have prompted that "restart your computer" screen in the last couple of weeks.

Right now, the Mac is on probation. If the KPs return, two suggestions were made:

• Remove the Little Snitch installation, following the developer's instructions - as this is installed fairly deeply in the system, it is not just a question of throwing the app in the trash and walking away. There are a number of related files that a user cannot usually access which will need proper handling.

  The previous version (3.5) was installed on 14 November which coincides with the start of the KPs - the same day that the students sent me their files.

• If the KPs persist even after the removal of the software, it was suggested that a visit to the service agent would be advisable. When I asked further if it could be a hardware problem, the answer was, "Yes". Brief. To the point. Unequivocal.

Knowing that the latest MacBook Pro range was designed with parts that could not be replaced piecemeal, an out-of-warranty repair might be expensive, so I bought Apple Care in June of this year and was lucky enough to find it on offer: 7,225 baht with 1,275 baht off. Insurance like this is always a gamble, but while hard disks are not expensive these days, RAM (and I have 16 GB) or a mother board would be.

Fingers crossed. Sort of.

See also:

• Kernel Panics Galore: Unwelcome Problems (not apparently cured)

• Kernel Panics Galore: Unwelcome Problems (preparing for the service center)

• Kernel Panics Galore: Unwelcome problems (sailing into dry dock)

• Kernel Panics Galore: Unwelcome problems (adapting to change and making changes to images) - Resize, Auto Resize and Simple Resize

  <

• Kernel Panic Restore: Macbook Pro Time Machine Backup onto a Spare iMac

Graham K. Rogers teaches at the Faculty of Engineering, Mahidol University in Thailand where he is also Assistant Dean. He wrote in the Bangkok Post, Database supplement on IT subjects. For the last seven years of Database he wrote a column on Apple and Macs. He is now continuing that in the Bangkok Post supplement, Life.