Apple Pro Training Series: OS X Support Essentials 10.9: System Troubleshooting
- Reference 29.1<br>System Initialization
- Reference 29.2<br>User Session
- Reference 29.3<br>Sleep Modes, Logout, and Shutdown
- Reference 29.4<br>Startup Shortcuts
- Reference 29.5<br>System Initialization Troubleshooting
- Reference 29.6<br>User Session Troubleshooting
- Exercise 29.1<br>Examine System Startup
- Exercise 29.2<br>Use Single-User Mod
From the book
From the book
From the book
GOALS
Understand the OS X startup process
Examine essential files and processes required to successfully start up
Learn about the various startup modes used by OS X
Troubleshoot the processes used at startup and login
System startup certainly isn’t the most glamorous part of OS X, but it’s clearly important and technically quite impressive. Apple has improved startup and runtime processes with every revision of OS X. When things work correctly, the startup process often takes under 30 seconds. Obviously, users appreciate a quick startup, but most aren’t aware of what goes on during system startup because their Mac computers usually work properly.
However, when things do go wrong during system startup, users often fear the worst. Novice users may assume that if their Mac computers won’t start up, they will lose important documents. But the system startup process can fail due to many issues that probably won’t result in any user data loss. It’s important to properly diagnose startup issues so you can get the Mac up and running, or at least try to recover data.
This lesson focuses on the process that your Mac goes through from the moment you press the power button until you ultimately reach the Finder. You will identify the essential files and processes required to successfully start up OS X. You will also explore the various OS X sleep modes, log out, and system shut down. You will then learn about the various startup shortcuts and diagnostic modes that work with Mac systems and OS X. Finally, the end of this lesson focuses on methods that will allow you to effectively troubleshoot system initialization and user session issues.
Reference 29.1
System Initialization
This section examines the main stages of the OS X system startup procedure. The stages of system startup can be categorized into either system initiation, the processes required to start the operating system, or user session, the processes required to prepare the user environment. At each stage the Mac presents an audible or visual cue to help you validate startup progress. The startup cues discussed here are what you’ll experience during a typical startup. Any deviation will be covered as you learn more about the startup process.
)
The four main OS X system initialization stages are, in order:
- Firmware—At this stage the Mac computer’s hardware is tested and initialized, and then the booter is located and started. Successfully completing this stage results in an audible startup chime and a bright flash from the power-on light, then all displays show a light gray background.
- Booter—The main job of the booter is to load the system kernel and essential hardware drivers, known as kernel extensions (KEXTs), into main memory and then allow the kernel to take over the system. The booter stage is indicated by a dark gray Apple logo on the main display.
- Kernel—The kernel provides the system’s foundation and loads additional drivers and the core BSD UNIX system. It is indicated by a dark gray spinning gear below the Apple logo on the main display.
- System launchd—Once the core operating system is loaded, it starts the first nonkernel process, the system launchd, which is responsible for loading the remainder of the system. This stage is indicated by the disappearance of the dark gray spinning gear and the brief appearance of a white background on all displays. Successful completion of this stage results in either the login screen or the Finder, if the user is set to automatically log in.
System Initialization: Firmware
Your Mac computer’s firmware, also called BootROM, resides on flash memory chips built into the main computer board. When you power on your Mac, even before it starts a “real” operating system, the firmware acts as a mini-operating system with just enough software to get things going. Specifically, the firmware tests and initializes the hardware, and then locates and starts the system software booter.
Intel-based Mac systems feature firmware based on the Intel Extensible Firmware Interface (EFI) technology. Aside from supporting the Intel processor hardware, EFI is what allows your Mac to start up from OS X, Windows, or any other Intel-compatible operating system.
Power-On Self-Test
The first thing your Mac firmware does at power on is the Power-On Self-Test (POST). The POST tests built-in hardware components such as processors, system memory, network interfaces, and peripheral interfaces. When your Mac passes the POST, you hear the startup chime and see a light gray background on all displays. After a successful POST, the firmware goes on to locate the booter file.
If your Mac fails the POST, the display remains blank or off, and you may get hardware error codes. Depending on the age and model of your Mac, these error codes may manifest as audible tones, a series of flashes from the external power-on light, or internal diagnostic lights illuminating. You may even see a combination of these things. Regardless of which error code you experience, it indicates that a hardware problem exists that OS X cannot control. You can visit the Apple support website at www.apple.com/support to identify your specific Mac error code, or you can take your Mac to an Apple Authorized Service Provider.
Booter Selection
By default, the firmware picks the system booter file that was last specified from Startup Disk preferences in OS X or the Boot Camp control panel in Windows. The booter file’s location is saved in your Mac computer’s nonvolatile RAM (NVRAM) so that it persists across system restarts. If the booter file is found, EFI starts the booter process and OS X begins to start up. This is indicated by the dark gray Apple logo in the center of the main display.
)
If the firmware cannot locate a booter file, a flashing folder icon with a question mark appears. Troubleshooting this issue is covered later in this lesson.
)
FileVault 2 Unlock
If the system disk is protected with FileVault 2 encryption, the OS X booter cannot be accessed until the system disk is unlocked by a user. If this is the case, the system instead begins initial startup from the OS X Recovery HD, where a special EFI booter resides that presents the user with an authentication screen much like the login window. The FileVault 2 authentication unlock screen appears just a few seconds after POST and has a much lighter background than the standard OS X login window.
Once the user successfully authenticates and unlocks the encrypted system disk, the EFI firmware is granted access to the system volume containing the OS X booter. Startup then continues as normal, with one exception. Because the user has already authenticated to unlock the disk, the system will automatically log in to his session without the user having to authenticate again at the login window. This happens only once per startup and only for the user who unlocked the encrypted system disk.
Startup Shortcuts
Your Mac firmware also supports many keyboard shortcuts, which, when pressed and held down during initial power-on, allow you to modify the startup process. Some of these shortcuts modify the booter selection, while others modify how OS X starts up. Startup shortcuts are detailed later in this lesson.
Firmware Updates
Boot read-only memory, or boot ROM, refers to older versions of firmware technology that are not upgradable. Your Mac firmware, however, is upgradable, and on Intel-based Mac systems it’s even replaceable if it becomes damaged.
The OS X software update service may automatically update some Mac firmware, but you can also check the Apple Support website for the latest list of Mac firmware updates. Article HT1237, “EFI and SMC firmware updates for Intel-based Macs,” maintains a list of Mac firmware updates. You can replace your Intel-based Mac computer’s firmware using a firmware restoration CD as outlined in article HT2213, “About the Firmware Restoration CD (Intel-based Macs).”
System Initialization: Booter
The booter process is launched by your Mac firmware and is responsible for loading the OS X kernel and enough essential kernel extensions, or KEXTs, so the kernel can take over the system and continue the startup process. Your Mac firmware also passes on any special startup mode instructions for the booter to handle, such as entering safe mode when the user is holding down the Shift key. The booter process itself resides at /System/Library/CoreServices/boot.efi.
To expedite the startup process, the booter loads cached files whenever possible. These files contain an optimized kernel and KEXTs that load much more quickly than if the system had to load them from scratch. These caches are located in the /System/Library/Caches/com.apple.kernel.caches folder. If the system detects a problem or you start OS X in safe mode, these caches are discarded and the kernel-loading process takes longer.
As covered previously, the booter process is indicated at startup by the dark gray Apple icon in the center of the main display. If the booter successfully loads the kernel, this is indicated by a small, dark gray spinning gear icon below the Apple icon. Though, some modern Mac systems start up so fast you may not even see the spinning gear before the next stage is indicated.
)
If your Mac is set to NetBoot and the firmware successfully locates the booter file on the NetBoot server, you again see the dark gray Apple icon. However, in this case the booter and the cached kernel information must be downloaded from the NetBoot server. This process is indicated by a small, dark gray spinning globe icon below the Apple icon. The globe icon is replaced by the standard spinning gear icon once the kernel has been successfully loaded from the NetBoot server.
)
Finally, if the booter is unable to load the kernel, a dark gray prohibitory icon takes the place of the Apple icon. Again, troubleshooting this issue is covered later in this lesson.
)
System Initialization: Kernel
Once the booter has successfully loaded the kernel and essential KEXTs, the kernel itself takes over the startup process. The kernel has now loaded enough KEXTs to read the entire file system, allowing it to load any additional KEXTs and start the core BSD UNIX system. A spinning gray gear icon below the Apple icon indicates the kernel startup progress.
Finally, the kernel starts the first normal (nonkernel) process, the system launchd, which is ultimately the parent process for every other process. The appearance of anything besides the white startup screen with the Apple logo is an indication that the kernel has fully loaded and the launchd process is starting other items.
Again, in most cases the kernel is loaded by the booter from cached files. However, the kernel is also located on the system volume at /mach_kernel. This file is normally hidden from users in the graphical user interface, because they don’t need access to it. Many other hidden files and folders at the root of the system volume are necessary for the BSD UNIX system, and again the average user doesn’t need access to these items. As covered in Lesson 27, “Peripherals and Drivers,” KEXTs reside in the /System/Library/Extensions and /Library/Extensions folders.
System Initialization: System launchd
Once the kernel is up and running, the Mac is ready to start running processes at the behest of the system and eventually human users. The first normal (nonkernel) process started is the system launchd, located at /sbin/launchd, which runs as root and is given the process identification number of 1. In UNIX terms, the system launchd is the first parent process that spawns all other child processes, and those processes go on to spawn other child processes.
The first task for the system launchd process is to complete the system initialization by starting all other system processes. Earlier versions of OS X show the “Welcome to Mac OS X” dialog with a progress bar to indicate system initialization status as the various system processes start up.
However, beginning with OS X v10.5, the launchd process was highly optimized, so the system initialization process takes only a few moments and is difficult to visually discern. The best indication that you have reached this point is that the dark gray Apple logo is replaced by the login window or the user’s desktop background. If you have a Mac system with multiple displays you may also notice a brief white flash coming from the secondary displays. This is a result of launchd starting the WindowServer process, which is responsible for drawing the OS X user interface, but it’s still a good indication that things are progressing through the system startup process.
The launchd process is designed to expedite system initialization by starting multiple system processes simultaneously whenever possible and starting only essential system processes at startup. After startup, the system launchd process automatically starts and stops additional system processes as needed. By dynamically managing system processes, launchd keeps your Mac responsive and running as efficiently as possible.
System launchd Items
As covered in Lesson 15, “System Resources,” launchd manages system processes as described by launchd preference files in the /System/Library/LaunchDaemons folder. Third-party processes can also be managed when described by launchd preference files in the /Library/LaunchDaemons folder.
Apple strongly encourages all developers to adopt the launchd system for all automatically started processes. But the system launchd process also supports legacy startup routines. This includes support for running the traditional UNIX /etc/rc.local script during system initialization if present, though this script is not included on OS X by default.
The system launchd process also starts the /sbin/SystemStarter process, which manages system processes as described by legacy OS X startup items. OS X does not include any built-in startup items, but SystemStarter still looks in the /System/Library/StartupItems and /Library/StartupItems folders for third-party startup items.
Viewing the launchd Hierarchy
You may find it beneficial to open /Applications/Utilities/Activity Monitor and examine the process listing as you learn about how OS X starts up the user environment. The Activity Monitor application lists all processes along with their identification numbers and parent/child relationships. In the Activity Monitor, you see this relationship best if you choose View > All Processes, Hierarchically. You can also view a process’s parent process by double-clicking its name in the list. Detailed information about using Activity Monitor is covered in Lesson 21, “Application Management and Troubleshooting.”
)