Skip to main content

We've been having an alarming amount of Kernel panics this past week. The Macs that I've seen this happen to are on Sierra and only a couple that have upgraded to High Sierra. I was thinking it was caused by some of them doing upgrades to High Sierra, but when chatting with the employees, they either do a restart or turn it on from a shutdown. Nothing out of the ordinary that I can find. Anyone else having these or ran into something like this?

Kernel Panic logs are stored in:
/Library/Logs/DiagnosticReports



You'll probably find the culprit in there. Its usually caused by hardware/drivers mis-communicating with each other. For example you'll get something like this on mine, when my GPU triggered a kernel panic:



Mon Jan 8 15:53:37 2018

Event: GPU Reset
Date/Time: Mon Jan 8 15:53:37 2018
Application:
Path:
Tailspin: /Library/Logs/DiagnosticReports/gpuRestart2018-01-08-155337.tailspin
GPUSubmission Trace ID: 0
OS Version: Mac OS X Version 10.13.2 (Build 17C88)
Graphics Hardware: NVIDIA GeForce GT 750M
Signature: 20

Report Data:

NVDA(DMA): Channel exception! Exception type = 0x20 DMA Engine Error (PBDMA Error)
Channel Info: [17, 0x19, 0x23, 0xf8a4]
Version Info: [com.apple.GeForce, 10.2.8, 0x4e554e, 22470010, 355.11.10.10.20.111, 1]

I encountered this due to 3rd party applications using kernel extensions e.g. Symantec, Avecto, etc. It looks like whatever change was made to mitigate Meltdown and/or Spectre is the cause which is why it's happening in both 10.12.6 and 10.13.x. The machines were stuck in a boot loop and had to be mounted in target disk mode to retrieve the logs.


This is an issue with the 2018-001 update Apple just released. The Kernel meltdown happened to us because of carbon black. Here are a few articles revolving around the issue.



https://discussions.apple.com/thread/8253958



https://support.apple.com/kb/DL1956?locale=en_US



https://www.carbonblack.com/2018/01/24/alert-latest-macos-security-updates-cb-response-cb-protection-customers/



https://www.jamf.com/jamf-nation/discussions/26832/2018-001-safari-update-causing-crashes-on-10-12-6


I also have had five systems with a Kernel panic in the last week. 2013 and 2015 15" MBP Retina models with El Cap and Sierra. Our AV product Trend Micro was causing this for us. If I removed Trend AV it works fine, after an updated client was installed all is well.


Apparently this only applies to TMS versions older than 3.0.3034.
We experienced the same problem - after the 2018-001 security update the machine throws a kernel panic.
Unfortunately the official Trend Micro Security Uninstaller doesn't completely remove everything.



Create a policy scoped to the Mac(s) affected.
Trigger: Custom, named tmsuninstall f.x.
Attach this script:



!/bin/bash



launchctl unload /Library/LaunchDaemons/com.trendmicro.icore.av.plist
rm /Library/LaunchDaemons/com.trendmicro.*
rm -r "/Library/Application Support/TrendMicro"
rm -r /Library/Frameworks/TMAppCommon.framework
rm -r /Library/Frameworks/TMAppCore.framework
rm -r /Library/Frameworks/TMGUIUtil.framework
rm -r /Library/Frameworks/iCoreClient.framework
rm -r /Applications/TrendMicroSecurity.app
killall -kill TmLoginMgr
killall -kill UIMgmt
exit 0



Boot the Mac in Safe Mode (shift key pressed) and run sudo jamf policy -event tmsuninstall



Hope this helps.


Hey all,
Looks like SEP has issues too. Here is how to fix the issue for SEP



https://support.symantec.com/en_US/article.ALERT2538.html


Reply