Odd Behavior on 2017 MacBook Air

[SKYLANE]

MacBook Air (2017) - MacBookAir7,2
2.2 GHz Intel Dual-Core i7
RAM: 8 GB
SSD: 1 TB - OWC Aura Pro X
macOS 12.6.3

Attached via TB: LaCie 2Big HD/Dock, Dell 2560x1440 attached via to dock with display port
Attached to USB: Two external drives (2TB HD for TM, 1TB SSD for data)



I have had this computer setup above for at least 4 years. An odd behavior has developed which has been going on for many months now. The odd behavior also appears even when all the external drives are disconnected with monitor connected directly to the TB with display port cable. Sometimes this computer is "ON" for days at a time. (Not sure I tested for behavior with MBA by itself.)

The odd behavior is this: Sometimes evident by delayed erratic cursor movements when trying to follow my mouse inputs. However, this is evident all the time when the behavior hits, the sound notifications (for copying files, incoming notifications, etc) will be distorted. When this occurs, I try to reboot by shutting down with intention to restart after that. However, after the shutdown command, the computer restarts on its own to a black screen that says something like this: "Your computer has restarted due to an error, press any key to continue." Sometimes I continue by letting it start all the way up, or shut it down then restart. When I get past that, the computer seems to operate just fine until it the behavior hits again (could be couple of hours or a day or more). I have not been able to tie the behavior to any usage of specific software (yet).

It seems that I hear a lot move fan behavior than in the days when the MBA was newer. Not sure if the added monitor drives the GPU to run the machine warmer or something else. Was contemplating whether it would be useful to replace the thermal paste or not. Not sure if any of that is related to above odd behavior or not.

Anyway, computer works fine otherwise.

Side Note: I have a friend with exact same setup except Aura Pro X2 and 1080HD monitor. He has not seen this odd behavior on his MBA.



Anyone come across this kind of behavior?

[Tiangou]

It's a kernel panic.

Look in /Library/Logs for log files ending in ".panic" and look for commonalities within those log files, focusing on last loaded/unloaded kext and active bsd processes to begin with.

[SKYLANE]

In the Diagnostics Report folder for the last month:

Numerous .shutdownStall files and one Kernel .panic. file

In a quick glance, did not see anything with bsd.

[Tiangou]

Do you see last loaded and/or unloaded kext in the panic log?

[SKYLANE]

I don't venture into the logs at all, have not studied that area to see what information that I can get from them (I need to study and understand that area). So, in trying to answer your question, I am not quite sure what I am looking for or if I am even looking in the correct area. That being said, is the information I am looking for actually in the Diagnostics Report folder? What features in the file names would I be looking for?

Since I have some time, I am going to search around online to see what information I can get how to understand files in that folder.

[Tiangou]

You're looking for a file with a name that ends in ".panic" to indicate that it's a special sort of log generated after a kernel panic. Panic logs (when they exist) are found in the /Library/Logs folder hierarchy. Sometimes they may be found within a sub-folder such as the /Library/Logs/DiagnosticReports folder.

When you double-click a panic log file, you should see the Console.app open to display that log.

You may, instead, be prompted to select an application to open the file. That prompt/window will allow you to select from the applications in your Applications folder. Select TextEdit from the list. (You may have to tick a box or select from a menu to allow you to select other than "recommended" applications in the selection window in order to select TextEdit.)

Once you have the file open, you'll see information automatically gathered from the crash. Sometimes (not always) there will be entries noting the last loaded "kext" (kernel extension) and the active BSD process (program) at the time of the crash. These provide good clues as to the cause of the crash.

For example, if you see "iousb" in the name of the last loaded kext then it usually indicates that a driver for a USB device caused the crash.

Or you might see that the active BSD process was Norton LiveUpdate, which would point to crummy antivirus software causing your problems.

A single panic log may not provide enough info to know to a reasonable certainty what caused the crash. If you have multiple panic logs and you can discern a common pattern to them -- the same last-loaded kexts or the same BSD process identified each time -- then you can be reasonably certain that you have identified the cause of your crashes.

There's often a lot of other info in a panic log, but breaking down the other stuff is getting into an area of arcana that's probably not necessary to deal with in this case.