Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Kernel panic Part 1

[This whole post is about 13000 characters. But when I try to post it, I get told "Message cannot exceed 20000 characters". Perhaps the admin needs to check the configuration.....]

I don't know if this was related to Sophos or something else, but.....

I had been running Sophos for around 24 hours, scanning my Time Machine backup disk. Then the machine just turned itself off. I was not using it at the time, except for listening to a podcast in iTunes.

Kernel panics are not something I expect on OS X. The last one I had was nearly ten years ago with OS X 10.1.

This is OS X 10.5.8 on an iMac 2.8GHz Core 2 Duo, 4GB RAM.

The panic report follows.

David

Interval Since Last Panic Report:  31374208 sec

Panics Since Last Report:          1

Anonymous UUID:                    0B4F27A4-4A4A-4ACA-8749-E11500F0FF95

Sun Dec  5 13:00:21 2010

panic(cpu 1 caller 0x004312D7): "IOGMD: not wired for the IODMACommand"@/SourceCache/xnu/xnu-1228.15.4/iokit/Kernel/IOMemoryDescriptor.cpp:1311

Backtrace (CPU 1), Frame : Return Address (4 potential args on stack)

0x5b8af938 : 0x12b4c6 (0x45f91c 0x5b8af96c 0x13355c 0x0) 

0x5b8af988 : 0x4312d7 (0x4a5ab4 0x547f04 0x100f9b8 0x6e618e4) 

0x5b8afa08 : 0x42b7ba (0x98e4a80 0x3 0x6d0e500 0x80) 

0x5b8afae8 : 0x42bdee (0x6d0b200 0x42b2aa 0x2a 0x5b8afb30) 

0x5b8afb58 : 0x42c500 (0x6d0b200 0x2a 0x4fb88 0x6d0b200) 

0x5b8afb98 : 0x42b230 (0x6d0b200 0x0 0x0 0x0) 

0x5b8afbe8 : 0x61fc03 (0x6d0b200 0x98e4a80 0x1 0x7530) 

0x5b8afc58 : 0x6243ec (0x6cb8800 0x98e4a80 0x4 0x6ecb40c) 

0x5b8afc98 : 0x979307 (0x6ecb400 0x98e4a80 0x7530 0x7530) 

0x5b8afcf8 : 0x9799e5 (0x6e9d200 0x6e9d2e4 0x4 0x6d0b580) 

0x5b8afd38 : 0x61f1cb (0x6e9d200 0x6e9d2e4 0x0 0x0) 

0x5b8afda8 : 0x9601d7 (0x6cb8800 0x6d0d400 0x0 0x0) 

0x5b8afe48 : 0x960b82 (0x6cb8800 0x6e613f8 0x0 0x0) 

0x5b8afec8 : 0x960bd7 (0x6cb8800 0x0 0x0 0x41250c) 

0x5b8afee8 : 0x95996c (0x6cb8800 0x0 0x5b8aff18 0x959a50) 

0x5b8aff18 : 0x426bfb (0x6cb8800 0x0 0x1 0x19fed4) 

Backtrace continues...

      Kernel loadable modules in backtrace (with dependencies):

         com.apple.iokit.IOUSBMassStorageClass(2.0.8)@0x976000->0x97ffff

            dependency: com.apple.iokit.IOSCSIArchitectureModelFamily(2.1.1)@0x5e9000

            dependency: com.apple.iokit.IOUSBFamily(3.5.2)@0x61a000

            dependency: com.apple.iokit.IOStorageFamily(1.5.6)@0x7cb000

         com.apple.driver.AppleUSBEHCI(3.4.6)@0x956000->0x967fff

            dependency: com.apple.iokit.IOPCIFamily(2.6)@0x64b000

            dependency: com.apple.iokit.IOUSBFamily(3.5.2)@0x61a000

         com.apple.iokit.IOUSBFamily(3.5.2)@0x61a000->0x643fff

BSD process name corresponding to current thread: kernel_task

Mac OS version:

9L31a

Kernel version:

Darwin Kernel Version 9.8.0: Wed Jul 15 16:55:01 PDT 2009; root:xnu-1228.15.4~1/RELEASE_I386

System model name: iMac8,1 (Mac-F227BEC8)

[The rest follows in another topic, here]

:1001313


This thread was automatically locked due to age.
  • Hi David,

    I've just checked the configuration settings for maximum post length, and 20,000 chars is how it's set. I can't see any local settings that would lower that limit just for you.

    I've been able to post all three parts of your panic output into a single test post (just over 7,500 chars including whitespace) with no warnings. I'll raise a ticket with Lithium, and see if they can come up with an answer. Sorry for the inconvenience. As a minor aid to navigation, I've put in active links to take readers from one post to the next.

    Thanks,

    spike

    :1001347
  • Hi David;

    This issue looks to be similar to reported issues involving the NTFS kernel panic reported elsewhere. Could you please confirm if this issue occurs with Sophos Anti-Virus for Mac OS X Home Edition 7.2.2?

    The version of the product can be ascertained by clicking the shield icon, and selecting "About Sophos Anti-Virus". The version number should be at the top of the about panel. The update to 7.2.2 should now be available (or will be available shortly), so if it is still at 7.2.1, I'd suggest upgrading as soon as possible (that update contains fixes for other issues relating to Time Machine as well).

    If the problem still occurs with 7.2.2, the following information would help us to track the issue down further:

    - What was the configuration of the scan in particular when you reported that the scan was scanning your Time Machine backup? In particular, was the scan set to automatically clean up?

    - What format is your backup disk in? (This can be seen in Disk Utility in /Applications/Utilities/). Is it a local backup disk, or is it a network-mounted disk?

    - Are there any messages in the syslog from any of the following processes:

        - com.sophos.intercheck

        - com.parallels.*

        any messages relating to Time Machine.

    David

    :1001353
  • It is 7.2.2C, downloaded about 24 hours before the problem occurred.

    The scan was set to just log any problems.

    The disk is connected by Firewire 800. It is formatted as Mac OS Extended Journalled

    I found this by going to Terminal and greping all the log files:

    Dec  5 13:00:23 Cho-oyu com.sophos.intercheck[56]: kextload serialization lock busy; sleeping (89 retries left)
    Dec  5 13:00:24 Cho-oyu com.sophos.intercheck[56]: kextload serialization lock busy; sleeping (88 retries left)
    Dec  5 13:00:25 Cho-oyu com.sophos.intercheck[56]: kextload serialization lock busy; sleeping (87 retries left)
    Dec  5 13:00:26 Cho-oyu com.sophos.intercheck[56]: kextload serialization lock busy; sleeping (86 retries left)
    Dec  5 13:00:27 Cho-oyu com.sophos.intercheck[56]: kextload serialization lock busy; sleeping (85 retries left)

    Dec  5 13:00:23 Cho-oyu com.sophos.intercheck[56]: kextload serialization lock busy; sleeping (89 retries left)

    Dec  5 13:00:24 Cho-oyu com.sophos.intercheck[56]: kextload serialization lock busy; sleeping (88 retries left)

    Dec  5 13:00:25 Cho-oyu com.sophos.intercheck[56]: kextload serialization lock busy; sleeping (87 retries left)

    Dec  5 13:00:26 Cho-oyu com.sophos.intercheck[56]: kextload serialization lock busy; sleeping (86 retries left)

    Dec  5 13:00:27 Cho-oyu com.sophos.intercheck[56]: kextload serialization lock busy; sleeping (85 retries left

    Dec  5 13:00:41 Cho-oyu com.apple.launchd[1] (com.parallels.vm.prl_naptd): Unknown key for boolean: SuccessfulExit

    Dec  5 13:00:43 Cho-oyu kernel[0]: com.parallels.kext.prlnet 5.0.9344.558741 has started.

    Dec  5 13:00:43 Cho-oyu kernel[0]: com.parallels.kext.vnic 5.0.9344.558741 has started.

    Dec  5 13:00:43 Cho-oyu kernel[0]: com_parallels_kext_prl_vnic: created vnic0

    Dec  5 13:00:43 Cho-oyu kernel[0]: com_parallels_kext_prl_vnic: created vnic1

    This was about the time the crash occurred.

    Cheers

    David

    PS, I types in the top of this message, the copied and pasted the logs from Terminal. When I clicked on Post I got this:

    Your post has been changed because invalid HTML was found in the message body. The invalid HTML has been removed. Please review the message and submit the message when you are satisfied.

    Not sure where the HTML came from, and I cannot see anything changed in the ASCII I pasted. Could it be something to do with UTF?

    :1001375
  • Thanks for the logs David. From what you've reported, it looks like this issue isn't anything to do with the NTFS issues - so I think we can rule out that line of investigation.

    First thing to check then is if there are any associated crash logs that happened at the same time. If there are any, they should be listed in:

    /Library/Logs/CrashReporter/com.sophos.intercheck.*

    Secondly, the logs posted suggest that the On-access scanner was unable to load the Kext, so the next thing to check is the permissions on the Kext in:

    /Library/Sophos Anti-Virus/Intercheck.app/Contents/Resources/Sophos Anti-Virus.kext

    These should give:

    drwxr-xr-x  3 root  wheel  Sophos Anti-Virus.kext

    Please let me know what you find.

    David

    :1001383
  • >>>>> Sorry, I was kicked out of my house for a week while it was dried out after a minor flood and had no Internet access.

    First thing to check then is if there are any associated crash logs that happened at the same time. If there are any, they should be listed in:

    /Library/Logs/CrashReporter/com.sophos.intercheck.*

    >>>>>  Nothing to do with Sophos in that folder

    Secondly, the logs posted suggest that the On-access scanner was unable to load the Kext, so the next thing to check is the permissions on the Kext in:

    /Library/Sophos Anti-Virus/Intercheck.app/Contents/Resources/Sophos Anti-Virus.kext

    These should give:

    drwxr-xr-x  3 root  wheel  Sophos Anti-Virus.kext

    >>>>>> drwxr-xr-x  3 root  wheel  102 16 Sep 22:04 Sophos Anti-Virus.kext

    Cheers

    David

    drwxr-xr-x  3 root  wheel  102 16 Sep 22:04 Sophos Anti-Virus.kextdrwxr-xr-x  3 root  wheel  102 16 Sep 22:04 Sophos Anti-Virus.kext
    :1001461
  • I like your virus scanner, it seems to catch the windows viruses. Problem is, if I do a total scan of my Mac it always results in a Kernel Panic after about 2 hours of scanning. The only other program I've ever seen cause a Kernel Panic is a faulty driver for a SATA board I have. So it is good for email attachments, but for now I can't scan the whole disk system.
    :1002413