OS hangs on login

I've also had to de-install Sophos for exactly the same reason. Since de-installing I'm back to normal. I guess there might be a conflict with something else in my startup list, but I'm not using anything 'unusual' in the way of software. I'd be really interested to know how to find out.

---

gimpster wrote:

I recently installed Sophos Anti-Virus for Mac Home Edition on my 2011 MacBook Pro, however I had a major issue with it that forced me to uninstall it. I found that after rebooting, I would sign in and then the OS would hang indefinitely. My computer was unusable because I could not sign in. I was able to repro this condition at least 6 times in a row. I eventually had to boot into Safe Mode to uninstall the software and as soon as I did, I rebooted and the OS was back to normal operation. Are there any known issues with this hardware or any information I can gather to help diagnose the problem?

---

What version of the MacOS are you using?  Do you have anything installed that modifies the system on an OS level?

I'm running OS X 10.6.7. As for applications that might be modifying the OS, I've looked through all my apps, disabled quite a few but still haven't found the magic one that fixes it. I'm not that familiar with OS X to know where to look for things like that but I avoid "haxies" as a general rule and the only other app that I thought might be doing some trickery was SIMBL but uninstalling that didn't fix it either. I don't think I have any kernel extensions installed and I can't find any .kext files. Are there no logs that might give an indication?

Actually, the system log should indicate where the issue lies... it should report what causes the hang, or at least what stage the login process was at when you had to force a reboot.

Console.app -> FILES -> system.log

By this point, the log file will have rotated though, so you might actually have to look in /var/log/ for one of the system.log.#.bz2 archives to locate the issue.

I get this problem too.

In fact I was having this problem in March, and eventually I realised that it was Sophos causing it. Today I tried Sophos again, and deliberately exercised it by logging out and in several times.

After several sucessful logins, I got a problem one in which one app failed to read the keychain on startup (this doesn't ever happen without Sophos), but the OS didn't hang.

On the next login the OS didn't hang.

On the next login the OS hung, requiring a forced reboot.

On the next login the OS hung again, requiring a forced reboot.

On the next login the OS hung again, requiring a forced reboot.

On the next login, the OS didn't hang, so I was able to uninstall Sophos.

I have captured by system.log file covering the period of the problem. What am I looking for? I'm quite happy to send it to you if you think it would help.

Here's my system config info:

  System Version:    Mac OS X 10.6.7 (10J869)
  Kernel Version:    Darwin 10.7.0
  Boot Volume:    Macintosh HD
  Boot Mode:    Normal
  Secure Virtual Memory:    Enabled
  64-bit Kernel and Extensions:    No

  Model Name:    MacBook Air
  Model Identifier:    MacBookAir3,1
  Processor Name:    Intel Core 2 Duo
  Processor Speed:    1.4 GHz
  Number of Processors:    1
  Total Number of Cores:    2
  L2 Cache:    3 MB
  Memory:    2 GB
  Bus Speed:    800 MHz
  Boot ROM Version:    MBA31.0061.B01
  SMC Version (system):    1.67f3

I finally got around to re-running the setup and I captured the system.log information for one complete boot where the system hung after login. I'm not quite sure how to read this, so perhaps you can help tell me if there is something in here that indicates what's causing the system to hang.

Jun 24 20:46:22 ryan-macbook /System/Library/CoreServices/CCacheServer.app/Contents/MacOS/CCacheServer[152]: No valid tickets, timing out
Jun 24 20:47:21 ryan-macbook mds[40]: (Warning) Server: No stores registered for metascope "kMDQueryScopeComputer"
Jun 24 20:48:15: --- last message repeated 1 time ---
Jun 24 20:48:15 ryan-macbook [0x0-0xe00e].org.mozilla.firefox[204]: NOTE: child process received `Goodbye', closing down
Jun 24 20:48:21 ryan-macbook com.apple.launchd.peruser.501[104] (com.apple.AirPortBaseStationAgent[149]): Exited: Killed
Jun 24 20:48:21 ryan-macbook loginwindow[41]: DEAD_PROCESS: 41 console
Jun 24 20:48:21 ryan-macbook com.apple.backupd[244]: Attempting to mount network destination using URL: afp://ryan@GimpDS.local/TimeMachine
Jun 24 20:48:22 ryan-macbook com.apple.kextd[12]: Can't load /System/Library/Filesystems/AppleShare/asp_tcp.kext - validation problems.
Jun 24 20:48:22 ryan-macbook com.apple.kextd[12]: Failed to load /System/Library/Filesystems/AppleShare/asp_tcp.kext - (libkern/kext) validation failure (plist/executable).
Jun 24 20:48:22 ryan-macbook com.apple.afpfs_afpLoad[246]: /System/Library/Filesystems/AppleShare/asp_tcp.kext failed to load - (libkern/kext) validation failure (plist/executable); check the system/kernel logs for errors or try kextutil(8).
Jun 24 20:48:22 ryan-macbook com.apple.backupd[244]: NetAuthConnectToServerSync failed with error: 22 for url: afp://ryan@GimpDS.local/TimeMachine
Jun 24 20:48:23 ryan-macbook com.apple.loginwindow[41]: BackupCore -- _CSBackupServerProxyCopyDestinationMountPoint returned: 19
Jun 24 20:48:23 ryan-macbook /usr/libexec/UserEventAgent[141]: ACRR: Failed to save usage store to /Users/ryan/Library/Application Support/CrashReporter/Intervals_116B6978-6ACC-5104-8952-1F038FDABD53.plist
Jun 24 20:48:24 ryan-macbook com.apple.kextd[12]: Cache file /System/Library/Caches/com.apple.kext.caches/Directories//System/Library/Extensions/KextIdentifiers.plist.gz is out of date; not using.
Jun 24 20:48:24 ryan-macbook com.apple.kextd[12]: Rescanning kernel extensions.
Jun 24 20:48:24 ryan-macbook shutdown[251]: reboot by ryan:
Jun 24 20:48:24 ryan-macbook shutdown[251]: SHUTDOWN_TIME: 1308973704 55747
Jun 24 20:48:24 ryan-macbook mDNSResponder[20]: mDNSResponder mDNSResponder-258.18 (Feb 17 2011 20:04:38) stopping
Jun 24 20:48:24 ryan-macbook DirectoryService[13]: BUG in libdispatch: 10J4138 - 1960 - 0x10004004
Jun 24 20:48:24 ryan-macbook WindowServer[73]: hidd died. Reestablishing connection.
Jun 24 20:48:24 ryan-macbook WindowServer[73]: Unable to create event queue via hidd: (0x10000003)
Jun 24 20:48:24 ryan-macbook hdiejectd[98]: processSIGTERM_DA: calling exit(0)
Jun 24 20:48:38 localhost com.apple.kextd[13]: Cache file /System/Library/Caches/com.apple.kext.caches/Directories//System/Library/Extensions/KextIdentifiers.plist.gz is out of date; not using.
Jun 24 20:48:37 localhost com.apple.launchd[1]: *** launchd[1] has started up. ***
Jun 24 20:48:38 localhost mDNSResponder[19]: mDNSResponder mDNSResponder-258.18 (Feb 17 2011 20:04:38) starting
Jun 24 20:48:39 localhost configd[17]: network configuration changed.
Jun 24 20:48:39 Ryan-MacBook configd[17]: setting hostname to "Ryan-MacBook.local"
Jun 24 20:48:39 Ryan-MacBook blued[26]: Apple Bluetooth daemon started
Jun 24 20:48:44 Ryan-MacBook bootlog[52]: BOOT_TIME: 1308973716 0
Jun 24 20:48:44 Ryan-MacBook Parallels[78]: Loading kernel extension  prl_hypervisor.kext
Jun 24 20:48:44 Ryan-MacBook com.apple.usbmuxd[34]: usbmuxd-211 built on Feb  8 2011 at 13:49:43 on Feb  8 2011 at 13:49:43, running 64 bit
Jun 24 20:48:44 Ryan-MacBook XProtectUpdater[32]: NSURLConnection error: Error Domain=NSURLErrorDomain Code=-1009 UserInfo=0x104104f60 "This computer’’’’s Internet connection appears to be offline." Underlying Error=(Error Domain=kCFErrorDomainCFNetwork Code=-1009 UserInfo=0x1041060c0 "This computer’’’’s Internet connection appears to be offline.")
Jun 24 20:48:44 Ryan-MacBook com.apple.launchd[1] (com.apple.xprotectupdater[32]): Exited with exit code: 255
Jun 24 20:48:45 Ryan-MacBook iStatLocalDaemon[61]: Waiting for connections on port 5204.
Jun 24 20:48:45 Ryan-MacBook /System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow[41]: Login Window Application Started
Jun 24 20:48:45 Ryan-MacBook LogMeIn[60]: *** CRAToolkitNotifier::TKNotify(LogMeIn.ServiceStarted)
Jun 24 20:48:45 Ryan-MacBook com.apple.kextd[13]: Can't load InternalModemSupport.kext - no code for running kernel's architecture.
Jun 24 20:48:45 Ryan-MacBook com.apple.kextd[13]: Failed to load InternalModemSupport.kext - (libkern/kext) requested architecture/executable not found.
Jun 24 20:48:45 Ryan-MacBook com.apple.kextd[13]: Load com.apple.driver.InternalModemSupport failed; removing personalities.
Jun 24 20:48:45 Ryan-MacBook com.apple.SystemStarter[35]: Starting HP IO Monitor
Jun 24 20:48:45 Ryan-MacBook com.apple.SystemStarter[35]: Starting HP Trap Monitor
Jun 24 20:48:45 Ryan-MacBook com.apple.backupd-attach[118]: Not starting scheduled Time Machine backup - computer is on battery power.
Jun 24 20:48:45 Ryan-MacBook Parallels[121]: Loading kernel extension  prl_hid_hook.kext
Jun 24 20:48:45 Ryan-MacBook Parallels[127]: Loading kernel extension  prl_usb_connect.kext
Jun 24 20:48:45 Ryan-MacBook Parallels[132]: Trying to load kernel extensions, exit status: 0
Jun 24 20:48:45 Ryan-MacBook Parallels[135]: Starting Parallels networking...
Jun 24 20:48:45 Ryan-MacBook Parallels[138]: Loading kernel extension  prl_netbridge.kext
Jun 24 20:48:46 Ryan-MacBook Parallels[143]: Loading kernel extension  prl_vnic.kext
Jun 24 20:48:46 Ryan-MacBook Parallels[154]: Parallels networking sucessfully started
Jun 24 20:48:46 Ryan-MacBook Parallels[156]: Restarting CiscoVPN
Jun 24 20:48:46 Ryan-MacBook SystemStarter[158]: Unknown service: CiscoVPN
Jun 24 20:48:46 Ryan-MacBook Parallels[161]: Starting Parallels Dispatcher Service
Jun 24 20:48:46 Ryan-MacBook Parallels[165]: Parallels Dispatcher Server sucessfully started
Jun 24 20:48:46 Ryan-MacBook prl_naptd[152]: Starting Parallels Network Daemon
Jun 24 20:48:46 Ryan-MacBook prl_naptd[152]: vnic0: DHCP/NAT for 10.211.55.1-10.211.55.254 netmask 255.255.255.0
Jun 24 20:48:46 Ryan-MacBook prl_naptd[152]: vnic1: DHCP for 10.37.129.1-10.37.129.254 netmask 255.255.255.0
Jun 24 20:48:46 Ryan-MacBook com.apple.launchd[1] (com.logmein.logmeinguiagent): Unknown key for boolean: UseLMILaunchAgentFixer
Jun 24 20:48:47 Ryan-MacBook com.logmein.logmeinguiagent[176]: WINLOG - 6 Main LMIGUIAgent started:176 uid:0 (parent:1 launchd)
Jun 24 20:48:47 Ryan-MacBook com.logmein.logmeinguiagent[176]: WINLOG - 6 Main LMIGUIAgent waiting for window server connection
Jun 24 20:48:47 Ryan-MacBook com.logmein.logmeinguiagent[176]: WINLOG - 6 Main LMIGUIAgent waiting for window server session
Jun 24 20:48:47 Ryan-MacBook com.logmein.logmeinguiagent[176]: WINLOG - 6 Main LMIGUIAgent Starting
Jun 24 20:48:47 Ryan-MacBook loginwindow[41]: Login Window Started Security Agent
Jun 24 20:48:47 Ryan-MacBook WindowServer[95]: kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.
Jun 24 20:48:47 Ryan-MacBook com.apple.WindowServer[95]: Fri Jun 24 20:48:47 Ryan-MacBook.local WindowServer[95] <Error>: kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.
Jun 24 20:48:47 Ryan-MacBook com.logmein.logmeinguiagent[176]: WINLOG - 7 SessionManager SessionAgentStarted
Jun 24 20:48:48 Ryan-MacBook warmd[33]: [fetcher_open_file:936] open("/var/db/dyld/dyld_shared_cache_x86_64") => -1 (errno: 2)
Jun 24 20:48:48 Ryan-MacBook warmd[33]: [fetcher_open_file:936] open("/var/db/dyld/dyld_shared_cache_i386") => -1 (errno: 2)
Jun 24 20:48:49 Ryan-MacBook configd[17]: network configuration changed.
Jun 24 20:48:49 ryan-macbook configd[17]: setting hostname to "ryan-macbook"
Jun 24 20:48:55 ryan-macbook SecurityAgent[179]: NSSecureTextFieldCell detected a field editor ((null)) that is not a NSTextView subclass designed to work with the cell. Ignoring...
Jun 24 20:48:58 ryan-macbook hdiejectd[192]: running
Jun 24 20:48:59 ryan-macbook loginwindow[41]: Login Window - Returned from Security Agent
Jun 24 20:48:59 ryan-macbook com.parallels.vm.prl_naptd[152]: QKqueueFileSystemWatcherEngine::addPaths: open: No such file or directory
Jun 24 20:48:59 ryan-macbook com.parallels.vm.prl_naptd[152]: QFileSystemWatcher: failed to add paths: /Library/Managed Preferences
Jun 24 20:48:59 ryan-macbook loginwindow[41]: USER_PROCESS: 41 console
Jun 24 20:48:59 ryan-macbook com.logmein.logmeinguiagent[176]: WINLOG - 7 SessionManager sessionTerminating
Jun 24 20:48:59 ryan-macbook com.logmein.logmeinguiagent[176]: WINLOG - 7 SessionManager DisplayServer stop
Jun 24 20:48:59 ryan-macbook com.logmein.logmeinguiagent[176]: WINLOG - 7 SessionManager DisplayServer close
Jun 24 20:48:59 ryan-macbook com.logmein.logmeinguiagent[176]: WINLOG - 7 GUIAgent DisplayServerStopped.Sent[176]
Jun 24 20:48:59 ryan-macbook com.logmein.logmeinguiagent[176]: Session - Error occured:read errno: (9) Bad file descriptor
Jun 24 20:48:59 ryan-macbook com.logmein.logmeinguiagent[176]: WINLOG - 7 SessionManager Connection closed
Jun 24 20:48:59 ryan-macbook com.logmein.logmeinguiagent[176]: WINLOG - 7 SessionManager Closing DisplayServer
Jun 24 20:48:59 ryan-macbook com.logmein.logmeinguiagent[176]: WINLOG - 7 SessionManager DisplayServer close
Jun 24 20:48:59 ryan-macbook com.logmein.logmeinguiagent[176]: WINLOG - 7 SessionManager Exiting
Jun 24 20:48:59 ryan-macbook com.apple.launchctl.Aqua[200]: launchctl: Please convert the following to launchd: /etc/mach_init_per_user.d/com.adobe.SwitchBoard.monitor.plist
Jun 24 20:48:59 ryan-macbook com.apple.launchd.peruser.501[198] (com.logmein.logmeingui): Unknown key for boolean: UseLMILaunchAgentFixer
Jun 24 20:48:59 ryan-macbook com.apple.launchd.peruser.501[198] (com.logmein.logmeinguiagent): Unknown key for boolean: UseLMILaunchAgentFixer
Jun 24 20:48:59 ryan-macbook com.apple.launchd.peruser.501[198] (com.apple.ReportCrash): Falling back to default Mach exception handler. Could not find: com.apple.ReportCrash.Self
Jun 24 20:49:00 ryan-macbook com.apple.launchd[1] (com.logmein.logmeinguiagent[176]): Exited with exit code: 1
Jun 24 20:49:01 ryan-macbook fontd[209]: Database content version mismatch (stored(15) != expected(14))
Jun 24 20:49:01 ryan-macbook fontd[209]: Failed to open read-only database, regenerating DB
Jun 24 20:49:04 ryan-macbook com.apple.fontd[209]: FODBCheck: foRec->annexNumber != kInvalidAnnexNumber (0)
Jun 24 20:49:04 ryan-macbook com.apple.launchd.peruser.501[198] (com.Logitech.Control Center.Daemon[230]): Bug: launchd_core_logic.c:4139 (24498):13
Jun 24 20:49:05 ryan-macbook com.apple.launchd.peruser.501[198] (com.apple.Kerberos.renew.plist[222]): Exited with exit code: 1
Jun 24 20:49:06 ryan-macbook /usr/libexec/hidd[44]: setting surface orientation to 0 returned 0xE00002C0
Jun 24 20:49:06 ryan-macbook /usr/libexec/hidd[44]: setting surface orientation mode to 0 returned 0xE00002C2
Jun 24 20:49:06 ryan-macbook com.apple.backupd-attach[249]: Not starting scheduled Time Machine backup - computer is on battery power.

You've got a few issues in here; I think I see where part of the issue is, and Sophos is more a symptom of the problem rather than the problem itself:

Jun 24 20:48:21 ryan-macbook com.apple.backupd[244]: Attempting to mount network destination using URL: afp://ryan@GimpDS.local/TimeMachine
Jun 24 20:48:22 ryan-macbook com.apple.kextd[12]: Can't load /System/Library/Filesystems/AppleShare/asp_tcp.kext - validation problems.

Jun 24 20:48:22 ryan-macbook com.apple.backupd[244]: NetAuthConnectToServerSync failed with error: 22 for url: afp://ryan@GimpDS.local/TimeMachine

Jun 24 20:48:44 Ryan-MacBook XProtectUpdater[32]: NSURLConnection error: Error Domain=NSURLErrorDomain Code=-1009 UserInfo=0x104104f60 "This computer’’’’s Internet connection appears to be offline." Underlying Error=(Error Domain=kCFErrorDomainCFNetwork Code=-1009 UserInfo=0x1041060c0 "This computer’’’’s Internet connection appears to be offline.")

Jun 24 20:48:47 Ryan-MacBook WindowServer[95]: kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.

Jun 24 20:48:59 ryan-macbook com.logmein.logmeinguiagent[176]: WINLOG - 7 GUIAgent DisplayServerStopped.Sent[176]
Jun 24 20:48:59 ryan-macbook com.logmein.logmeinguiagent[176]: Session - Error occured:read errno: (9) Bad file descriptor
Jun 24 20:48:59 ryan-macbook com.logmein.logmeinguiagent[176]: WINLOG - 7 SessionManager Connection closed
Jun 24 20:48:59 ryan-macbook com.logmein.logmeinguiagent[176]: WINLOG - 7 SessionManager Closing DisplayServer
Jun 24 20:48:59 ryan-macbook com.logmein.logmeinguiagent[176]: WINLOG - 7 SessionManager DisplayServer close
Jun 24 20:48:59 ryan-macbook com.logmein.logmeinguiagent[176]: WINLOG - 7 SessionManager Exiting
Jun 24 20:48:59 ryan-macbook com.apple.launchctl.Aqua[200]: launchctl: Please convert the following to launchd: /etc/mach_init_per_user.d/com.adobe.SwitchBoard.monitor.plist
Jun 24 20:48:59 ryan-macbook com.apple.launchd.peruser.501[198] (com.logmein.logmeingui): Unknown key for boolean: UseLMILaunchAgentFixer
Jun 24 20:48:59 ryan-macbook com.apple.launchd.peruser.501[198] (com.logmein.logmeinguiagent): Unknown key for boolean: UseLMILaunchAgentFixer
Jun 24 20:48:59 ryan-macbook com.apple.launchd.peruser.501[198] (com.apple.ReportCrash): Falling back to default Mach exception handler. Could not find: com.apple.ReportCrash.Self
Jun 24 20:49:00 ryan-macbook com.apple.launchd[1] (com.logmein.logmeinguiagent[176]): Exited with exit code: 1
Jun 24 20:49:01 ryan-macbook fontd[209]: Database content version mismatch (stored(15) != expected(14))
Jun 24 20:49:01 ryan-macbook fontd[209]: Failed to open read-only database, regenerating DB

The issues appear to be:

 asp_tcp.kext fails to load, meaning no AppleShare.

You have a bunch of services depending on network shares (such as your TIme Machine) which then error out and fail to load.

Then, you hit the kCGErrorFailure - maybe try suggestions there to fix this problem?

Then you have multiple LogMeIn errors -- some of those could be due to the network errors previously, but it looks like you've got further issues; I'd suggest re-installing LogMeIn, as well as checking if that's what's conflicting with Sophos (since it does install a kext IIRC).

Then it looks like you've got an outdated SwitchBoard install:

com.adobe.SwitchBoard.monitor.plist

This probably needs a software update from Adobe.

Then after that, LogMeIn appears to take down a launchd process and a database while attempting to load again; as this is the last thing you see, it appears this also locks up the computer.

So, it looks like there are a few things you can do to make your computer run better in general, and you might need to take a look at LogMeIn.

Much appreciated for the analysis. I'll start working through these issues and see where I can get. It's strange that LogMeIn is throwing so many errors because otherwise it seems to work just fine for me. Oh well, R&R that and see if it cleans up.

It looks like the problem is caused by FileVault.

http://openforum.sophos.com/t5/Sophos-Anti-Virus-for-Mac-Home/Unable-to-complete-login-after-reboot/td-p/262

On Lion, I've turned off Legacy FileVault, and turned on the new full-disk FileVault. I have not been able to get the Mac to hang again since I did this.

This makes sense... the old FileVault is not very compatible with Lion, and there's no easy way I've found to upgrade -- if you have your Time Machine FileVaulted (old FV), when you upgrade to Lion, all pre-lion backups become inaccessible.  Removing File Vault protection before the upgrade, and then installing new File Vault protection after the install appears to fix the FV-related issues.

From an analyst's viewpoint, I avoided the old FV due to the number of implementation issues I saw in it (I just used applescript automated encrypted disk images instead); however, the new FV gets my stamp of approval (proper key handling, recovery, use of hardware encryption, proper abstraction layer...).