I’ve noticed for a while now, and I mean a long time (as in this affects both macOS Catalina and Mohave ), that if I locked my screen and went away for any length of time that I would come back to it midway through a restart. Normally iTerm2 had prevented shutdown, but half my applications would be closed. Today I figured I would work out why.
TLDR If you’re looking for a solution you can jump to the fix.
My first assumption – this is related to power settings, involved with Sleep/Hibernation. My working theory that the machine tries to sleep while locked and this upsets it, so my first thought was to confirm those settings.
This lists the system-wide power settings if ran in a terminal as an administrator (it doesn’t need root privileges). I was sort-of expecting
autopoweroff to be set to 1 but nope, in this case that doesn’t seem to be the case. So it seems my settings are correct and nothing obvious looks like it will cause a power-off or restart while locked.
Maybe the issue, therefore, is an issue with the machine. While restarting, it’s not shown the typical Kernel panic style messages, and the reboot has been quick, but after some googling found George Garside blog which has a handy one-liner for looking at your logs for what the last shutdown cause was and more importantly what the error code are.
log show --predicate 'eventMessage contains "Previous shutdown cause"' --last 24h
A few interesting things to note from the image, number 1 the timestamps are off by a couple of hours. The second that the shutdown cause was 5… Which is, it was correctly shutdown.
We shall skip over states 1, 2 & 4 and simply take the good news the machine is not crashing, it’s doing this on purpose. So something is sending
/sbin/shutdown command. Yet the timestamp is bothering me; what if it’s not trying to shut down at all?
- Lock Screen
- Log Out
Both Sleep and Lock screen leave the user’s apps and space intact while Log Out and shutdown close apps. I had made the assumption the machine was trying to shutdown and restart; what if it was just logging out?
Working out how to identify in the logs when a Log Out occurred was a little bit of trial and error, but eventually settled on searching for
sessionlogoutd within messages.
log show --predicate 'eventMessage contains "sessionlogoutd"' --last 6h
Now that is the right timestamp, so the machine isn’t doing a full reboot, rather it’s logging my user out.
This also now totally smells like macOS itself not an application doing this, it seems far less likely an application would attempt to log out the user than restart it, so it’s looking more like there is something in macOS forcing a log out.
How to fix macOS automatically logging out
Once you know the problem, googling the answer is easy and it quickly becomes clear that you are not the first to have this issue.
But to summarise, macOS added a setting which logs you out even when the screen is locked as it is still counting this as inactivity. Applications like iTerm often prevent this and it tends to look like the machine is constantly restarting.
To fix you need to have administrator access then:
System Preferences -> Security and Privacy (unlock via padlock) -> Advanced
Then untick the Log Out after, checkbox, followed by OK.
It would appear this feature appeared in High Sierra, so now I have to wonder how long have I been putting up with it?
Anyway, mystery solved, and I learnt a few bits about macOS system logs along the way.