Six Colors
Six Colors

by Jason Snell & Dan Moren

This Week's Sponsor

End users aren't your enemy! Kolide gets users to fix their own device compliance problems–and unsecure devices can't log in. Click here to learn how.

By Jason Snell

The mysterious case of the undead iMac

Note: This story has not been updated for several years.

Sometime in the last few months, my 5K iMac started misbehaving. Not in any of the ways you’d expect—crashes, lock-ups, weird error messages, that sort of thing. No, one day I came into my office in the morning and the iMac and all the peripherals were still on, the spinning gear animation still right where I had left it upon choosing Shut Down from the Apple menu the night before.

I fancy myself a pretty good Mac troubleshooter, but this was a bit baffling to me. The system has already gone into shutdown mode by the time it gets to this point; I can’t bring up a terminal window or run Activity Monitor to see what might be going on. Even stranger, when I manually powered off the iMac and restarted it, then tried to shut it down, it shut down properly. Okay. Maybe it was nothing. I started up and got about my business.

After a full day’s work, I shut down the iMac again—and once again, the spinning-gear animation appeared. I came back after dinner and it was still there. Okay, this was a problem. I reset my iMac’s power manager, zapped the PRAM, did all of the weird system-level things I could think of, and nothing solved the problem.

The next day, I started my iMac up while holding down Command-V, the cue for the Mac to boot in “verbose mode,” which shows a scary cascade of text information at the beginning and end of the startup process. When I shut down at the end of the night, I finally had some new information:

Failed to send exception EXC_CORPSE_NOTIFY. error code: 5 for pid 57024
Wed Jan 13 21:11:05 2016 iMonkey.local[1]

Yes, there’s a bizarre error code called “corpse notify.” Whatever. At least I now knew something! It appeared that a process (in this case, one with id 57024) was getting in the way of my shutdown. Hooray! Now to open Activity Monitor and see which process that…

…oh, right. My computer’s locked up and shutting down. I can’t look at the process ID. And process IDs change from boot to boot.

My old pal Matt Deatherage solved the issue by suggesting that before I shut down, I open Terminal and save a list of all my existing processes, so that I could then compare that list to whatever process was holding up my Mac.

So at the end of the day, when I was ready to shut down (after once again having started up in verbose mode), I opened Terminal and typed

ps -x > dump.txt

…which generated a textfile with a list of all of those processes. Then I shut down, wrote down the process ID of the item that might be hanging up the shutdown, manually powered off the iMac, rebooted, and opened that dump.txt file in BBEdit, then searched for the appropriate process ID. Here’s the result:

  459 ??         0:00.21 /Applications/Utilities/Adobe Creative Cloud/CoreSync/Core

Well, well. My culprit appeared to be Adobe Creative Cloud Crash Reporter Daemon. That’s right, a tool designed to help Adobe improve its software quality was causing my iMac to fail to shut down every night. I am surprised Creative Cloud didn’t collapse into itself right then in a fit of irony.

I don’t want to get rid of Adobe Creative Cloud. I’ve been using Photoshop for two decades and don’t plan to stop now. Instead, I dug into the Creative Cloud app package and deleted the AdobeCRDaemon itself—with more than a little bit of glee—in the hopes that I’d still be able to launch Photoshop without that element around.

It took some detective work, but at least this story has a happy ending: These days my Mac shuts down when I tell it to.

If you appreciate articles like this one, support us by becoming a Six Colors subscriber. Subscribers get access to an exclusive podcast, members-only stories, and a special community.

Search Six Colors