How to Check Why a Mac Restarted or Shut Down Using Terminal

If your Mac restarted or shut down unexpectedly, Terminal can help you determine whether macOS recorded a power loss, forced restart, kernel panic, scheduled shutdown, or a normal shutdown. The most useful starting point is the last command, followed by unified-log searches for events around the time the problem occurred.

Quick Answer

1. Open Terminal from Applications > Utilities.
2. Run this command to view recent reboot and shutdown records:

bash
last reboot shutdown

3. Look for entries near the time your Mac stopped working. A reboot without a matching normal shutdown can indicate a power interruption, crash, or forced restart.
4. To search system logs for likely causes, run:

bash
log show --predicate 'eventMessage CONTAINS[c] "Previous shutdown cause"' --last 7d

5. For kernel panic evidence, check for panic reports:

bash
ls -lt /Library/Logs/DiagnosticReports/*panic* ~/Library/Logs/DiagnosticReports/*panic* 2>/dev/null

These commands only read existing history. They do not change macOS settings or delete data.

Before You Begin

Terminal records are useful, but they cannot always identify the exact cause. For example, an abrupt loss of power may leave no detailed explanation. A restart caused by a failed component, overheating, or a system crash may also appear simply as an unexpected reboot.

Write down the approximate time of the incident before searching. If the Mac restarted overnight, check the previous evening and morning. Accurate timing makes log searches much easier.

Avoid repeatedly restarting the Mac while investigating. Each new startup adds more events and can make the relevant entries harder to locate.

Check Recent Reboots and Shutdowns

The last command reads the system’s login and session history. Its reboot and shutdown arguments filter the output to restart and shutdown records.

last reboot shutdown

Run the command and read the date, time, and event type shown for each entry. Depending on the amount of available history, the output may include several recent events.

How to interpret the results

A normal sequence may show a shutdown followed by a later reboot. That suggests macOS recorded the shutdown before the next startup.

A reboot with no nearby shutdown may indicate one of several possibilities:

• The Mac lost power.
• The power button was held down.
• macOS crashed and restarted.
• The system became unresponsive and was forcibly restarted.
• The shutdown record was not written before power was lost.

This command does not prove which explanation is correct. Use the log and diagnostic-report checks below to narrow it down.

Check the Recorded Previous Shutdown Cause

macOS may write a shutdown-cause value to the unified log. Search the recent log history with:

log show --predicate 'eventMessage CONTAINS[c] "Previous shutdown cause"' --last 7d

The log show command reads historical unified logs. The --predicate option limits results to messages containing the phrase Previous shutdown cause, and --last 7d searches the previous seven days.

This is a read-only command. It does not enable logging or modify the system.

If you know approximately when the incident happened, use a narrower time range. For example:

log show --predicate 'eventMessage CONTAINS[c] "Previous shutdown cause"' --start '2025-01-15 20:00:00' --end '2025-01-16 08:00:00'

Replace the dates and times with the period you want to investigate. Use the date and time format shown in the command, and quote the complete values so the shell treats them as one argument.

A numeric cause value is not necessarily self-explanatory. Treat it as a clue rather than a diagnosis. Compare its time with the reboot history, panic reports, power events, and what you observed.

Search Unified Logs for Shutdown and Restart Events

The unified log can contain messages related to shutdown, restart, sleep, wake, power management, and crashes. Search recent entries with:

log show --last 24h --style compact --predicate 'eventMessage CONTAINS[c] "shutdown" OR eventMessage CONTAINS[c] "restart" OR eventMessage CONTAINS[c] "panic" OR process == "kernel"'

This command reads the previous 24 hours, displays compact records, and filters for messages containing common shutdown or crash terms. It does not change logging behavior.

You can adjust the time window without changing anything else:

log show --last 7d --style compact --predicate 'eventMessage CONTAINS[c] "shutdown" OR eventMessage CONTAINS[c] "restart" OR eventMessage CONTAINS[c] "panic" OR process == "kernel"'

A broad search can produce a large amount of output. Focus on entries close to the unexpected restart, especially messages mentioning a panic, watchdog, thermal condition, power state, or forced shutdown.

If the result is too long, send it through less so you can scroll through it:

log show --last 24h --style compact --predicate 'eventMessage CONTAINS[c] "shutdown" OR eventMessage CONTAINS[c] "restart" OR eventMessage CONTAINS[c] "panic" OR process == "kernel"' | less

Press the Space bar to move forward, the arrow keys to move line by line, and q to quit. This only changes how Terminal displays the output.

Check for Kernel Panic Reports

A kernel panic is a serious system-level failure that can cause a restart. macOS may save a diagnostic report when one occurs. Search the standard diagnostic-report locations with:

ls -lt /Library/Logs/DiagnosticReports/*panic* ~/Library/Logs/DiagnosticReports/*panic* 2>/dev/null

The ls -lt command lists matching files with the newest files first. The two paths cover system-wide and user-level diagnostic reports. 2>/dev/null hides the error message that would otherwise appear when a path or matching file does not exist.

This command is read-only. It does not remove reports.

If matching files appear, inspect the newest report with less. Replace the example path with the actual file path displayed by the previous command:

less "/Library/Logs/DiagnosticReports/example-panic-report.ips"

Do not type example-panic-report.ips literally unless that is the name shown on your Mac. You can drag a report from Finder into the Terminal window to insert its path, then press Return.

Look for the report’s timestamp and descriptions of the failing process, panic string, or backtrace. A panic report confirms that macOS recorded a kernel panic, but it may not identify the underlying hardware or software fault by itself.

If no panic files are listed, that does not prove that no crash occurred. The report may not have been created, may have been removed, or may be stored under a different diagnostic filename.

Check for Other Diagnostic Reports

Unexpected restarts can also be associated with watchdog, hang, or power-related reports. List all recent diagnostic reports rather than filtering only for the word panic:

find /Library/Logs/DiagnosticReports ~/Library/Logs/DiagnosticReports -type f -mtime -7 -print 2>/dev/null

This command searches both diagnostic-report directories for regular files modified within the last seven days. It only lists file paths.

To sort the results by modification time, use:

find /Library/Logs/DiagnosticReports ~/Library/Logs/DiagnosticReports -type f -mtime -7 -print0 2>/dev/null | xargs -0 ls -lt

If the command finds nothing, there may be no reports in those locations or none modified during the selected period. Do not delete diagnostic files while investigating; they may be useful to Apple Support or an authorized technician.

Investigate a Specific Incident

For the clearest results, work from the known incident time:

1. Run last reboot shutdown and note the closest reboot or shutdown entry.
2. Search the unified log around that time with --start and --end.
3. Check diagnostic reports whose timestamps overlap the event.
4. Compare the Terminal findings with what happened physically.

For example, if the Mac restarted between 2:00 PM and 2:15 PM, search only that window:

log show --start '2025-01-15 14:00:00' --end '2025-01-15 14:15:00' --style compact --predicate 'eventMessage CONTAINS[c] "shutdown" OR eventMessage CONTAINS[c] "restart" OR eventMessage CONTAINS[c] "panic" OR process == "kernel"'

Change the dates and times to match your incident. Narrow searches reduce unrelated messages and make the output easier to interpret.

Record useful timestamps and report filenames before closing Terminal. If you need help later, those details are more useful than a general statement that “the Mac restarted.”

What the Results Usually Mean

A reboot appears without a normal shutdown

This pattern is consistent with an abrupt interruption, crash, or forced restart. It does not distinguish between those causes. Check for a shutdown-cause entry, panic report, and log messages around the same time.

A panic report is present

A panic report indicates that macOS recorded a kernel panic. Review its timestamp and whether the report repeatedly names the same driver, device, or process. Avoid drawing a hardware conclusion from one filename alone.

Logs show a normal shutdown

A normal shutdown record may mean the Mac was shut down by a person, an application, a scheduled action, or a system process. Check the surrounding log messages for more context.

There is no useful log entry

Power loss, a drained battery, a disconnected power adapter, storage problems, or a failure before logging completed can leave little evidence. Check the power connection and whether the problem repeats. If the Mac will not start normally, use Apple’s current startup and recovery guidance or contact Apple Support.

Troubleshooting

Terminal says “command not found”

The commands in this guide are built-in macOS commands. Check that you copied the command correctly, including hyphens and quotation marks. Do not install a replacement utility just to run these checks.

The log search returns too much output

Reduce the time window with --start and --end, or search for one term at a time. You can also pipe the results to less for easier reading. Avoid deleting or modifying log files to reduce the output.

The log search returns no results

Try a longer period, such as --last 7d, and confirm that the incident occurred during that period. A missing result does not establish that the Mac shut down normally.

The command reports permission errors

Some log records and directories may be restricted. Run the read-only commands as provided first. Do not disable macOS security protections or change permissions simply to obtain more history.

The Mac keeps restarting

Save your work if the Mac remains usable. Disconnect recently attached peripherals, note whether the restart occurs during a particular task, and preserve diagnostic reports. If the Mac cannot stay running, start with Apple’s current troubleshooting instructions or seek professional service.

You suspect storage problems

Unexpected shutdowns and restarts can sometimes occur alongside storage errors, although Terminal history alone cannot prove that connection. Do not erase or reformat a disk while investigating unless you have a verified backup and specifically intend to remove its contents. An erase operation is destructive and cannot be safely reversed through Terminal.

Frequently Asked Questions

Can Terminal tell me the exact reason my Mac restarted?

Not always. Terminal can reveal reboot history, shutdown-cause records, unified-log messages, and diagnostic reports. Some abrupt power losses leave too little information to identify the exact cause.

Does last reboot shutdown repair anything?

No. It only reads historical records. It does not repair macOS, change settings, or create new logs.

Is it safe to run log show?

Yes, these commands read existing unified logs. They do not enable logging, delete records, or change system behavior.

How far back can I search?

The available history depends on what macOS retained. Use a recent window first, then expand it with --last 7d or another appropriate period. Older entries may no longer be available.

Should I delete panic reports after reading them?

No. Keep them while troubleshooting. They may help identify a repeating problem or provide useful information to Apple Support or a repair professional.

Can a shutdown-cause value identify failing hardware?

No. It is only one diagnostic clue. Interpret it alongside timestamps, logs, panic reports, power conditions, and whether the problem repeats.

Final Thoughts

Start with last reboot shutdown, then correlate the result with log show and diagnostic reports from the same time. These read-only Terminal commands can distinguish a recorded normal shutdown from an abrupt restart and may expose evidence of a panic or power-related interruption. Preserve useful reports, avoid destructive storage commands, and seek assistance if the restarts continue.