X

Tutorial: Identifying and neutralizing problematic internal/external devices

Tutorial: Identifying and neutralizing problematic internal/external devices

CNET staff
9 min read

Errant internal and external devices are among the most notorious causes of wide-ranging problems for Mac OS X. These include, but are not limited to:

  • Startup stalls or hangs
  • Kernel panics (repeated or sporadic)
  • Slow system operation
  • General stalls or freezes -- especially when performing certain tasks
  • Issues going to or waking from sleep

Identifying the culprit device(s)

There are a number of methods for identifying the device(s) responsible for one or more of the aforementioned problems.

Isolation method The easiest and generally most effective -- but also somewhat tedious -- is to simply connect different sets of devices, excluding others, and repeat the behavior that initially manifested the issue. For example, if you are experiencing a startup stall, and have various internal/external devices connected, try the following:
  1. Shutdown your Mac
  2. Disconnect all external devices including those connected via FireWire/USB, PCMCIA, CarBus, ExpressCard, etc.
  3. Startup your Mac and check for the persistence of the issue

At this point, if startup proceeds correctly, you can reasonably assume that the culprit is an external peripheral. If startup does not proceed correctly (the issue still manifests), continue as follows:

  1. Shutdown your Mac
  2. Remove all non-essential internal devices including PCI cards, AirPort cards, etc.
  3. Startup your Mac and check for persistence of the issue

If startup now proceeds correctly, you can reasonbly assume that the culprit is an internal add-on device. If startup does not proceed correctly, the issue is likely not related to a peripheral device.

[Again, the startup stall serves only as an example -- you can use this same process for other issues, replacing the "Shutdown your Mac" and "Startup your Mac" steps with the behaviors that initially triggered the problem]:

You can then either reconnect devices one at a time and repeat the behavior that caused the initial issue, or use a reduction method, i.e. connect half of the devices and repeat the behavior, effectively exhonerating that group if the behavior does not return. Keep connecting different sets, or individual devices until the problem returns. You can then identify the culprit.

[Side note:While most of the above discussion and henceforth content deals with physical devices, it should be noted that network connections can also cause some of the problems listed at the top of this article. When attempting to isolate a problematic device, also try disconnecting network cables and/or turning off AirPort/wireless networking to check for persistence of the issue.

Faulty RAM may also be the culprit for similar issues. You can sometimes determine if you have a "bad" RAM module by using the Apple Hardware Diagnostic CD, included with all currently shipping Macintosh models. To use the Apple Hardware Test CD, restart your computer while holding down the C key on PowerPC-based Macs, or D key on Intel-based Macs until the "Loading..." icon appears. You may also want to try removing each RAM module one-by-one and checking for persistence of the problem(s).]

Check the logs Scouring Mac OS X log files for clues to a device issue can be daunting but is sometimes more practical than disconnecting and re-connecting arrays of devices.

To begin, launch the Console application, located in /Applications/Utilities. On the left-hand side of the main window, you will see a listing of logs maintained by Mac OS X.

The primary logs to be concerned with are:

  • console.log
  • system.log
  • panic.log

Generally speaking, for device issues, you will be looking for strings in the log files that contain the letters "IO" (for input/output). Unfortunately, simply typing "IO" in the Filter field at the top-right of the Console window will usually return too many spurious results. Instead, there are a few key strings by which you can filter to check for problems with specific kinds of devices.

To better understand this methodology, it is important to know that most interaction with internal and external devices in Mac OS X is accomplished through various kernel extensions, which are located in /System/Library/Extensions. Kernel extensions allow various devices (USB, FireWIre, PCI, Bluetooth, etc.) to interact directly with Mac OS X and its hosted applications, but can cause significant issues because they operate at a relatively low level.

The following is a list of some kernel extensions that are designed for add-on device interaction. As you can see, many contain the letters "IO":

  • IONetworkingFamily.kext (for networking devices)
  • IOFireWireSerialBusProtocolTransport.kext (for FireWire/IEEE 1394 devices)
  • IOFireWireSBP2.kext ("")
  • IOFireWireIP.kext ("")
  • IOFireWireFamily.kext ("")
  • IOFireWireAVC.kext ("")
  • IODVDStorageFamily.kext (for DVD storage devices)
  • IOCDStorageFamily.kext (for CD storage devices)
  • IOBluetoothFamily.kext (for Bluetooth devices)
  • IOAudioFamily.kext (for Audio devices, generally connected to the headphone or audio input jacks)
  • IOUSBMassStorageClass.kext (for hard drives and other storage devices)
  • IOUSBFamily.kext (for USB devices)
  • IOStorageFamily.kext (for various storage devices)
  • IOSerialFamily.kext (for serial devices including some EVDO and HSPDA access cards)
  • IOSCSIParallelFamily.kext (for SCSI devices)
  • IOSCSIArchitectureModelFamily.kext ("")
  • IO80211Family.kext (for wireless networking devices)
  • IOBluetoothHIDDriver.kext (for Bluetooth devices)
  • IOATAFamily.kext (for ATA devices, generally hard drives)
  • IOAHCIFamily.kext (for Serial ATA devices, generally hard drives)
  • IOADBFamily.kext (for ADB devices like some keyboards/mice/trackpads)
  • IOPCIFamily.kext (for PCI devices)
  • IOPCCardFamily.kext (for PC card devices)

The items in bold are those most commonly involved in device-related kernel issues -- those responsible for controlling USB, FireWire, and PCI devices.

It should also be noted that some devices use their own proprietary kernel extensions that are not labeled with the generic "IO" moniker. For example, these kernel extensions:

  • Adaptec39160.kext
  • Adaptec290X-2930.kext
  • Adaptec78XXSCSI.kext
  • Adaptec29160x.kext

are associated with PCI cards manufactured by Adaptec for controlling external hard drives and have exhibited potentiality for causing kernel panics. Likewise, the kernel extension ATIRadeon9700.kext is associated with an ATI graphics card.

When you are digging through Mac OS X log files for device-related issue indicators, you will be looking for log entries that mention one or more of the above files (and others). However, you cannot simply type "IOUSBFamily.kext," for instance, into the "Filter" field in the Console application and expect results. Instead, drop the ".kext" portion of the name and type only "IOUSBFamily" or "IOPCIFamily," for example. Enter these terms (and others, depending on your device collection) as filters in the console.log, system.log and panic.log first, then delve into other logs if you do not receive results.

If you recently had a kernel panic in which you think a device may be implicated, check panic.log first. In the above screenshot, you can see that the Backtrace indicates the IOPCIFamily kernel extension with the entry "dependency: com.apple.iokit.IOPCIFamily(2.1)@0x572000." [For more information on exactly what a backtrace is, see our tutorial "An introduction to reading Mac OS X crash reports." [Note that kernel issues are not exclusively resultant in kernel panics; they can also cause problems with startup, sleep and more as the kernel becomes overloaded or otherwise obviated from normal operation.]

Using the log searching method can not only help you identify which type of device (USB, FireWire, etc.) is causing your problem, but it can also help you discover which kernel extensions may need to be replaced as described in the section "Downgrading I/O kernel extensions" below.

Modifying device parameters to solve the issue

Now that you've identified the problematic device you have a choice: banish the peripheral from your system setup, replace it with a similar device that may not cause the same issues, or attempt to modify the variables associated with the device so it can operate properly with your setup and cease problem causation. The last option should always be attempted first, and there are some common techniques for nudging your errant hardware into compliance.

Make sure firmware is up-to-date Before writing off a suspect device and seeking replacement, make sure that its firmware is not simply out-of-date. For most devices, manufacturers' Web sites will maintain a stock of current (and sometimes older, perhaps more compatible) firmware revisions.

Deleting kernel extension caches Kernel extensions store frequently accessed data in cache files. These caches have the potential for corruption, and as such can cause issues with device interaction.

Fortunately, clearing these caches is a relatively painless process with little propensity for consequence. Try the "deep" or "extended" cache deletion routines offered by tools like Cocktail, Mac Pilot or Tiger Cache Cleaner, or manually delete the following files:

  • /System/Library/Extensions.kextcache
  • /System/Library/Caches/com.apple.kernelcaches

Check for software conflicts In some cases, third-party software can cause interaction issues with various internal/external devices. The software types most notorious in this category are those that take action whenever a device is connected or disconnected, or those that are in persistent operation. For instance, virus scanning software (which in many cases fits both bills) has been implicated in numerous device connectivity issues.

Downgrading I/O kernel extensions

If you are having a critical device-related issue -- especially after applying a new iterative release of Mac OS X or other major system update -- you may want to consider the somewhat risky procedure of reverting to an earlier version of one or more kernel extensions. This is often a tedious process and can cause new problems since you are essentially mixing and matching components from one version of Mac OS X with those from another. As such you should always have a solid backup (preferably a clone) on hand in case anything goes wrong.

Fortunately, the kernel extension most likely to be implicated in external device issues is also the easiest to downgrade, so we will start with it. The file in question is IOUSBFamily.kext, and as aforementioned, it controls Mac OS X's interaction with various USB devices. Apple maintains old versions of this kernel extension at:

Go to this directory in your favorite FTP client or the Mac OS X Finder, and sort by date. The newest files should be those associated with the most recent iteration of Mac OS X. For instance, IOUSBFamily-261.4.2(Intel) contains the version of IOUSBFamily.kext included with the Intel version of Mac OS X 10.4.8.

Both PowerPC and Intel versions are available. The files are disk images and will be named as such:

  • IOUSBFamily-261.4.2(Intel)-log.dmg
  • IOUSBFamily-258.4.1(PPC)-log.dmg

You can check the version of Mac OS X associated with the disk image you've downloaded by looking at the included ReadMe file.

If you've decided to downgrade, download the appropriate disk image and mount it, then run the included installer packages. This will overwrite your current version of file:

  • /System/Library/Extensions/IOUSBFamily.kext

Other files will be overwritten as well, but the aforementioned is crucial.

If something goes wrong, you can always bring your system back to the latest release of IOUSBFamily.kext by using the most recent installer available from ftp://ftp.apple.com/developer/Development_Kits/Mac_OS_USB/, or by re-applying the most recent Mac OS X combination updater, available from Apple's software download page.

For other kernel extensions, the reversion process is a bit more complicated, but can usually be accomplished via the following steps:

  1. Download the combination updater (from Apple's download page) for a version of Mac OS X earlier than the one you currently have installed. For example, if you are using Mac OS X 10.4.8, download the Mac OS X 10.4.7 combo updater. [Note, however that every kernel extension does not necessarily refresh with each iteration of Mac OS X. As such, you may want to download Mac OS X update releases earlier than the directly preceeding version until you find one with an older kernel extension revision -- you can determine the version of a kernel extension by selecting it in the Finder and choosing "Get Info" from the file menu, then looking at the "Version:" field under "General." See the screenshot at right for an example.]
  2. Download and install the shareware application Pacifist
  3. Drag the Mac OS X combo update installer package onto the Pacifist application icon.
  4. Click the triangle next to "System" to expand it
  5. Click the triangle next to "Library" to expand it
  6. Click the triangle next to "Extensions" to expand it
  7. Scroll down and find the kernel extension you would like to revert, e.g. IO80211Family.kext, IOFireWireFamily.kext, etc. (see the guide under the section of this article titled "Check the logs" for information on which kernel extension is associated with which type of device). Drag it to your Desktop or another location (you will have to enter your administrator password)
  8. On your Mac OS X startup drive, navigate to /System/Library/Extensions and locate a similarly named file (e.g. IO80211Family.kext). Move it to another location for safe keeping.
  9. Now drag the file from step 7 (the one that you retrieved from the Mac OS X installer package) into the /System/Library/Extensions, in effect replacing the newer file with and older copy; you will again have to enter an administrator password.
  10. Restart your Mac

If none of the methods mentioned in this article are effective, your hardware may have a defect that prevents proper operation with Mac OS X. Consider replacing it or looking toward an alternate brand/manufacturer.

Reference articles:

Like what you've found in this tutorial? Get more troubleshooting guidance (updated daily) by subscribing to MacFixIt Pro.

Resources

  • More from Tutorials