MacBook Pro recorded an unobserved restart during a video call

On further thought, the main point I was addressing was that Last reported reboots when they could not possibly have occurred. In my case reboots were reported at dates/times that the iMac was shut down & unpowered. In the OP's case the reboot was reported to have occurred during a live video call, again, it could not possibly have occurred at that moment.

On further digging, I found some evidence that some of Last's underlying interfaces were deprecated in macOS and that reboots and user sessions are not reported consistently or correctly. (ss64 and some other sources).

Correct or not, I suspect this is another case where the logs are best left to the developers and users should not read too much importance into them.

MMG13 wrote:

Puzzled by a Restart My MacBook Says Happened During a Video Call

So my question is: how could my Mac record a restart that doesn’t seem to have happened? Is there something that could write that entry without the Mac actually restarting?

My Mac is a MacBook Pro with an Apple M1 chip, running macOS Tahoe 26.6.3.

Thank you so much in advance for any help or ideas.

For a one-off issue I would simply ignore the anomaly.

The current stable release of Tahoe including bug fixes, security updates is macOS 26.7.1

Keep your Mac up to date - Apple Support

Keep your Mac up to date - Apple Support

re: Restaring.

Clearly it did not do this in the middle of your meeting. You could not have ignored that.

Remember, when looking at internal logs, the internal timestamp may be in Universal Time, similar to Greenwich Mean Time -- not necessarily local time for your time zone. MacOS graphical user interface takes such good care of us, we sometimes forget that it is doing us these favors.

Regarding having to supply your passcode after a long time away from the computer, that is a feature, not a bug. Happens with face-ID as well. No matter WHAT face you present, it's not good enough!

I just checked my own system, and Last reports a reboot about 1 hour after every nightly shutdown. And I know for a fact that cannot be correct because I cut the power after the nightly shutdown. There is no way it could reboot. So, the 'reboot' log entries appear to be some kind of phantom entries.

Oh, and the timestamps are correct for my time zone, so UTC or GMT are not the issue.

Thank you so much for taking the time to reply. I would happily ignore it if it were a one-off but it’s part of a wider pattern that has been worrying me.

Every so often, usually first thing in the morning or after I’ve been out for a long day, my Mac asks for my password instead of accepting Touch ID. This happens even though I use it every day, and the Mac hasn’t restarted since 5 October.

Even as a one-off, I’d love to understand it. If the Mac really restarted, my Teams call would have dropped and it didn’t. Can the last record sometimes contain entries that are simply wrong, and if so, what causes that?

I’m also keen to rule out anyone accessing my Mac remotely. Are there any other checks you would recommend?

Many thanks again.

MMG13 wrote:

Thank you so much for taking the time to reply. I would happily ignore it if it were a one-off but it’s part of a wider pattern that has been worrying me.

Every so often, usually first thing in the morning or after I’ve been out for a long day, my Mac asks for my password instead of accepting Touch ID. This happens even though I use it every day, and the Mac hasn’t restarted since 5 October.

That is not a larger pattern... I would fixate on something else.

I am sorry I see no larger pattern(?)

I would ignore the anomaly of some mysterious report of a shutdown if it did not happen— then it did not happen enough to effect your on-line usage/documentation of no interruption

If TouchID is an issue remove all finger prints and then add them back in to sort this independent issue.

If Touch ID isn't working on Mac

There are a few instances where Touch ID will not be accepted by macOS:

If you restarted your Mac, or if you're not logged into your user account.

If you have not unlocked your Mac for 48 hours.

If you are trying to unlock Security & Privacy

If you are trying to unlock Users & Groups Settings (when FileVault is on)

If 5 wrong fingerprint attempts

You can read even more: Optic ID, Face ID, Touch ID, passcodes, and passwords - Apple Support

you want to be proactive— update your software.

<< I cut the power after the nightly shutdown. >>

As this is a discussion on the MacBook Pro forums, is your own computer a MacBook Pro? With a built-in battery?

If it is NOT a MacBook Pro, cutting power can cause the 3 Volt non-recharging PRAM backup battery to work all night, and after years of doing that, your Mac might stay dark -- until you figure out its the backup battery.

On modern Macs, those can be truly awful to change.

To Grant Bennet-Alder ...

Ok, you got me. When I posted my earlier reply, I clearly blanked that the subject Mac was a MacBookPro. I replied based on an iMac. Big difference.

I have had occasions where my M4Pro MBPro has restarted itself after a shutdown & closing the lid. I have found no explanation for the behavior, just that it happens sometimes. Although I wonder if sometimes there might be just enough momentum/vibration from the lid closure that it triggers the power/touchID button.

w/r/t cutting the power & the CMOS/PRAM battery ... as I replied in another thread, in all my years of doing this with hundreds of Macs, I have only ever had to replace 2 PRAM batteries ... one was in a 2004 eMac, the other was a 2009 aluminum iMac ... and both had sat unused for nearly 5 years. So, while PRAM battery discharge may be a theoretical problem it has not been a real-life problem in my experience.

<< So, while PRAM battery discharge may be a theoretical problem it has not been a real-life problem in my experience. >>

it would be very refreshing if those batteries were now lasting

closer to the lifetime of the computers they were installed in!

Many thanks all. I've taken your advice onboard. x