Bad Crash, need help with terminal
 

Hi,

My iMac G5 went grey and gave me the message "You need to restart your Computer". Same message when trying to reboot. Tried booting from Install CD and an eMac with FireWire target disk mode. It tries to boot but then I get a black box in the middle of the screen and it hangs up. I suspected a huge video file, so I wanted to remove the file.

So, went into terminal.

Did: /sbin/fsck -fy
Got: The volume MacintoshHD appears to be OK. (good!)
Then: /sbin/mount - uw /
Got: panic(cpu 0 caller 0x00102854): jnl: transaction too big (8385024 >= 8388096 bytes, bufsize 4096, tr 0x2ff8fb0 bp 0x3d09ec20)

Latest stack backtrace for cpu 0:
Backtrace:
(lots of numbers here)
Proceeding back via exception chain:
Exception state (sv=0x00D67780)
(more numbers) (0xC00 - System call)

Kernel version:
Darwin Kernel Version 8.6.0: Tue Mar 16:58:48 PDT 2006; root:xnu-792.6.70.obj~1/RELEASE_PPC
panic: We are hanging here...

I am a real UNIX newbie. I need all the help I can get and it would be GREATLY appreciated
:confused:

If you are a Unix newbie, then single-user mode on a wonky filesystem is NOT the place to start :eek:

Your suspicion of a overly-large file looks reasonable - that looks like a journal error.

Try this:

Boot the bad machine in firewire mode, connect it to anything else convenient AFTER you launch Disk Utility on the good machine. In Disk Utility, select the volume and disable journaling. FInd and delete the video file in the usual manner then run repair again.

If it reboots after all that you can re-enable journaling whenever it's convenient.

I tried that
 

Hi, Thanks for taking the time to answer my plea.

I tried booting from Install CD and an eMac in FireWire target disk mode. It tries to boot but then I get a black box in the middle of the screen and it hangs up.

So I figured terminal is the only way to go.:confused:

Please supply (much) more detail about exactly what you did when trying to boot from the Install CD.
See this Apple doc:
http://docs.info.apple.com/article.html?artnum=106214


Can we assume that the extra space in the above 'mount' command is just a typo - that you actually executed '/sbin/mount -uw /' ?

That message is referring to a problem with the HFS+ journalling facility. In the 10.4.5 Darwin source code (probably the same in 10.4.6), it comes from the function 'journal_modify_block_start' in the file "xnu-792.6.61/bsd/vfs/vfs_journal.c"
[edit] Here's the section of code that is producing that error:
[/edit]

So maybe if you booted without journalling, that might work.
I'm not sure at the moment how to do that. Maybe someone else knows.
I'll see if I can find out and tell you later.

Unless something is very wrong with my limited mathematic skills, I'm inclined to believe that there might be more than one bug:

8385024 >= 8388096

As this is the PPC kernel, which luckily Apple publishes, you could look up in the source what's going wrong there...

acme suggested to that would be the iMac in your case. Try to follow his instructions step by step, chances are it'll work.

Hi Again
 

To answer the questions from Hayne:

Quote:

Can we assume that the extra space in the above 'mount' command is just a typo - that you actually executed '/sbin/mount -uw /' ?

Yes, I executed '/sbin/mount -uw /, sorry for the typo

Quote:

Please supply (much) more detail about exactly what you did when trying to boot from the Install CD.

OK, to make a long story.. long

I put in the Install CD, powered up. I got the choice of my drive or the Install CD or the Apple Hardware check. Ran the Hardware check, everything passed. Tried to boot from the Install CD, it tried and then I got a black box in the middle of the screen and it hung up.

Tried to boot using an eMac, with disc utility open, with my computer (a G5) in FireWire target disk mode. It caused the eMac to crash with the same "You need to restart your computer message".

Tried to boot my G5 with the eMac in FireWire target disk mode, my computer saw it as a possible boot drive, but when I tried it, I got the black box in the middle of the screen and the crash again.

I edited my above post to show the relevant section of code. As you can see there, the error message is merely slightly misleading.
The true inequality is
8385024 + 4096 > 8388096

Thanks for answering
 

I also tried to boot the bad machine in Firewire mode and it crashed the good machine.
:mad:

I would have thought that could only happen if there were something wrong with the "good machine" or if there were a hardware problem with the firewire hardware (on either machine or the cable).
Have you tried with a different firewire cable? Does this cable work with other firewire drives?
Do you have any reason to suspect the firewire hardware (port etc) on your G5?
What is the history of this G5? Did it have any problems before this?

My G5
 

My machine is less than a year old. It has been great, no problems even remotely like this.

I have an external firewire drive which I sometimes use to back up, and have had no problems with it. The cable is good.

When I booted with the good eMac as the slave, my bad G5 saw it as a possible boot drive, but then crashed when I tried to start from it. So I think the connection is OK

You need to figure out a way the corrupt journal does not cause problems, so stop trying to mount it, let alone boot from it.

Either using command line tools to convert the journaled partition to one that no longer is or using a system old enough (System 9) not to understand journaling, but able to mount and fix HFS+ are two ideas that come to mind.

Before we go too much further, are you sure that you used the "-f" option when you did the 'fsck'?
I recall reading that 'fsck -fy' would result in the journal files being ignored when the disk was next mounted.
Perhaps you merely need to 'reboot' after doing the 'fsck -fy'
(instead of trying to mount the disk read-write)
So try it again:
Boot into single-user mode, run 'fsck -fy', and then 'reboot'.
Hold down Command + V after you hear the chime (in order to get "vernose mode" so you can see the messages).
What happens?

Hi Again
 

What I get is the panic(cpu 0 caller...
message that I listed earlier, ending with:

panic: We are hanging here...

Still looking for the key
 

Hi,

I found this on at apple:

Disabling journaling via diskutil

You can disable journaling from the Terminal application by using diskutil. Follow these steps:
1. Log in as an Admin user to the server whose disk you want to set up for journaling.
2. Make sure that no one is using the server.
3. Open Terminal (/Applications/Utilities/).
4. Execute the diskutil command, using the disableJournal option and identifying the volume for which you want journaling disabled. To disable journaling for the root volume, for example, you would execute:

sudo /usr/sbin/diskutil disableJournal /

To disable journaling for a volume called MyDisk, you would execute:

sudo /usr/sbin/diskutil disableJournal /Volumes/MyDisk

This seems to be the command to disable the Journal. Would this effect my disc other than disabling the journaling?

Looks like you're on the right track.

Try to mount the corrupt partition without any checking or journal-replay.

If that doesn't work look if there is a syntax to do the same thing to unmounted partitions, something like /dev/disk1s10 instead of /mountpoint .

Can I assume that the reason you are willing to spend so much effort on this is that there are files on the disk that you don't have a backup of?
Note that if those files are sufficiently valuable to you, you might be better using a professional data recovery service. But that would cost many hundreds of dollars, so the files have to be valuable enough.

Otherwise we could work on trying to erase the disk so you could start fresh.

Thanks for all your help
 

Thank you for taking the time to help me out so generously. I do have back ups of my files, I just hate to have to put everything back onto an erased drive when I know that the drive is OK now. I have had macs since the late 80's and I've never had a problem I couldn't fix, but since my system is less than a year old and I bought Apple Care, I'm going to take it in for servicing.

I really appreciate everyone's time.

Regards

:)

Note that (as far as I have heard), Apple Care does not support data retrieval. In general if you take your Mac in for service, you should expect that the drive will be erased. They will get you to sign a form that says that you agree to this.
If you want them to try to keep the data on that drive, you will need to specify that - and perhaps pay an extra fee for this.

Thanks!
 

;) I'll watch out for that.

If Apple service is able to fix the problem without erasing the drive, try to get them to write down an explanation of what they did so you can tell us and future readers can benefit.

OK, I will

Of course, that's your call.

I feel you came pretty close and learnt a lot in the process.
You shouldn't expect every tech to fully understand what's happening to you as the problem does not seem to occur frequently. You might want to point them to this thread or give it another swing yourself.

As you have backup, there's nothing more at stake than a little bit more of your time.

I thought I'd add to this, I suffered my second occurence of this transaction too large kernel panic.

The first time I was able to boot from the install disk and I did a OS reinstall and had to remove a file from the Trash since deleting it caused a problem.
Today I couldn't even boot from install disk. I could boot in single user mode, a web search indicated a journalling problem but in single-user mode it is not possible to run diskutil to disable journalling. Trying to mount the disk writeable caused the kernel panic. I managed to disable the journalling by
/System/Library/Filesystems/hfs.fs/hfs.util -U /

It threw some error messages but disabled journalling and I was able to boot.

Now that journalling is off I'm going to try to delete the file that caused my previous panic.

BTW - I have an Intel iMac with 500GB (ish) hard disk.

You might consider instead just making a complete backup and then erasing the disk and reinstalling OS X.

I had the same problem when trying to empty the Trash after having placed a very large file in it (over 70 Gb, due to a problem while encoding a movie).

Any attempt to access the hard drive under OS X caused a kernel panic and I couldn't manage to disable journaling while booting in single-user mode (note that I haven't tried the solution presented above by langdt, as my problem occured earlier, the following is to be considered a workaround if that solution does not solve the problem).
The only way I found to either copy data from the hard drive or to even format the hard drive (!) was to do it under Linux, with an Ubuntu LiveCD.

The procedure was the following:
1 - download and burn an Ubuntu liveCD
2 - boot from the liveCD on another mac
3 - connect the unaccessible (under OS X) hard drive (FW target mode) as well as another external hard drive to the Ubuntu Linux booted mac (the other hard drive enables you to backup data from the unaccessible one...)
4 - enable root access under Ubuntu Linux to be able to access all files on the unaccessible hard drive
a. open a Terminal window under Ubuntu to define a password for the root use: "sudo passwd root", then type in the password of your choice
b. under System/Administration/Login Window, enable admin login
c. change user: Quit, then Switch User
d. type in root as User and the password you chose in a. above
5 - Copy data you forgot or chose not to backup... (this is fine for files, I had problems with applications)
6 - Format the unaccessible hard drive
a. open a Terminal window under Ubuntu Linux
b. use the "mount" command to identify the drive to format (of course be careful, the drive, as all other drives, would be indicated in the following way: /dev/sdd3, where sdd3 is a variable; other Terminal commands may be needed to precisely identify the correct drive...)
c. use the umount command to unmount the drive: "umount /dev/sdd3"
d. format the drive with the following command "mkfs /dev/sdd3"
7 - the drive is then formated with the standard Linux format ext3
8 - turn off macs and drives and disconnect them
9 - boot the mac with the reformated drive from the OS X installation CD/DVD, then launch Disk Utility and reformat the hard drive in HFS+ format. I chose not to activate journaling, I hope you guess why...

Recovering boot disk journal panic
 

A quick addendum to the above. When the boot volume is the one that has the overflowed journal, it's possible to get a kernel panic even after a fsck, when mounting the volume read/write once more.

The trick seems to be using mount_hfs in single-user mode to turn off the journaling:
/sbin/mount_hfs -w -j -o update /dev/disk0s3 /

However, when this is done, a kernel panic happens anyway, so it looks like the command failed. It did something though.

Don't worry (much), press on. Bring the system up in single-user mode again, then do the "fsck -fp /" command; this seems to clean up the root filesystem and the subsequent mount to read/write mode works. You've got the disk back! Reboot normally.

Of course, now it's not journaled, which you can change with diskutil later on after you've copied those critical files to a backup location.

I hope this will help someone else who's encountered this problem.
-D-

Wow, this thread saved me! A MDS crash log (60GB) filled my HD. I deleted the file and emptied trash. I got a panic during the crash. I booted it in FW disk mode, and I got a panic on my machine. I removed the HD, and put it in an external enclosure. I got a panic. I was out of luck in the GUI. Single user mode gave me read only access. I removed journaling using (thanks langdt)

/System/Library/Filesystems/hfs.fs/hfs.util -U /

I rebooted, and recovered my data. Sweet! I had informed the user that the data was lost for good. I got to go back and tell her that I recovered everything. Excellent!

I have the same problem as thegooch49, but when I try the /System/Library/Filesystems/hfs.fs/hfs.util -U /
I get the following

hsf: disabling journaling for mount @ 0x3a6fd00
Failed to remove the journal //.journal (Read-only file system)
Failed to remove the journal info block //.journal_info_block (Read-only file system)
Journaling disabled on /

Does anyone have additional advise of what I can do?