Publishers of technology books, eBooks, and videos for creative people

Home > Articles > Apple > Operating Systems

Apple Pro Training Series: OS X Support Essentials 10.9: System Troubleshooting

This excerpt from Apple Pro Training Series: OS X Support Essentials 10.9: Supporting and Troubleshooting OS X Mavericks explains the OS X startup process, examines essential files and processes required to successfully start up, covers the various startup modes used by OS X, and shows how to troubleshoot the processes used at startup and login.
From the book


Understand the OS X startup process

Examine essential files and processes required to successfully start up

Learn about the various startup modes used by OS X

Troubleshoot the processes used at startup and login

System startup certainly isn’t the most glamorous part of OS X, but it’s clearly important and technically quite impressive. Apple has improved startup and runtime processes with every revision of OS X. When things work correctly, the startup process often takes under 30 seconds. Obviously, users appreciate a quick startup, but most aren’t aware of what goes on during system startup because their Mac computers usually work properly.

However, when things do go wrong during system startup, users often fear the worst. Novice users may assume that if their Mac computers won’t start up, they will lose important documents. But the system startup process can fail due to many issues that probably won’t result in any user data loss. It’s important to properly diagnose startup issues so you can get the Mac up and running, or at least try to recover data.

This lesson focuses on the process that your Mac goes through from the moment you press the power button until you ultimately reach the Finder. You will identify the essential files and processes required to successfully start up OS X. You will also explore the various OS X sleep modes, log out, and system shut down. You will then learn about the various startup shortcuts and diagnostic modes that work with Mac systems and OS X. Finally, the end of this lesson focuses on methods that will allow you to effectively troubleshoot system initialization and user session issues.

Reference 29.1
System Initialization

This section examines the main stages of the OS X system startup procedure. The stages of system startup can be categorized into either system initiation, the processes required to start the operating system, or user session, the processes required to prepare the user environment. At each stage the Mac presents an audible or visual cue to help you validate startup progress. The startup cues discussed here are what you’ll experience during a typical startup. Any deviation will be covered as you learn more about the startup process.

The four main OS X system initialization stages are, in order:

  • Firmware—At this stage the Mac computer’s hardware is tested and initialized, and then the booter is located and started. Successfully completing this stage results in an audible startup chime and a bright flash from the power-on light, then all displays show a light gray background.
  • Booter—The main job of the booter is to load the system kernel and essential hardware drivers, known as kernel extensions (KEXTs), into main memory and then allow the kernel to take over the system. The booter stage is indicated by a dark gray Apple logo on the main display.
  • Kernel—The kernel provides the system’s foundation and loads additional drivers and the core BSD UNIX system. It is indicated by a dark gray spinning gear below the Apple logo on the main display.
  • System launchd—Once the core operating system is loaded, it starts the first nonkernel process, the system launchd, which is responsible for loading the remainder of the system. This stage is indicated by the disappearance of the dark gray spinning gear and the brief appearance of a white background on all displays. Successful completion of this stage results in either the login screen or the Finder, if the user is set to automatically log in.

System Initialization: Firmware

Your Mac computer’s firmware, also called BootROM, resides on flash memory chips built into the main computer board. When you power on your Mac, even before it starts a “real” operating system, the firmware acts as a mini-operating system with just enough software to get things going. Specifically, the firmware tests and initializes the hardware, and then locates and starts the system software booter.

Intel-based Mac systems feature firmware based on the Intel Extensible Firmware Interface (EFI) technology. Aside from supporting the Intel processor hardware, EFI is what allows your Mac to start up from OS X, Windows, or any other Intel-compatible operating system.

Power-On Self-Test

The first thing your Mac firmware does at power on is the Power-On Self-Test (POST). The POST tests built-in hardware components such as processors, system memory, network interfaces, and peripheral interfaces. When your Mac passes the POST, you hear the startup chime and see a light gray background on all displays. After a successful POST, the firmware goes on to locate the booter file.

If your Mac fails the POST, the display remains blank or off, and you may get hardware error codes. Depending on the age and model of your Mac, these error codes may manifest as audible tones, a series of flashes from the external power-on light, or internal diagnostic lights illuminating. You may even see a combination of these things. Regardless of which error code you experience, it indicates that a hardware problem exists that OS X cannot control. You can visit the Apple support website at to identify your specific Mac error code, or you can take your Mac to an Apple Authorized Service Provider.

Booter Selection

By default, the firmware picks the system booter file that was last specified from Startup Disk preferences in OS X or the Boot Camp control panel in Windows. The booter file’s location is saved in your Mac computer’s nonvolatile RAM (NVRAM) so that it persists across system restarts. If the booter file is found, EFI starts the booter process and OS X begins to start up. This is indicated by the dark gray Apple logo in the center of the main display.

If the firmware cannot locate a booter file, a flashing folder icon with a question mark appears. Troubleshooting this issue is covered later in this lesson.

FileVault 2 Unlock

If the system disk is protected with FileVault 2 encryption, the OS X booter cannot be accessed until the system disk is unlocked by a user. If this is the case, the system instead begins initial startup from the OS X Recovery HD, where a special EFI booter resides that presents the user with an authentication screen much like the login window. The FileVault 2 authentication unlock screen appears just a few seconds after POST and has a much lighter background than the standard OS X login window.

Once the user successfully authenticates and unlocks the encrypted system disk, the EFI firmware is granted access to the system volume containing the OS X booter. Startup then continues as normal, with one exception. Because the user has already authenticated to unlock the disk, the system will automatically log in to his session without the user having to authenticate again at the login window. This happens only once per startup and only for the user who unlocked the encrypted system disk.

Startup Shortcuts

Your Mac firmware also supports many keyboard shortcuts, which, when pressed and held down during initial power-on, allow you to modify the startup process. Some of these shortcuts modify the booter selection, while others modify how OS X starts up. Startup shortcuts are detailed later in this lesson.

Firmware Updates

Boot read-only memory, or boot ROM, refers to older versions of firmware technology that are not upgradable. Your Mac firmware, however, is upgradable, and on Intel-based Mac systems it’s even replaceable if it becomes damaged.

The OS X software update service may automatically update some Mac firmware, but you can also check the Apple Support website for the latest list of Mac firmware updates. Article HT1237, “EFI and SMC firmware updates for Intel-based Macs,” maintains a list of Mac firmware updates. You can replace your Intel-based Mac computer’s firmware using a firmware restoration CD as outlined in article HT2213, “About the Firmware Restoration CD (Intel-based Macs).”

System Initialization: Booter

The booter process is launched by your Mac firmware and is responsible for loading the OS X kernel and enough essential kernel extensions, or KEXTs, so the kernel can take over the system and continue the startup process. Your Mac firmware also passes on any special startup mode instructions for the booter to handle, such as entering safe mode when the user is holding down the Shift key. The booter process itself resides at /System/Library/CoreServices/boot.efi.

To expedite the startup process, the booter loads cached files whenever possible. These files contain an optimized kernel and KEXTs that load much more quickly than if the system had to load them from scratch. These caches are located in the /System/Library/Caches/ folder. If the system detects a problem or you start OS X in safe mode, these caches are discarded and the kernel-loading process takes longer.

As covered previously, the booter process is indicated at startup by the dark gray Apple icon in the center of the main display. If the booter successfully loads the kernel, this is indicated by a small, dark gray spinning gear icon below the Apple icon. Though, some modern Mac systems start up so fast you may not even see the spinning gear before the next stage is indicated.

If your Mac is set to NetBoot and the firmware successfully locates the booter file on the NetBoot server, you again see the dark gray Apple icon. However, in this case the booter and the cached kernel information must be downloaded from the NetBoot server. This process is indicated by a small, dark gray spinning globe icon below the Apple icon. The globe icon is replaced by the standard spinning gear icon once the kernel has been successfully loaded from the NetBoot server.

Finally, if the booter is unable to load the kernel, a dark gray prohibitory icon takes the place of the Apple icon. Again, troubleshooting this issue is covered later in this lesson.

System Initialization: Kernel

Once the booter has successfully loaded the kernel and essential KEXTs, the kernel itself takes over the startup process. The kernel has now loaded enough KEXTs to read the entire file system, allowing it to load any additional KEXTs and start the core BSD UNIX system. A spinning gray gear icon below the Apple icon indicates the kernel startup progress.

Finally, the kernel starts the first normal (nonkernel) process, the system launchd, which is ultimately the parent process for every other process. The appearance of anything besides the white startup screen with the Apple logo is an indication that the kernel has fully loaded and the launchd process is starting other items.

Again, in most cases the kernel is loaded by the booter from cached files. However, the kernel is also located on the system volume at /mach_kernel. This file is normally hidden from users in the graphical user interface, because they don’t need access to it. Many other hidden files and folders at the root of the system volume are necessary for the BSD UNIX system, and again the average user doesn’t need access to these items. As covered in ­Lesson 27, “Peripherals and Drivers,” KEXTs reside in the /System/Library/Extensions and /Library/Extensions folders.

System Initialization: System launchd

Once the kernel is up and running, the Mac is ready to start running processes at the behest of the system and eventually human users. The first normal (nonkernel) process started is the system launchd, located at /sbin/launchd, which runs as root and is given the process identification number of 1. In UNIX terms, the system launchd is the first parent process that spawns all other child processes, and those processes go on to spawn other child processes.

The first task for the system launchd process is to complete the system initialization by starting all other system processes. Earlier versions of OS X show the “Welcome to Mac OS X” dialog with a progress bar to indicate system initialization status as the various system processes start up.

However, beginning with OS X v10.5, the launchd process was highly optimized, so the system initialization process takes only a few moments and is difficult to visually discern. The best indication that you have reached this point is that the dark gray Apple logo is replaced by the login window or the user’s desktop background. If you have a Mac system with multiple displays you may also notice a brief white flash coming from the secondary displays. This is a result of launchd starting the WindowServer process, which is responsible for drawing the OS X user interface, but it’s still a good indication that things are progressing through the system startup process.

The launchd process is designed to expedite system initialization by starting multiple system processes simultaneously whenever possible and starting only essential system processes at startup. After startup, the system launchd process automatically starts and stops additional system processes as needed. By dynamically managing system processes, launchd keeps your Mac responsive and running as efficiently as possible.

System launchd Items

As covered in Lesson 15, “System Resources,” launchd manages system processes as described by launchd preference files in the /System/Library/LaunchDaemons folder. Third-party processes can also be managed when described by launchd preference files in the /Library/LaunchDaemons folder.

Apple strongly encourages all developers to adopt the launchd system for all automatically started processes. But the system launchd process also supports legacy startup routines. This includes support for running the traditional UNIX /etc/rc.local script during system initialization if present, though this script is not included on OS X by default.

The system launchd process also starts the /sbin/SystemStarter process, which manages system processes as described by legacy OS X startup items. OS X does not include any built-in startup items, but SystemStarter still looks in the /System/Library/StartupItems and /Library/StartupItems folders for third-party startup items.

Viewing the launchd Hierarchy

You may find it beneficial to open /Applications/Utilities/Activity Monitor and examine the process listing as you learn about how OS X starts up the user environment. The Activity Monitor application lists all processes along with their identification numbers and parent/child relationships. In the Activity Monitor, you see this relationship best if you choose View > All Processes, Hierarchically. You can also view a process’s parent process by double-clicking its name in the list. Detailed information about using Activity Monitor is covered in Lesson 21, “Application Management and Troubleshooting.”

Peachpit Promotional Mailings & Special Offers

I would like to receive exclusive offers and hear about products from Peachpit and its family of brands. I can unsubscribe at any time.


Pearson Education, Inc., 221 River Street, Hoboken, New Jersey 07030, (Pearson) presents this site to provide information about Peachpit products and services that can be purchased through this site.

This privacy notice provides an overview of our commitment to privacy and describes how we collect, protect, use and share personal information collected through this site. Please note that other Pearson websites and online products and services have their own separate privacy policies.

Collection and Use of Information

To conduct business and deliver products and services, Pearson collects and uses personal information in several ways in connection with this site, including:

Questions and Inquiries

For inquiries and questions, we collect the inquiry or question, together with name, contact details (email address, phone number and mailing address) and any other additional information voluntarily submitted to us through a Contact Us form or an email. We use this information to address the inquiry and respond to the question.

Online Store

For orders and purchases placed through our online store on this site, we collect order details, name, institution name and address (if applicable), email address, phone number, shipping and billing addresses, credit/debit card information, shipping options and any instructions. We use this information to complete transactions, fulfill orders, communicate with individuals placing orders or visiting the online store, and for related purposes.


Pearson may offer opportunities to provide feedback or participate in surveys, including surveys evaluating Pearson products, services or sites. Participation is voluntary. Pearson collects information requested in the survey questions and uses the information to evaluate, support, maintain and improve products, services or sites; develop new products and services; conduct educational research; and for other purposes specified in the survey.

Contests and Drawings

Occasionally, we may sponsor a contest or drawing. Participation is optional. Pearson collects name, contact information and other information specified on the entry form for the contest or drawing to conduct the contest or drawing. Pearson may collect additional personal information from the winners of a contest or drawing in order to award the prize and for tax reporting purposes, as required by law.


If you have elected to receive email newsletters or promotional mailings and special offers but want to unsubscribe, simply email

Service Announcements

On rare occasions it is necessary to send out a strictly service related announcement. For instance, if our service is temporarily suspended for maintenance we might send users an email. Generally, users may not opt-out of these communications, though they can deactivate their account information. However, these communications are not promotional in nature.

Customer Service

We communicate with users on a regular basis to provide requested services and in regard to issues relating to their account we reply via email or phone in accordance with the users' wishes when a user submits their information through our Contact Us form.

Other Collection and Use of Information

Application and System Logs

Pearson automatically collects log data to help ensure the delivery, availability and security of this site. Log data may include technical information about how a user or visitor connected to this site, such as browser type, type of computer/device, operating system, internet service provider and IP address. We use this information for support purposes and to monitor the health of the site, identify problems, improve service, detect unauthorized access and fraudulent activity, prevent and respond to security incidents and appropriately scale computing resources.

Web Analytics

Pearson may use third party web trend analytical services, including Google Analytics, to collect visitor information, such as IP addresses, browser types, referring pages, pages visited and time spent on a particular site. While these analytical services collect and report information on an anonymous basis, they may use cookies to gather web trend information. The information gathered may enable Pearson (but not the third party web trend services) to link information with application and system log data. Pearson uses this information for system administration and to identify problems, improve service, detect unauthorized access and fraudulent activity, prevent and respond to security incidents, appropriately scale computing resources and otherwise support and deliver this site and its services.

Cookies and Related Technologies

This site uses cookies and similar technologies to personalize content, measure traffic patterns, control security, track use and access of information on this site, and provide interest-based messages and advertising. Users can manage and block the use of cookies through their browser. Disabling or blocking certain cookies may limit the functionality of this site.

Do Not Track

This site currently does not respond to Do Not Track signals.


Pearson uses appropriate physical, administrative and technical security measures to protect personal information from unauthorized access, use and disclosure.


This site is not directed to children under the age of 13.


Pearson may send or direct marketing communications to users, provided that

  • Pearson will not use personal information collected or processed as a K-12 school service provider for the purpose of directed or targeted advertising.
  • Such marketing is consistent with applicable law and Pearson's legal obligations.
  • Pearson will not knowingly direct or send marketing communications to an individual who has expressed a preference not to receive marketing.
  • Where required by applicable law, express or implied consent to marketing exists and has not been withdrawn.

Pearson may provide personal information to a third party service provider on a restricted basis to provide marketing solely on behalf of Pearson or an affiliate or customer for whom Pearson is a service provider. Marketing preferences may be changed at any time.

Correcting/Updating Personal Information

If a user's personally identifiable information changes (such as your postal address or email address), we provide a way to correct or update that user's personal data provided to us. This can be done on the Account page. If a user no longer desires our service and desires to delete his or her account, please contact us at and we will process the deletion of a user's account.


Users can always make an informed choice as to whether they should proceed with certain services offered by Adobe Press. If you choose to remove yourself from our mailing list(s) simply visit the following page and uncheck any communication you no longer want to receive:

Sale of Personal Information

Pearson does not rent or sell personal information in exchange for any payment of money.

While Pearson does not sell personal information, as defined in Nevada law, Nevada residents may email a request for no sale of their personal information to

Supplemental Privacy Statement for California Residents

California residents should read our Supplemental privacy statement for California residents in conjunction with this Privacy Notice. The Supplemental privacy statement for California residents explains Pearson's commitment to comply with California law and applies to personal information of California residents collected in connection with this site and the Services.

Sharing and Disclosure

Pearson may disclose personal information, as follows:

  • As required by law.
  • With the consent of the individual (or their parent, if the individual is a minor)
  • In response to a subpoena, court order or legal process, to the extent permitted or required by law
  • To protect the security and safety of individuals, data, assets and systems, consistent with applicable law
  • In connection the sale, joint venture or other transfer of some or all of its company or assets, subject to the provisions of this Privacy Notice
  • To investigate or address actual or suspected fraud or other illegal activities
  • To exercise its legal rights, including enforcement of the Terms of Use for this site or another contract
  • To affiliated Pearson companies and other companies and organizations who perform work for Pearson and are obligated to protect the privacy of personal information consistent with this Privacy Notice
  • To a school, organization, company or government agency, where Pearson collects or processes the personal information in a school setting or on behalf of such organization, company or government agency.


This web site contains links to other sites. Please be aware that we are not responsible for the privacy practices of such other sites. We encourage our users to be aware when they leave our site and to read the privacy statements of each and every web site that collects Personal Information. This privacy statement applies solely to information collected by this web site.

Requests and Contact

Please contact us about this Privacy Notice or if you have any requests or questions relating to the privacy of your personal information.

Changes to this Privacy Notice

We may revise this Privacy Notice through an updated posting. We will identify the effective date of the revision in the posting. Often, updates are made to provide greater clarity or to comply with changes in regulatory requirements. If the updates involve material changes to the collection, protection, use or disclosure of Personal Information, Pearson will provide notice of the change through a conspicuous notice on this site or other appropriate way. Continued use of the site after the effective date of a posted revision evidences acceptance. Please contact us if you have questions or concerns about the Privacy Notice or any objection to any revisions.

Last Update: November 17, 2020