Macs should never shut down or restart of their own accord, nor should they ever freeze. If yours does any of those, you should assume it’s the result of a kernel panic, and that’s not something you should ignore. The most important evidence as to what happened in a kernel panic, and clues as to why it happened, comes in the panic log, shown shortly after you’ve logged back into your Mac. Don’t dismiss that dialog until you’ve saved its contents for future reference.

Save the panic log

Panic logs used to be saved in /Library/Logs/DiagnosticReports, from where you could open them in Console, but more recently were found somewhere closer to /var/db/PanicReporter, but now seem to vanish into thin air. You therefore need to copy its contents as soon as it appears and before sending it to Apple.

If the alert isn’t already showing the panic log, click on its Report… button, then open a text editor like TextEdit. Copy the whole contents of the panic log into a new text document and save it somewhere safe before clicking on the button to send the report to Apple. Once you’ve done that, the alert is dismissed and can’t be brought back.

Unlike app crash logs, panic logs are normally brief and to the point. Although they may be non-specific and not help much, in many cases they contain obvious clues as to what caused the panic. Formats have changed over the years, and the current Paniclog version is 14, but the following sections are likely to prove worthwhile examining.

Immediate cause

At the very top, following the first word panic, the log gives summary information and may suggest a cause:
panic(cpu 0 caller 0xfffffe002f4e48bc): cannot find IOAESAccelerator
tells you that the panic occurred on CPU core 0, because a key kernel extension couldn’t be found, a cause that isn’t particularly useful in discovering why the panic occurred.

Other non-specific examples include:
panic(cpu 0 caller 0xffffff80015efa76): Kernel trap at 0xffffff7fa047645c, type 14=page fault, registers:
panic(cpu 4 caller 0xfffffe001b91de94): Kernel data abort. at pc 0xfffffe001c2b2538, lr 0x65a4fe001c2b28ec (saved state: 0xfffffe402ecdb310)

Sometimes you strike lucky at the start:
panic(cpu 1 caller 0xfffffff01731bd68): SEP Panic: :SEPD/MDMA: 0x0000b72d 0x0002791b 0x0000971f 0x00003a91 0x00003bb7 0x00000000 0x00000000 0x00000000 [rnit]
reveals that it was the SEP, Secure Enclave Processor, that panicked. That’s likely to result in a boot-loop panic, where every time the Mac tries to start up, it panics immediately, and continues to cycle through booting and panicking until you or your Mac force it to shut down.

panic(cpu 8 caller 0xffffff80017729eb): "zalloc: zone map exhausted while allocating from zone kalloc.12288, likely due to memory leak in zone kalloc.48 (6586956000 total bytes, 137228148 elements allocated)"@/AppleInternal/BuildRoot/Library/Caches/com.apple.xbs/Sources/xnu/xnu-6153.141.1/osfmk/kern/zalloc.c:3627
is pure gold, as it reveals a probable memory leak as the cause.

Exceptions mentioned here can include page faults, in which something has tried to access an invalid memory address, invalid instruction codes for the processor, and general protection faults which include a wide variety of other bugs. As far as the user is concerned, all exceptions indicate a bug or problem in the code that’s being run.

Further down you should see confirmation that this was a kernel panic, in a line like
Debugger message: panic

OS details

Normally you’ll see a couple of lines reporting the version number of macOS running at the time. For example
OS version: 24C101
Kernel version: Darwin Kernel Version 24.2.0: Fri Dec 6 18:57:59 PST 2024; root:xnu-11215.61.5~2/RELEASE_ARM64_VMAPPLE
You can compare those with the build number of macOS shown in System Information / Software, and in Mints. This is an unusual situation, as RELEASE_ARM64_VMAPPLE means this is from a virtual machine running on an Apple silicon Mac.

Sometimes you might see a line like
OS version: Not set yet
simply indicating that the version hasn’t been recorded yet.

On Apple silicon Macs, you should also see the iBoot version, and the current level of boot security:
iBoot version: iBoot-11881.61.3
secure boot?: YES
The latter is important, as running in Secure Boot means that no third-party kernel extensions have been loaded.

Memory leak

If there has been a memory leak, the panic log may well contain a breakdown of system memory zones giving more detailed clues.
Zone Name Cur Size Free Size
vm objects 78041088 26795008
…
Zone Name Cur Size Free Size
kalloc.32 280834048 3040
kalloc.48 6586956000 4896
kalloc.64 4241453056 5000896
…
Note how the Free Sizes of kalloc.32 and kalloc.48 are very small, and that of kalloc.64 is fairly low too. This is consistent with the kernel running out of memory in one of those zones. Further information may follow:
Backtrace suspected of leaking: (outstanding bytes: 288)

Because there’s the suspicion of memory leakage, the panic log also gives a detailed backtrace of where it suspects that leakage is occurring, and details of the kexts involved in that. Note that those may not coincide with any kexts identified earlier as possible culprits.

Panicked task

It’s worth looking through the log to discover the task that was running at the time of the panic. That might simply be the kernel
Panicked task 0xfffffe166cff1f18: 10735 pages, 374 threads: pid 0: kernel_task
or may give more specific information
BSD process name corresponding to current thread: WindowServer
Boot args: chunklist-security-epoch=0 -chunklist-no-rev2-dev
or
Panicked task 0xfffffe1b55369798: 24964 pages, 8 threads: pid 800: com.apple.Mobile
alternatively
Process name corresponding to current thread: mediaanalysisd

This is the name of the process running its code at the time, and can give another clue as to where the problem lies.

You may also be given a list of kernel extensions that might be involved:
Kernel Extensions in backtrace:
com.apple.filesystems.apfs(1412.141.1)[6DA33D13-4501-3D48-B4D8-0329E6AEC86D]@0xffffff7f84e7d000->0xffffff7f84fa4fff
dependency: com.apple.kec.corecrypto(1.0)[804DD660-F561-3444-A076-05D7A52D65E3]@0xffffff7f82746000
…

Third-party kexts

Whatever the cause, you should next look at the list of unloaded and loaded kexts forming the rest of the panic log. These are listed in the order that they were loaded, with the most recent kext at the top. As third-party kexts are the last to be loaded, the top of the lists start with any third-party kexts installed on that system and loaded at the time of the panic:
last loaded kext at 939128480512562: >!UAudio 323.4 (addr 0xffffff7f86baa000, size 434176)
last unloaded kext at 948795488738566: >usb.IOUSBHostHIDDevice 1.2 (addr 0xffffff7f8556c000, size 45056)
loaded kexts:
>!ATopCaseHIDEventDriver 3430.1
…
In most cases, the name of the kext as you’ll find it in /System/Library/Extensions is the last part of the ID given. For example, the kext with the ID of com.apple.driver.AppleMobileFileIntegrity is named AppleMobileFileIntegrity.kext.

If those lists contain any third-party kexts, they should be immediately suspected as being the cause of that panic, unless another cause is apparent.

Keep your Mac’s panic logs

Although you’ll want to get on with whatever you were going to do when you were so rudely interrupted by that kernel panic, put that record of the panic log somewhere safe. If your Mac does suffer another panic, you can then refer back to it for any common features that might indicate they had the same cause. Panic logs are also invaluable for others who might assist you in discovering what was wrong. I’m very grateful to those who send me their panic logs, and here wish to acknowledge Joe, who kindly sent me my first SEP panic, a real collector’s item.

There’s more information about dealing with kernel panics in the following articles here:
Crashes, panics, freezes and other unexpected events
How to deal with a kernel panic