A few weeks ago, I considered here whether starting up in Safe Mode (with the Shift ket held) checks and repairs disks, as it has done in the past. I concluded then that macOS Catalina no longer does that. This article looks at what Catalina’s Safe Mode actually does.
Apple’s current support page detailing Safe Booting was written over two years ago, and clearly hasn’t been updated for 10.15 yet. According to that, entering Safe Mode at startup does three things:
Choose Another Startup Disk with the Startup Manager. To boot from a specific device, press. Immediately after your Mac starts (some Mac computers play a startup sound), press and hold the Shift key. Release the Shift key when you see the gray Apple logo and progress indicator. To leave safe mode, restart your Mac again, but don’t press and hold any keys during startup.
- it verifies the boot disk and, if there are any directory issues with it, it attempts its repair;
- it blocks the loading of many kernel extensions, startup and login items, and user-installed fonts;
- it deletes font caches, the kernel cache, and other system caches.
The second of those limits its usefulness, as some of the blocked items prevent some sub-systems from working normally. If you’re trying to isolate a problem which affects one of those sub-systems, Safe Mode won’t help.
I’ve now performed Safe Boots on a MacBook Pro 2017 (without T2 chip) running both 10.15 and 10.15.1, and conclude that no useful check of the integrity of storage is performed any more, have compiled a list of kernel extensions which aren’t loaded in Safe Mode, and looked at some of the ‘caches’ which it rebuilds. Let me step you through some typical log entries from starting up in Safe Mode. As usual, times are given in decimal seconds, in local time UTC+0100.
As with all startups, the log entries open with two characteristic waypoints:
3.000000 system boot: [UUID]
3.000000 log class: in-memory begins
Note that the UUID/GUID given here appears to be unique to that startup, rather than any for that machine.
Holding down the shift key while turning a Mac on will boot it into Safe Mode. Here's how to start a Mac in Safe Mode and use it to diagnose issues.
The first indication of Safe Booting appears very early in the log. I’ve always been uncertain how long to hold the Shift key for. In this case, less than a second from initiating the startup should have been fine.
3.054764 kernel SAFE BOOT DETECTED - only valid OSBundleRequired kexts will be loaded.
In 10.15, you will then see scattered entries referring to kernel extensions which haven’t been loaded, such as
3.352849 Kext com.apple.vecLib.kext is not loadable during safe boot; omitting its personalities.
In 10.15.1, there’s now a full listing by subsystem of all the kexts which aren’t loaded, which I reproduce at the end of this article.
Almost exactly one second after the initial log entry, the new Catalina Volume Group is prepared and mounted (just as in a regular startup):
4.080006 ROSV: apfs mounted RO and is the system volume of a volume group and mounted as the root fs: creating the shadow fs_root
4.080063 apfs_vfsop_mount:1463: mounted volume: Macintosh HD
4.081282 attempting kernel mount for data volume...
4.084126 attempting kernel mount for vm volume...
Outlook For Mac Safe Mode
There are no log entries which report that
fsck_apfs is being run, nor of any results of that. This is almost unnecessary anyway: compare the time taken for Safe Boot in Mojave with that in Catalina, particularly if you have any snapshots which need to be checked. Safe Booting in Catalina – on my system at least – takes little longer than a regular startup. If you experience any different, please let me know.
One major task which appears in Safe Boots is a thorough rebuild of OpenDirectory databases. This is heralded by the log entry:
6.504643 opendirectoryd Safe boot is enabled
Every startup is followed by a quick clean-up of temporary files, which is performed by the Directory Helper:
6.516512 dirhelper Cleaning T/ older than 3 days
6.516518 dirhelper Cleaning TemporaryItems older than 3 days
Another new and important service which takes note of the Safe Boot is Endpoint Security:
6.517115 endpointsecurityd Safe Boot mode detected
As this subsystem is so new, and little-used still, the implications of this aren’t clear yet.
Shortly after that, the OpenDirectory rebuild swings into action, with a great many log entries such as
6.816245 opendirectoryd PlistFile Database '/private/var/db/dslocal/nodes/Default/sqlindex' passed integrity check
6.816455 opendirectoryd PlistFile Database closing '/private/var/db/dslocal/nodes/Default/sqlindex'
6.816568 opendirectoryd PlistFile Database removed '/private/var/db/dslocal/nodes/Default/sqlindex' along with journal file
6.823589 opendirectoryd PlistFile re-indexing '<private>' with type 'computers'
6.833248 opendirectoryd PlistFile re-indexing '<private>' with type 'users'
repeated many times, progressing through sharepoints, config and groups.
Many of the caches which are cleared as user-specific, so don’t appear until after login. That process is marked by distinctive entries such as
loginwindow main Login Window Application Started
loginwindow -[SessionStateMonitor setLoginState:] ************* login state: InitialStartup
Unfortunately, once user processes start up, finding anything among them to indicate specific caches being cleared is like looking for a needle in a haystack. When I have plenty of time (!), and fancy browsing the 58 MB of log entries again, I may revisit this. But I have no reason to doubt Apple’s claim that various user caches are cleared.
To return to Apple’s original list of what happens in Safe Mode, as far as Catalina goes:
- if any verification of the boot Volume Group does take place (which doesn’t appear to be the case), it’s performed in secret;
- it blocks the loading of many kernel extensions (listed below), startup and login items, and user-installed fonts;
- it deletes font caches, the kernel cache (which I think is started afresh on the VM volume anyway), and other system caches;
- it rebuilds OpenDirectory databases.
Appendix: List of Kernel Extensions Which Aren’t Loaded in Safe Mode (10.15, 10.15.1)
AppleCameraInterface.kext – this means a built-in camera can’t be used
AppleThunderboltEDMService.kext – these may prevent use of some Thunderbolt devices
eficheck.kext – this means that firmware integrity checks aren’t performed on non-T2 models
msdosfs.kext – this makes the Mac unable to access MS-DOS file systems
and user-installed kernel extensions. Apple hasn’t yet explained what will happen with loading of its new ‘SEXTs’, but I suspect that they too will be blocked.
Reasons to start your Mac in Safe Mode
Mac's Safe Mode minimizes the applications you have available on your Mac to help identify where any issues might be coming from. Starting up your computer and making it run in Safe Mode is also known as a safe boot (safe boot is how your Mac starts, Safe Mode is how it runs).
Booting in Safe Mode doesn’t just restrict your applications: A safe boot also checks through your startup drive to make sure there are no problems there.
A fault in your system (like corrupted boot sector) might be preventing you from using your Mac at all. By booting in Safe Mode, your Mac can work with macOS core processes to get back into the system and identify problems, such as floating extensions or rogue applications, that you can then remove.
What happens in Safe Mode
When your computer is prompted to perform a safe boot, it will perform a number of tasks before you can use it, which include:
- A directory check of the startup drive;
- Running on only the bare minimum of necessary kernel extensions;
- Disabling all startup or login applications;
- Deleting the dynamic loader cache, which can help fix blue screen freeze on startup (OS X 10.5.6 or later);
- Disabling all fonts that are not supplied by Apple and moving all font caches to the Trash.
Troubleshooting in Safe Mode
Once your Mac is running in Safe Mode, some applications will no longer be available. If your Mac is working fine in Safe Mode, then it’s likely that one of the restricted applications is responsible for the issues. You can manage the list of startup applications manually, removing the potential buggy apps one at a time to see if it affects the performance.
Open Apple Menu > System Preferences
Click Users & Groups icon
Choose your username, then click Login items
Use [-] sign to remove startup items
There is still a problem though. Manually deleting problem applications still leaves their traces deep in the system, so it’s best to use a dedicated Mac cleanup software like CleanMyMac X to double check your Mac is clear of any problematic files.
If your Mac continues to run into difficulties even in Safe Mode, you may need to use Mac’s native recovery tool, Disk Utility.
Identifying the problem
Here is a list of most common system issues Mac users encounter when their Mac isn’t running at peak performance:
- Corrupted startup files or login applications
- Software conflicts
- Damaged hardware
- Too many apps running, or too much junk cluttering up your disk
To diagnose your Mac more precisely, we recommend performing a full scan with some dedicated Mac cleaning app. As described above, CleanMyMac is our favorite (you can download this app here for free). This app made by the guys from MacPaw sports a handy Dashboard, with hardware health monitors among others, which should give you a clue as to what’s wrong with your system.
How to start your Mac in Safe Mode
To restart your Mac in Safe Mode, begin with your Mac switched off or restart it.
1) As soon as your Mac switches on and lights up, press and hold the Shift key.
2) Release the Shift key as soon as the login window appears.
That’s it, your Mac has now been booted in safe mode. Note that it may take longer than usual to boot your computer: This is because there are several checks being performed before it’s ready to use.
If you don’t trust your Mac to turn off and on again without further complications, or for some other reason you would prefer not to safe boot from the startup screen, there is an alternative using the Terminal application.
1) Locate Terminal: Applications > Utilities > Terminal.
2) In the Terminal command line, type the following code and then press Enter:
sudo nvram boot –arg=”-x”
3) You will be asked to enter your password to authorize.
4) Your Mac will now reboot in safe mode. You will not have to hold the Shift key when the computer restarts, simply log in when prompted.
Running your Mac in Safe Mode
If you’re not sure whether your safe boot was successful, there are a couple of ways you can check.
‘Safe Mode’ will appear in red in the menu bar
The boot mode will be listed as ‘Safe Mode’ (instead of ‘Normal’). To find your boot mode, click on the Apple logo in the menu (top left) and select This Mac. Choose System Report, then Software, and from there you will be able to see whether you are in normal or safe mode.
Your performance speed will change. Typically macOS will run slower when it is in Safe Mode due to the reduced processes, but if you have noticed some serious lagging this may be improved by the faulty applications being restricted.
Working in Safe Mode
Running your macOS in Safe Mode is normally used to troubleshoot glitches that you have noticed, such as lag, crashing, or spontaneous closures of applications. You should try to use your Mac as you normally do so that you can see if the issues have disappeared in Safe Mode or are still there.
You will find that some features aren’t available, such as third-party fonts, the DVD player, and audio in/out devices, which may limit how productive you can be, so it’s best to identify the fault in Safe Mode, fix it, and return to normal mode to work as usual.
Exiting Safe Mode
Once you’re finished in Safe Mode, simply restart your Mac. It should then reboot as normal, hopefully with improved performance.
If you’re using Terminal commands to return to normal, type
sudo nvram boot-args='
It may take a little longer than usual to shut down from safe mode, but don’t become impatient and use the power button to force a hard shut down.
Booting in Safe Mode Unprompted
If your Mac automatically enters Safe Mode itself without you pressing shift or using the Terminal, don’t panic. Your Mac may have detected an issue that it thinks needs repairing in Safe Mode. If this happens only once, then great, your Mac did its job and cleaned up the issue before it could cause any more problems.
If your Mac is stuck restarting in a Safe Mode loop, try entering another startup configuration, the Recovery Mode, by pressing Command (?) + R upon startup. This will perform a Disk Utility scan to check for issues, and, if that doesn’t work and you have backed up your files, you can try a reinstalling a clean copy of macOS to start fresh.
Tip: Check your keyboard is clean and that there is no debris beneath the keys. If the shift key has become stuck, your Mac will think it’s being pressed during startup to initiate a safe boot.
Safe Mode limitations
Purpose Of Safe Mode
Unfortunately, the responsibility to locate software issues still resides with the user in Safe Mode. A safe boot will check for disk problems, but if it fails to turn anything up you may be resigned to shifting through your applications list to see what might be causing the problem.
Safe Mode For Mac Pro
Luckily, some helpful maintenance utilities can be run while in Safe Mode. CleanMyMac X is one of those so check it out. It clears through your junk before it can impact on your system, but if your macOS is starting to lag it might be time to perform a full clean-out of those unused applications. With an average of 62GB of junk cleaned from an average Mac, it's maybe just the tool you need to put your Mac back on track.