Crash reports are unreadable in macOS Sonoma

tdecks wrote:

1. I'm frankly shocked that in 2025 you don't think endpoint protection is necessary on personal computers. I hope you never get hit with ransomeware...

Many businesses do require all their computers to be configured for Endpoint Protection, but they are using enterprise grade options. These enterprise grade options have caused us fewer issues than the traditional consumer & low level "enterprise" options provided by those older consumer grade vendors.

Sophos is a consumer based product that is not in the same tier (even if they do offer low level enterprise options). At one point my organization use Sophos, but only for a very short while before we moved away from it & several other traditional anti-virus brands. Today I would not touch any of the old traditional anti-virus products even if they are free. Most of those companies these days are providing inferior bug ridden products with gaping security holes while also selling people's personal information. The built-in protection provided by macOS and even Windows is perfectly fine for the majority of people as long as the users practice safe computing habits as outlined in this excellent article:

Effective defenses against malware and other threats - Apple Community

Only if a person is a high value target are other enhance security measures warranted, but I still would not use the average consumer based products currently available for the reasons I mentioned.

I stopped using third party anti-virus options back in the late Windows XP days once Microsoft's built-in option was performing on par with most of the consumer products. I've never thought to use any anti-virus on macOS except for my work Mac (using an enterprise grade EndPoint Protection) where it is required by my employer due to our cyber insurance.

3. I don't think either of these things is causing the problem because its been like that for a while. I'm much more inclined to believe that recently installing NoMachine is causing the problem, but I was hoping to find someting in the logs to validate that (besides just uninstalling it to see if the problem goes away, which I will probably try at this point)

NoMachine is a possibility as well, but I would suspect Sophos first & foremost because it is actively scanning the system & intercepting system processes whereas NoMachine is not. Plus at the time you ran the EtreCheck report you had performance issues, but NoMachine's extensions were not running.

I've seen people defend their use of anti-virus software, cleaning/optimizer apps, and third party security software over & over here on this forum using the same logic. However, those people who have uninstalled these types of apps have discovered all their issues magically disappeared afterwards. This is why all of the regular forum contributors advocate for never using these types of apps unless of course they are required by a school or employer. Even then, it is best to choose the least invasive & problematic option if allowed.

Is it guaranteed to fix the problem? No, but it is a necessary first step in troubleshooting since the user can always reinstall it later on if they wish. When troubleshooting issues it is best to go with the item with the highest probability of causing problems.

Of course everyone is free to do whatever they wish with their own devices. I can only offer my educated insights from years of personal experience supporting my organization's Macs and those of many family & friends & referrals, plus my years of assisting here & reading thousands of threads on this forum.

I would suggest perusing some of the other Sophos related threads here on this forum as you may find it enlightening:

Search -- Sophos - Apple Community

I will try clearing some space on the main drive. 14.89GB is definitely not enough free space.

You should also delete the no longer needed files mentioned in the Clean Up section at the end of the EtreCheck report. There is a chance they could be causing some issues as well. Sorry about forgetting to mention that part.

Clean up:
  ~/Library/LaunchAgents/com.movavi.converteragent.startup.plist
   
  ~/Library/LaunchAgents/org.virtualbox.vboxwebsrv.plist

Good luck with your system.

Uninstall Sophos by following the developer's instructions. Anti-virus software, cleaning/optimizer apps, and third party security software are not needed on a Mac (or even on Windows these days). These types of apps usually cause more problems than they solve since they interfere with the OS at a low level.

Plus you are running way too low on Free storage space. You should have at least 20GB+ of Free storage space at all times.....much more depending on your workloads. Even that 20GB can disappear quickly even with some simple workloads. When macOS runs low on Free storage space, odd things begin to occur and if you completely run out of storage space, then files can become corrupted (HFS+) or you may not be able to delete any files to free up more space (APFS)....plus you will definitely see performance decrease and it will cause extra wear on an SSD.

It certainly does not help that Apple has chosen to focus on "Available" storage on macOS instead of the actual Free storage space. Unfortunately the only place the Free storage space is explicitly listed is in Disk Utility or in the Apple System Profiler. "Available" storage on macOS is not synonymous with Free.

In the EtreCheck report it show you have 15.74GB of Free space and 59.69GB of "Available" space. "Available" storage consists of Free space and Purgeable space. Purgeable space is storage that will automatically be released at some unknown time in the future. Apple makes it seem like this will occur when you run low on storage, but that is a great deception & disservice to people. Free space is the only one which matters since that is storage that can be used immediately.

Even if you delete 10GB of files right now, you won't see an increase in the Free space until at least 24 hours from now (sometimes 48 hours) although you will see an increase in both "Available" and Purgeable storage. The deleted items will remain in the hidden APFS snapshots for your Time Machine backups (or even many third party backup apps).

Free space = Available space + Purgeable space

Available space = Free space + Purgeable space

It think there is a good chance these two things are causing the problem or at least are greatly contributing to the problem.

The best use for Crash Reports is for Apple Engineers and they may request them when you open a Support Ticket.

If you are looking to resolve a crash problem, then post the free EtreCheck report using the Additional Text option when posting. The report contains no personal information and will identify which apps are crashing along with any third party processes running on startup that may be contributing to the crash.

How to use the Add Text Feature When Post… - Apple Community

The Text Encoding in the posted crash report is using something other than UTF-8 and not sure why. The contents after the identification is a JSON.

I would suggest running the third party app EtreCheck and posting the complete report here so we can review it for possible clues.

How to use the Add Text Feature When Posting an EtreCheck Report - Apple Community

From time to time I find some macOS logs are corrupted like you have seen. I usually suspect a hardware issue does this, but I've never proven it since the corrupt logs are very random. However, macOS has such odd behavior with logs these days, it is also possible macOS is the cause as well. These days I find that trying to open a macOS log ends up relocating the log file and the Console app is unable to read it after I locate its new location (the file is fine when viewed using the command line utilities).

It is best to stay away from looking at any macOS logs these days since they are no longer useful for troubleshooting. You will just drive yourself crazy trying to analyze the macOS logs.

I agree with HWTech for all recommendations including free space, Sophos, and cleanup files. Another issue may be the Docker app. The problem is that the file installed on your computer is unsigned from Docker and crashes have been verified on Docker's own website as well as on this Support Site. Remove the Docker app with any provided uninstaller and verify with the EtreCheck report that all have been removed and test again. If all is well, you can try installing again.

The exact file that you have showing unsigned is com.docker.socket.plist. On Sequoia it will pop up a message claiming to be Malware and will block it from loading, but in Sonoma it may load and crash. A workaround for that file has been provided here, but I would just remove and test, followed by a reinstall instead of resorting to the Terminal commands.

https://github.com/docker/for-mac/issues/7527

Good Job! The point was to get your Mac stable and it appears you have accomplished that. Now you can identify the problematic app, so at least you can make the determination of following up with that developer or just removing it to avoid the crash.

Being paranoid about security is common and not actually a bad thing. The only concern is when this paranoia is being increased due to the many ads seen by these AntiVirus providers that claim you need protection along with all the scams you see that claim you have a virus, many times those are advertisements from these same providers. The fear factor used by many of them are unacceptable.

What we see here on a daily basis is the incompatibility with MacOS that provides very effective defenses against Malware, so the first recommendation will always be to remove it and compare your results. Time and time again, after removal the reported problems go away so that cannot be ignored. We are not telling you what you can and cannot have on a computer you own, just trying to resolve an issue and many times the issue is with AntiVirus. Whether you need it or not is much debated and not really relevant when a problem goes away after removal.

...