Users experiencing DDM software updates in Sonoma for the first time may be encountering the new macOS update deadline feature. Trouble is, that some unprepared users may complain about what they perceive to be forced or unprompted restarts. To stay ahead of this, let's take a dive to see what we could learn about these forced restarts and if they truly were unprompted.
Grain of salt with this one, folks. While we had a nice, tidy file to look into regarding the current DDM SWU status of a Mac, I haven't found an elegant way to pull this information. So, for the time being, we're getting our hands dirty and digging into everyone's favorite morass,
This file can be enormous on many devices - dozens of megabytes of plaintext. It also automatically truncates now and then, so referencing it can be helpful for recent activity, but I wouldn't recommend relying on it for historical information. With that limitation in mind, let's see what we can learn about DDM software updates inside of that log.
DDM Software Update Notification Center notifications
To begin the search, I opened the log file in Console and ran a search for "DDM", to see what I could find. After some poking around, I was able to find something that looked promising:
Over the coming weeks, as additional updates eventually came out (or in test VMs), I tried to see if this line would pop out roughly when Notification Center notifications would appear for users. It seemed... mostly accurate. At least a place to begin. So, here's a one-liner you can run to look for these successful notification logs:
I ran this on a few machines and saw consistent results - the pings started off about daily and then grew in frequency leading up to the expiration date. This was a great tool to show someone "Here are all the times your Mac tried to tell you that your updates were due soon, and you had all this time to just restart and do it". In the above example output, you can see the cluster of notifications leading up to the application of a previous patch, then a brand new one for the next available point update.
DDM Software Update Forced Restart History
Back to the log mines. Thankfully, when someone complains about a forced restart, they're usually complaining because it happened right before a meeting. While unfortunate, that often means they can give us a pretty good idea as to when it occurred so we have a place to begin our research.
Combing through the logs, there were plenty of breadcrumbs to follow - here are some of the interesting lines I ran into along the way:
Finally, we found the line to look for indicating that the Software Update service was triggering a forced restart. Converting this to a one-liner:
As the DDM spec continues to evolve, and with each new version of macOS, there's a chance this syntax will change. So, tread carefully here, and I hope these commands can be helpful for the time being. If you want to track this longitudinally and avoid the trouble with the install.log file auto-truncating, I may recommend running these commands as recurring daily/weekly maintenance items and outputting their results into a separate log (only importing new lines not detected in your semi-permanent log file).