I had a problem with my iMac today, everytime I tried to login it would get as far as showing me my desktop and the dock and then it would crash back to the login screen.
I found the following in the /var/log/system.log:
crashdump: Crash report written to: /Users/robin/Library/Logs/CrashReporter/loginwindow.crash.log
Having a look inside that file didnt really tell me much. So I tried to find the Darwin equivelant of strace or truss. There doesnt seem to be one, however I found fs_usage. This program will log all filesystem access after you run it, until you tell it to quit.
To debug this way you need to ssh into the problem mac from another machine, and on the command line (as root) run:
# fs_usage -w
If you use a bash shell you can capture the output to a file with:
# fs_usage -w > fs_usage.out 2>&1
Then try to login again, of course it will fail again, but this time we have captured all file system access in the fs_usage.out file or in our scroll back buffer.
You probably want to tell fs_usage to quit before you continure, press Ctrl-C.
Looking through this file I searched up from the bottom for the last line containing my username. I found this:
I went to have a look in that file. All .plist files in OsX are xml configuration files, but this one didnt containt xml it contained binary junk.
I moved this file to a different file name and tried to login again.
All working, thank god we have unix underneath!