El Capitan froze and rebooted (Macbook Pro Retina Mid 2012) 2.3 Ghz Intel Core i7 8GB DDR3:
Was running NetAdmin Pro which is monitoring 
my office LAN, processors consumption was at 
~15 - 20%. Simultaneously I ran WiFI Explorer, 
3.7% no more than 5% CPU usage. And I was 
updating Xcode to v 7.3.1 and was browsing and 
watching video from playground.ru
Watch the videos until half of it (20mins) the
Video froze I moved the mouse and turned out 
the whole OSX is frozen.
littleSnitch v 3.7 has no reaction
I immediately pull the Ethernet adaptor and 
MacBook just went to black screen. I then 
switch off the wireless router. (My MacBook Pro 
is connected to the network via Ethernet 
adaptor and via WiFi router bearing different IP,
I was thinking of cutting both network 
communication, in case it was an intrusion)
MacBook just restarted itself to login screen, 
after 15-20 sec of black screen and total 
silence)
I again restarted and booted into Recovery 
mode use disk utility. After completing disk 
check.
Login and previously opened programs resume 
back (NetAdmin Pro, WiFi Explorer, Yandex 
browser, Activity Monitor and AppStore)
AppStore doesn't resume the download 
everything else is functioning normally and in
Addition I have got my calendar open after login
(I did not launch accidental nor was it set to 
start with system login)


Question 1: Are there any way to know what was happening and what was OS El Capitan last reaction before it froze and rebooted?

Question 2: Are there any software better than "Console" v10.11 to interpret what was going on before it crashes?

P.S. Thank you in advance, I will try to upload the Console messages later from the MacBook Pro



DDT-2:~ Chaleune$ syslog | grep -i "shutdown cause"

Jun 22 14:15:37 DDT-2 kernel[0] &lt;Notice&gt;: Previous shutdown cause: 5

Jun 22 20:34:46 localhost kernel[0] &lt;Notice&gt;: Previous shutdown cause: 5

Jun 23 15:18:23 DDT-2 kernel[0] &lt;Notice&gt;: Previous shutdown cause: 5

Jun 24 17:58:32 localhost kernel[0] &lt;Notice&gt;: Previous shutdown cause: 5

Jun 24 20:09:52 localhost kernel[0] &lt;Notice&gt;: Previous shutdown cause: 5

Jun 24 22:58:15 localhost kernel[0] &lt;Notice&gt;: Previous shutdown cause: 5Jun 25 14:43:36 DDT-2 kernel[0] &lt;Notice&gt;: Previous shutdown cause: 5

Jun 25 21:55:31 localhost kernel[0] &lt;Notice&gt;: Previous shutdown cause: 3

Jun 25 22:20:57 localhost kernel[0] &lt;Notice&gt;: Kext com.apple.driver.AppleOSXWatchdog failed to load (0xdc008012).Previous shutdown cause: 5

Jun 26 10:18:44 localhost kernel[0] &lt;Notice&gt;: Previous shutdown cause: 5

Jun 26 12:09:45 localhost kernel[0] &lt;Notice&gt;: Previous shutdown cause: 5

Jun 26 18:00:31 localhost kernel[0] &lt;Notice&gt;: Previous shutdown cause: 5

Jun 27 13:05:58 DDT-2 kernel[0] &lt;Notice&gt;: Previous shutdown cause: 5

Jun 27 22:56:11 localhost kernel[0] &lt;Notice&gt;: Previous shutdown cause: 5

Jun 28 14:18:27 DDT-2 kernel[0] &lt;Notice&gt;: Previous shutdown cause: 5

*Jun 29 18:56:21 localhost kernel[0] &lt;Notice&gt;: Previous shutdown cause: -128*

Jun 29 23:31:22 DDT-2 kernel[0] &lt;Notice&gt;: Previous shutdown cause: -128




Opensource.apple shows the following


dsIllInstErr                  = 3,    /illegal instruction error/
dsChkErr                      = 5,    /check trap error/
userCanceledErr               = -128


macwizard gave the following interpretation:


03 Illegal Instruction
The computer has a specific vocabulary of machine language instructions it can understand. If a computer tries to execute an instruction that isn't in its vocabulary, you see this error code. It's less likely than error 02, but still very common.
05 Range Check Error
Programmers can use an instruction in the Motorola 68000 to check if a number is within a certain range. This error indicates that the number tested isn't in the specified range.
-128  userCanceledErr         User canceled an operation
Run a sysdisgnose. That is how Apple receives feedback from seeding/beta customers. The keyboard shortcut is Cmd Opt Ctrl Shift Period. 

You can also run sudo sysdiagnose -f ~/Desktop/ in Terminal. The former will save to /var/tmp and the latter will save to the Desktop. 

Sysdiagnose will contain pretty much A to Z.

You should be sure to check the disks.txt, diskutil.txt, errorlog.txt, logs.txt, and the diagnostics folder.