logo pmbanner

A Miscellany of Mystifying Tiger Problems

By Francine Schwieder

Amazing Disappearing Drive Space

Swapfiles

One day you notice GBs of drive space have disappeared. You add up everything you can see, and it Does Not Compute: you are still short of what Finder says is being used. You ask around and are told that the system can consume 5GBs of space when running normally, for its own mysterious purposes, and sometimes even more. Generally the files responsible are swapfiles, which are located here:

/private/var/vm/

Of course, the private folder is hidden, but you can get to it by using the Finder Go menu item, select the "Go to Folder..." option and type in the above path and hit the Go button.

menu dialog

Inside you will see at least one swapfile, and if this is the source of the problem you will have more of them. Each one is twice the size of the one before. If you remember the fairy tale about the peasant who agreed to help the king if he filled in a chess board with grains of wheat, doubling the number with each square, and ended up owning the kingdom, then you will realize just how quickly swapfiles can gobble up drive space. DO NOT attempt to remove these files! The only way to remove them is to restart the computer, and the only way to prevent their creation is to either buy more RAM or avoid having too many applications open at the same time (especially RAM hogs like Photoshop and, potentially, Safari) for the amount of RAM you have.

Failed Backups and the Volumes Folder

Another potential stealer of hard drive space is a failed backup, where the drive the backup was supposed to go to was unavailable, so the backup software simply copied the files into the invisible /Volumes folder. Again, use the Go and Go to Folder menu bar item, this time simply type /Volumes and click Go. The new window will have at least one item, an alias to your startup drive. If you have more drives/partitions mounted there will be aliases for each of them. If there is something in the folder that is NOT an alias drag it to your Desktop, and do GetInfo on it to see just how big it is. It may be that this is responsible for the vanished GBs. Check it to see what it contains, and if there is anything in it you need. You can then trash what you don't need in the usual way.

Log Files Gone Wrong

If your periodic UNIX jobs never run, and you have something writing incessantly to your log files, they can get very very big in a surprisingly short time. If you don't know whether the UNIX jobs have been running or not, get one of the Tiger utilities that will run them, such as OnyX or Cocktail, or run them yourself in the Terminal using this command:

sudo periodic daily weekly monthly

The sudo part of the command (super user do) makes you all-powerful for a short period of time, so be careful with it. You'll be asked for your password (and the first time you do it you'll be given a sort-of-stern warning about misuse), type it carefully, as it is not echoed to the screen, and then hit the Return key. For more information on the Terminal see HERE.

If this does bring back the missing space, then you have a problem. Launch your Console program from the Utilities folder and see if a whole bunch of error messages are constantly appearing. If they are you'll have to track down the offender and fix it. One of the most notorious culprits is certain scanner software installed by Canon. Try updating or disabling. Another famous one was a joystick from Macally, get their most recent driver.

console

A related antique problem is the famous Norton Antivirus spacesuckingfile. Yes, that is really its name. It will be somewhere in a sub-folder of /private/var/tmp. Do not use Norton anything on your Mac.

As long as you are looking in /private/var, take a look in this folder: /private/var/spool/cups and see if there is an enormous tmp folder in there. Previously there was a problem with this in Panther Server, but the problem has oddly started appearing on regular old Macs running Tiger. See this Apple Knowledge Base article for how to get rid of the junk:

http://docs.info.apple.com/article.html?artnum=107990

If All Else Fails: Locating the Bloat

Many people recommend using such utilities as Whatsize or OmniDiskSweeper to find where your drive space has gone. My experience is that these are kinda cool, nifty looking, but do not necessarily find where the space went. Try them, if they don't work to find your missing space, then try using this command in Terminal:

sudo du -cxhd 1 /

Launch Terminal, copy and paste the above into the Terminal window, hit the return key, carefully type your admin password (it is not echoed to the screen) and hit return again. If you have never run a sudo command before you'll get a little warning. You should get something like this:


8.0K /.Metadata
0B /.OSInstall-temp
4.0K /.Trashes
0B /.vol
3.8G /Applications
1.0K /automount
3.4M /bin
0B /Cleanup At Startup
0B /cores
8.0K /Desktop Folder
0B /dev
50M /Documents
3.0G /Library
512B /Network
109M /private
2.1M /sbin
668M /sw
1.0G /System
373M /System Folder
0B /Temporary Items
0B /TheFindByContentFolder
8.0K /TheVolumeSettingsFolder
0B /Trash
4.9G /Users
658M /usr
4.0K /Volumes
18G /
18G total

It may take a few minutes to finish running as it adds everything up. Be patient. The command translates into something like this: As root show the disk usuage, using the options to show a grand total but not looking at other mounted file systems, and display the numbers in human readable form, for the first level of directories on the startup disk. The number "1" is the level to use in displaying the information, so it just lists the size of the root level folders, kind of what you get if you opened the hard drive in list view in Finder with the Calculate size view option checked, except you see all the folders, not just the ones visible to Finder.

If you find find a large folder you continue using the Terminal command, stepping through the path until you find the offending folder. Thus, in the above list of my drive, if /private showed as 80GBs rather than the more normal 109MBs, I would issue the disk usuage command on it (I'm faking some numbers for purposes of demonstration):

sudo du -cxhd 1 /private
6.6M /private/etc
4.0K /private/tftpboot
80G /private/tmp
101M /private/var
80.1G /private
80.1G total

If one of those folders showed an unusual size, say instead of a normal 8KBs the /private/tmp folder showed 80GBs, I would do it again:

sudo du -cxhd 1 /private/tmp
80G /private/tmp
80G total

If there were a sub-folder I would keep going. In this case we're at the end of the folder line, so it is time to switch to the list command, as explained below.

If you don't see a huge folder size listed at the first step, or you have reached the end of the folder line, then it is possible that you have a giant single, and invisible, file at the root level of the drive itself or in the bloated folder. You can use a list command to see if that is the case:

ls -alh /

Hit return, and a list of everything at the root level of the drive, files and folders, will appear. It will look something like this:

-bash:~francine$ ls -alh /
total 11611
drwxrwxr-t 40 root admin 1K Nov 2 10:36 .
drwxrwxr-t 40 root admin 1K Nov 2 10:36 ..
-rw-r--r-- 1 francine francine 15K Nov 2 10:36 .DS_Store
drw------- 8 root francine 272B Nov 2 09:47 .Spotlight-V100
drwxrwxrwt 3 francine francine 102B May 4 2005 .TemporaryItems
d-wx-wx-wt 3 root admin 102B Oct 10 10:43 .Trashes

and so on, down to probably this:

lrwxr-xr-x 1 root francine 11B Aug 5 2006 var -> private/var

For the hypothetical problem with the /private/tmp folder it would look like this:

ls -alh /private/tmp
total 16
drwxrwxrwt 4 root wheel 136B Apr 9 23:10 .
drwxr-xr-x 6 root wheel 204B Apr 9 23:10 ..
-rw------- 1 francine wheel 80G Apr 9 23:12 objc_sharing_ppc_501
-rw------- 1 security wheel 24B Apr 9 23:10 objc_sharing_ppc_92

The first entry shows whether the item is a directory (begins with the letter d) or file (begins with -) or an alias (actually a symbolic link, begins with an l), gives the permissions, the owner and group the file belongs to, then the size in human readable form, the date modified and the file or folder name. You'll be looking for files with a size about equal to your missing space. To remove it you use the Terminal remove command. To learn how, see the article on Terminal. You may have to use a sudo command if the errant file belongs to the system.

To summarize: you use the disk usuage command (du) to locate large FOLDERS, after you find the FOLDER that contains the file, you need to do the list (ls) command to isolate the FILE to delete. Be very careful with this! If the file belongs to the system, so that it is necessary to use a sudo remove command you need to be absolutely certain you are removing a bad log or temp file, and nothing else.


Return to Index

Next: Disappearing Act: Invisibilities