[Simon]

Just out of curiosity, I recently decided to try out what happens when I delete Panther's swap files. So I went to /private/var/vm/ and deleted swapfile1, swapfile2, etc. Of course they were protected with 600 permission, so I just sudo'd the rm command. The files got deleted.

I then proceeded with work and I expected some bad errors to come up. I loaded big apps, games, large PS files, etc to get Panther to use a lot of memory and it actually did (according to top and the Activity Monitor), but the swap files didn't reappear, nor did I get any error messages.

So, what happens when you delete the files? Does the machine stop swapping? How come I can still use so much memory without the swap files?

[Oneota]

It's probable that you just got very lucky. I'd expect some major nastiness to occur if you ever do that in the future. Some apps (including the Finder and other more important system daemons) expect things that they were working on to be in memory somewhere (including a swapfile), and if they don't find those things, they can go haywire and do some major damage.

I'd avoid doing that in the future.

[wataru]

What gets swapped is data that you've already loaded at least once. So if the apps you opened after deleting the files hadn't already been run once since you last rebooted, they would not try to use the deleted files. I find it odd that no new swap files were formed; how much RAM do you have? Perhaps you didn't max it out. Or perhaps new swap files did appear, but you were looking at the folder in the Finder and the Finder just failed to refresh the folder. Regardless, that's a very dangerous game you played. Don't be surprised if things get hosed.

[kaboom]

We had a discussion over at ArsTechnica about this a couple of months ago. Someone was asking if you could delete swap files and some people were saying that you couldn't. I mentioned that I have deleted swap files using the method you described. One of the developer guys comes in and tells me that even though it looks like I deleted them, I actually didn't. I know it sounds weird but his explaination made a lot of sense.
I'd link to the discussion but since Ars' search doesn't work for sh!t, I can't.

[Simon]

I have 768MB of RAM. I'm not at all afraid about what I'm doing. This is on a development machine that is fully backed up. I intended to see what happens. I was expecting the machine to get hosed, but nothing happened...

[proton]

You're just seeing the wonders of Unix.

In Unix, when you unlink() (aka delete) a file, it doesn't actually get removed from the disk until after it's been closed by any processes that have it open. A quote from the holy manpage:

DESCRIPTION
The unlink() function removes the link named by path from its directory
and decrements the link count of the file which was referenced by the
link. If that decrement reduces the link count of the file to zero, and
no process has the file open, then all resources associated with the file
are reclaimed. If one or more process have the file open when the last
link is removed, the link is removed, but the removal of the file is
delayed until all references to it have been closed.

Nifty huh?

- proton

[Simon]

Originally posted by kaboom:
One of the developer guys comes in and tells me that even though it looks like I deleted them, I actually didn't.

Actually, I was expecting something like that...

I'd just like to know what exactly is going on under the hood.

[Simon]

Originally posted by proton:
You're just seeing the wonders of Unix.

In Unix, when you unlink() (aka delete) a file, it doesn't actually get removed from the disk until after it's been closed by any processes that have it open. A quote from the holy manpage:

...

Thanks proton, that's a very neat feature of UNIX. I Iove OS X.

[Person Man]

Originally posted by Simon:
Thanks proton, that's a very neat feature of UNIX. I Iove OS X.

Try doing a secure delete of the swap files (you may have to log in to the GUI as root to do so) and see what happens

[CharlesS]

Originally posted by Person Man:
Try doing a secure delete of the swap files (you may have to log in to the GUI as root to do so) and see what happens

Actually, you can do a secure delete with rm -P.

Not that I'd recommend it for the swap files!

[Person Man]

Originally posted by CharlesS:
Actually, you can do a secure delete with rm -P.

Not that I'd recommend it for the swap files!

No, but the original poster wanted to see what would happen if he deleted the swap files out from under the operating system, but because of the way UNIX handles deleted files that are in use, he couldn't do that... I wonder of rm -P works the same way? That's why I suggested logging in as root to the GUI (in case the Finder has its own method of securely deleting files).