[TheseApples]

I am running low on space and my MacBook Pro has been been sluggish lately. I think the two are related. I'm working on cleaning it up, but my available hard drive space seems to shrink while I'm not doing anything but surfing the web. Is something being dumped on to my drive without me noticing? This is probably something that I should know already but never learned, so I could use some help.

An hour ago, I got a "startup disk nearly full" message and I literally watched my available space count down while I did nothing but look for files to delete. When it hit zero, my computer froze and I had to perform a manual restart, something that I've been having to do quite often recently.

Can anyone tell me why this is happening and if there's anything I can do to stop it? I have a 111gb hard drive with less than 10gb available, I have downloaded WhatSize, but it didn't tell me anything that I didn't already know (I think. I might be missing something. Any pointers here would be appreciated as well) and I back up my data by running Time Machine on my 1 TB external hard drive.

Thanks in advance!

[iM@k]

Hmmmm, it's very odd to have your hard drive fill up randomly. If this were a Windows system, I'd tell you to run a security app (anti-virus ect) to look for any rogue programs that could be downloading things.

As this is a Mac this is a very unlikely case unless you've downloaded something recently that was a Mac Trojan.

Do you use Time Machine by any chance? Could it be on and set to back up to the HD it's backing up?

If you do have Time machine enabled, and correctly (To external drive), i would say you should do a clean in stall from the system/OS disk and then restore JUST what you need from the time machine and work on getting the rest moved to CDs or DVDs.

[Big Mac]

I don't think you can set Time Machine to backup to the source drive. Time Machine won't start unless it's provided with a backup drive with sufficient free space to back everything up to; I'm pretty sure it would never let the user select the startup drive.

TheseApples, if your hard drive really is nearly full, you'll have the problems you describe - your computer will be slow and you'll get disk space warnings. If you restart you may see more free space temporarily, but it will be reduced as you work and virtual memory space is used. How long has hard drive space been an issue? Have you been using your MBP with low disk space for a while? Rarely people report that errant log files are taking up large amounts of space, but that is very unusual. Have you looked for important errors in Console? It's hard to say without seeing your drive whether you just have too much legitimate data stored on it or if there's some other problem.

[reader50]

There may be a runaway logging process. Run OmniDiskSweeper on the disk, see where unexpected space has gone to.

[macaddict0001]

I don't think it's odd. The machine is just assigning Virtual Memory isn't it? Time for a bigger HD

[TheseApples]

Thanks for replying, everyone, and sorry I haven't been around. I ended up freeing around 10 gigs of space by moving some stuff to my external drive so I thought the problem was solved, but my machine just froze up again and I lost quite a bit of work so obviously I'm missing something, and it doesn't seem to have to do with hard drive space.

reader50: I'm running OmniDiskSweeper as I type this message but I have no idea what files are important and what files I can delete. Can you tell me what to look for in a runaway logging process?

Big Mac: My disk has been pretty full for a while, but only recently have I had any issues with performance or my system freezing up on me every hour or so. I don't know what Console is, or what an important error would look like, but recent events have made me believe that this problem isn't related to disk space.

Let me describe what happens in greater detail:
Everything works just fine for an hour or two, then gradually things start to slow down. Usually I'm online when this happens. Eventually, an application stops responding (like iTunes or Firefox) but I can still work basic functions, like scrolling through the dock or working hot corners/using Cmd+tab to change applications. Very soon, even this stops working and more and more applications fail to respond. Eventually I am stuck on an application that is not responding. When I click on the apple menu to initiate a force quit, the rainbow pinwheel of death appears indefinitely and I am unable to do anything but move my cursor. My dock does not respond when I hover over it, and hot-corners no longer functions. I have let it stand like this for quite a while, but as I pay for internet by the hour and cannot disconnect when my computer is in this state, I must perform a manual restart by holding down the power button after I am sure that the problem will not work itself out.

This exact routine has happened multiple times in the last few days and I am growing increasingly frustrated. Any further help would be greatly appreciated because I am obviously missing something very important.

[reader50]

OmniDiskSweeper sorts based on size. From your description, you freed up 10 GB, and some runaway process used that all up in a few days. So look at the top, for stuff 10 GB or bigger. Follow the folder trees.

• /System/ - You can ignore anything in here. Normal processes don't write to here, and most don't have permission to.
• /Applications/ - usually not a suspect either.
• /Library/Logs/ - Look here for big files.
• /Library/Caches/ - Look here for big files.
• /Library/Application Support/ - a misbehaving application might write a bunch of stuff here. On the other hand, there are often big folders inside here anyway.
• /Users/(your name)/ - your user folder. Look for anything biger than 10 GB that you don't recognize. Subfolders to look in particularly:
• /Users/(your name)/Library/Logs/
• /Users/(your name)/Library/Caches/

It would help if you've run OmniDiskSweeper before, gotten a feel for what the normal sizes are. Then you'd probably notice things that have grown a lot, but that weren't on the big-file radar before.

Console.app is a utility for viewing logs. It is located in /Applications/Utilities/Console.app and defaults to opening the system log file. Right after a forced reboot, checking this log can reveal useful info if you're used to viewing the system log. Otherwise, you might have to copy the last few pages of it, and post it here for us to poke through.

[TheseApples]

Ok, so there has been a development:

Using OmniDiskSweeper, I performed a sweep of my hard drive. I then looked at all my biggest folders and subfolders and wrote down the sizes for all of them. Then I waited about ten minutes, and checked my available space again, against what my recent sweep had told me was available. Sure enough, there was less available space. I performed another sweep of my hard drive and, using my written sizes from the last sweep, I discovered that there was only one folder that was bigger in the second sweep. It's called "private," and it's not in your list of places to look, but it is taking up 26.2 GB. I did some more digging and discovered /private/var/log/ which is 22.9 GB and growing. Within that, there is "asl" which is 12.1 GB. I have no idea what any of these things are, but this is where all my extra space is going. What does that mean to you, reader50?

[amazing]

what OS are you running?

seems like you've got a runaway log process. Searching google for "runaway log process for mac" comes up with:

10.5: One fix for a runaway syslogd process - Mac OS X Hints

note the long discussion w/respect to various culprits. Utilities that need updating, incompatible startup items, etc. Here's more info, with terminal commands to remove asl.db which will be recreated--but you've got to find whatever is cuing the runaway process. Disable all startup items, see if that solves the problem, stuff like that.

'syslogd' process taking 100% CPU under Mac OS X 10.5.4 | MacFixIt - CNET Reviews

[TheseApples]

amazing: I'm running Leopard, and that fix that you showed me seemed promising because I do indeed run Time Machine and for a long time now I've had poor battery life (it's a very old battery though), but Activity Monitor doesn't show that syslogd is taking up any CPU whatsoever. I killed it anyway, and we'll just have to see if that works. For now, I'm more concerned with getting back the space on my disk that is being filled by whatever this log process is. Is there anything within the enormous /private/ folder that I mentioned above that I can delete?

[amazing]

I would start up in "safe" mode, which is where you hold the shift key down during startup, until the login window comes up stating "safe mode" in red (takes quite some time holding the key.) Safe mode disables all items in the user login items folder. If you've got something in the login folder that's incompatible with Leopard (which version of 10.5 are you running?) then it's turned off and won't contribute to the runaway log process. If you run in safe mode for a reasonable amount of time and you find that you're not losing HD space, then something in your login folder is incompatible with 10.5.x.

In the Finder, under the "Go" menu, pull down to "Go to Folder" and type in "/private/var/log", report back on how big the asl.db folder is. My asl.db folder under 10.5.8 is 256K, the asl.db item is 6 MB. My whole log folder is only 10 MB. Do this test before restarting in safe mode and again in safe mode. If the sizes are humongous (report back here), then I'd suggest following the CNET terminal commands while in safe mode, the items will be re-created.

Just restart to get back into regular mode. If you're still losing HD space, report back.

[reader50]

My system is running Leopard, and my /private/var/log/ folder is 4.9 MB.

To regain space, feel free to delete any big log file in there. Any log file 1 GB or bigger is not just big, but HUGE. You might have to reboot before you can empty the trash, since the file in question may be open at the time.

/private/var/log/asl/ does seem to be Time Machine-related, based on the logs I peeked into. Suggestion: delete (or move to Trash & reboot, then empty trash) on all the log files in the GB+ range. Note down their names before deleting. Right after rebooting, look to see if any have been recreated. If so, copy them to your Desktop, so you can open the copies for clues.

You probably can't open the originals - they'll be ordinary text files, but trying to open MB - GB sized text files will get you nowhere in TextEdit. There are specialty editors that can work around that (tail in Terminal for example) but if you're a regular GUI person, the method outlined above will work better.

[TheseApples]

Amazing: That fix that you showed me earlier seems to have done the trick, whatever the log process was seems to have gone, so thanks a million for that. I'll keep an eye on my disk and I'll check back in if it starts to shrink again. Right now I'm working on freeing up the space that was lost while I was scrambling for a solution. Any tips on that?

reader50: Thanks for your advice on the log files, I'm deleting the bigger ones now, but I'm wondering if I can also get rid of the 500 to 700 MB ones, because I have a lot more of those. Aside from /asl/ there are also three rather large files (several GB) in /private/var/log/ that are labeled System.log.0, System.log.2, and System.log.3. Those three plus the /asl/ make up the large majority of my /private/ folder, which in total is 26 GB.

[reader50]

System.log.xxx are archived copies of the main system log. Every once in awhile, the system compresses the log file and starts a new one. Eventually, it deletes the older ones. In your case, it was running out of disk space before it got to the delete-old-logs stage.

You can delete any logfile that has a number on the end, it's a compressed older log. And you can delete any logfile bigger than say, 10 MB. That should clear out all the runaway logs, but still leave legit ones.

[TheseApples]

OK, so I've thrown all the logfiles away that have a number on the end as well as all the ones that are bigger than 10 MB (not easy, by the way. I had to make my hidden files visible before it would let me trash them), but I just want to double check before empty my trash, is it all right? I now only have six logfiles in /asl/ and the biggest one is 1.5 MB, does that sound right?

[reader50]

It's safe enough to dump any log file. They are kept solely so you can troubleshoot problems after the fact.

btw, you can delete files from inside OmniDiskSweeper. The big Delete button on bottom left. And OmniDiskSweeper shows all files, visible or not.

[TheseApples]

Just wanted to come back here and thank everyone for all the help. Together, we have solved the problem of the mysterious shrinking disk space. I really appreciate it, and I will most certainly be using this forum for any problems in the future.

[DmbShn41]

I had an issue similar to this on my iMac running 10.4. Except my log file would grow to 123GB!! Unfortunately I didn't read this till today, so I was late chiming in. My experience was that even after deleting the log file, it would continue to grow. You would have to stop the process to fix the issue. Something else that helps is to occasionally power your system down instead of letting it run for months at a time with out logging out. Glad you got it fixed.