Mystery of the disappearing disk space
A few days ago, my wife’s iMac started running out of disk space. As in, ‘Zero bytes available’ in the Finder, with a warning dialog. This was quite odd, as it had a good 20GB free last week. I cleared out a few old video podcasts from iTunes to free up a couple of GB and thought nothing more of it.
The next day, I noticed that the free space had suddenly jumped up to 20GB again.
Then, yesterday morning, it ran out of space again. I cleared a few more big files from the drive, then did a ‘df -h’. 780MB free. I did another ‘df -h’. 779MB free. Then 778MB free. It was dropping at a rate of 1-2MB/second.
I knew that iTunes was subscribed to quite a few podcasts and, indeed, it had been downloading a couple of episodes recently. So I shut down iTunes and did another ‘df -h’. 772MB free… 771MB…
Must be the backup, I thought. I do a nightly rsync backup from my iMac to hers, and sometimes it’s still going during the day. But a ‘ps -aux | grep rsync’ on both machines brought up nothing. The backup wasn’t running.
Very strange. Maybe it was some sort of virus, worm, or rootkit that was downloading from the net? I shut down the AirPort network on the iMac to stop all network activity.
745MB free… 744MB… 743MB…
The plot was thickening. I shut down all running apps in the Dock, then did a ‘ps -aux’ and killed off all processes except those that looked like core Mac OS X services. 671MB… 670MB…
I used ‘lsof’ to see what files and folders were being written to. Couldn’t see anything suspicious there.
645MB… 644MB…
I obviously wasn’t going to find the problem, so I just rebooted the iMac to kill everything off. It came back up with around 980MB free, and stayed stable. Phew.
This morning, it now shows 21GB free.
Very odd indeed. What could have caused this weirdness? Some sort of virus? A dodgy hard drive? Some weird Mac OS X oddity? Answers on a postcard please - or, more conveniently, in the comments section below!
Bookmark this post:
December 8th, 2007 at 10:44 pm
didn’t duplicate everything and purge it?
December 8th, 2007 at 11:40 pm
I highly doubt it was a worm/virus etc. I’ve had problems in the past with P2P programs that were meant to be downloading to an external HDD, but instead they downloaded to an invisible folder of the same name as my external HDD but on my internal drive. It also failed to move the files over to the external once they had completed downloading.
I discovered this using OmniDiskSweeper program. Though you could do the same thing in teminal I though this program was much faster at showing me EVERYTHING on my HDD, including invisible folders and the sizes of each. It’s shareware so you have to pay to get it to delete stuff for you.. but it sounds like you know what you’re doing in Terminal, so you could probably do what I did, and just use OmniDiskSweeper to find the files/folders in question and use Terminal to delete.
Gideon
December 8th, 2007 at 11:43 pm
Though it’s possible it was Virtual Memory going absolutely nuts. Therefore a restart was going to be pretty much the only remedy. I’ve never heard of this before though.
Check out Activity Monitor in the Utilities folder to see the virtual memory usage for each process running on your Mac
Gideon
December 10th, 2007 at 5:38 pm
Yes, I was thinking virtual memory too. As I say, I shut down the network and the disk space still went down, which rules out P2P.
Thanks for the tips re OmniDiskSweeper and Activity Monitor. If it happens again, I’ll check them out! Actually OmniDiskSweeper sounds like a useful bit of kit regardless.
September 24th, 2008 at 2:57 am
Ok, this isn´t a quick answer, but I´m having the same problem right now, and it appeared meanwhile running rsync.
After rebooting, the problem remains. What to do?
September 24th, 2008 at 11:15 am
@Flameboy: One app that might help is What’s Keeping Me?, which I plan to review soon: http://www.hamsoftengineering.com/products/wkm/wkm.html
This tells you what processes are using what files, which may help to track it down.
and/or try lsof as I describe in my post above.
Does that help?
September 25th, 2008 at 1:17 am
Matt: Thanks for the hint, but I don´t really se how “What’s Keeping Me?” would help me here?
The problem seems to be that reported disc use differs from my actual use.
None of the things above did help me out.
I ran a utlility called “What size”, and if I summarize the files, I don´t get the same result as Finder do… Weird!
September 26th, 2008 at 5:49 pm
@Flameboy: Hmm good point. Trawling through the output of ’sudo lsof’ might be a better bet than WKM, though it would be a tedious process. You’d need to locate suspect files, then ‘ls’ or ‘tail -f’ them to see if they’re growing. Then you could use lsof again or WKM to identify the process that’s writing to the file.
September 29th, 2008 at 6:07 am
I figured it out!
The problem is caused by a bad mount. When a mount process fails, the system automaticly create a mount and saves the data under /Volumes/NAME_OF_THE _MOUNT.
So, what I did was only to delete this directory (with ´sudo rm -rf /Volumes/NAME_OF_THE _MOUNT´), and boom, my free space was back again!
Thanks for taking time helping me, hopefully someone else will be able to use this.
September 29th, 2008 at 11:51 am
@Flameboy: Glad you sorted out the problem!
Thanks for posting your solution - I hope it helps others.