A glitch in the Matrix (i.e some weird invisible files in /private/var/db/)

[Cham2000]

Today, I made a "small" mistake by installing an app that I didn't liked: menuffy (from this place: https://zaru.github.io/menuffy/index_en.html). After trashing it, I searched for all the files that were created by this app, using a good search tool (Find Any File, which is pretty good). I then found four files called menuffy.aot (about 95KB each), inside some directories with large numbers in their name, which are located in the /private/var/db/oah directory. The /private/var/db/oah directory isn't accessible by the admin user (the owner is called "_oahd"), and was apparently created by Rosetta2 (according to what I found on the Web). This part is sealed by Apple.

So I'm unable to remove the four menuffy.aot files (even with the sudo command in the Terminal). This is apparently a sealed part of the OS, to protect against "Bad Actor" Software. But then, how the app menuffy could have created these files there? I guess it's - apparently - the OS itself that made them, so it's probably not the app itself (??).

AFAIK, there isn't any possibility to uninstall/remove/erase Rosetta2 and reinstall it from scratch. Is that right?

And is there a way to know what's in these 4 weird menuffy.aot files? My search tool can tell me some info on them (94KB to 98KB, each file), their creation date (about the time of installation of menuffy), and their owner: _oahd. And yet, the app is supposed to be native on Silicon Macs (menuffy is an universal app), so I don't understand why Rosetta2 was involved in this.

So what to think of all this?

 

[fisherking]

they can't do anything without the app. and if you google it, there is a way to remove rosetta (i did this on my air, after trying a rosetta app, deleting that, then moving fully into the silicon era). sorry, don't remember where i found instructions, but it's do-able.

meanwhile, i wouldn't worry about those files (but that's just me). i also use 'find any file' to remove detritus when i uninstall an app, so i get the desire to do that...

 

[Cham2000]

Yes, Find Any File seems to be very good. It apparently can find any file anywhere

But I'm still wondering about the pesky menuffy files that can't be erased. I'm very paranoid about them. And what are this aot file extension? What the Hell is this!?? The web isn't clear about it.

 

[fisherking]

have you tried rebooting, disabling SIP? then remove those files, reboot again and re-enable SIP...

 

[Cham2000]

have you tried rebooting, disabling SIP? then remove those files, reboot again and re-enable SIP...

Nope. I don't know how to do that, and I don't want to brake something, and having to reinstall the whole OS.

 

[Nermal]

Something doesn't quite add up here. I get the same behaviour as you in that I can't even view /private/var/db/oah even when root. So how do you know there are extra files in there in the first place? How could Find Any File possibly "see" inside that directory if it doesn't allow viewing?

 

[Cham2000]

Something doesn't quite add up here. I get the same behaviour as you in that I can't even view /private/var/db/oah even when root. So how do you know there are extra files in there in the first place? How could Find Any File possibly "see" inside that directory if it doesn't allow viewing?

Well, it's apparently the magic of this app (Find Any File = FAF). When I use it to search all files with the name "menuffy" in it (after I trashed the useless app), it found 4 files in that directory. FAF gives the whole exact path, and can get info on them. But using sudo in the console, we're unable to view what's inside the directory, and even the directory size doesn't match the info from FAF. According to the Finder, the directory is empty. It's not true!

Since the menuffy isn't a malware, I suggest you do the exercice. Install it (link given in my first message above), run it just to see what it's doing (it's very simple, the interface is very simplistic), then trash it. Then, use FAF to find all the "menuffy" files. You'll find just a few preferences files, that could be trashed directly from FAF, and you should also get these 4 untrashable files from Rosetta2.

EDIT: About the aot file extension, some info there. It's about Rosetta2: https://ffri.github.io/ProjectChampollion/part1/

Some info extract:

The file with the extension .aot contains the result of the translation from x86_64 to arm64. We refer to this file as the AOT file. The name .aot comes from Ahead-Of-Time, which means that the translation is performed before a thread actually starts. The oahd is the management daemon for the AOT files.

 

[fisherking]

Something doesn't quite add up here. I get the same behaviour as you in that I can't even view /private/var/db/oah even when root. So how do you know there are extra files in there in the first place? How could Find Any File possibly "see" inside that directory if it doesn't allow viewing?

find any file, in my experience, finds everything...

Nope. I don't know how to do that, and I don't want to brake something, and having to reinstall the whole OS.

then let it go. it's like you have a stove knob but no stove. if you don't want to try the SIP thing, there's probably nothing else to do

 

[Cham2000]

From the previous link (about Rosetta2):

Note that the folders and files under /var/db/oah are protected by SIP, so we cannot access even with admin privileges. After disabling SIP, we can access these folders and files with admin privileges.

So it appears there's a (risky?) way in erasing the pesky menuffy files. Does disabling SIP necessitate a restart?

Also, from that link, the invisible untrashable menuffy files were made by Rosetta2, when it was running an Intel code inside the menuffy app. At least, it's my interpretation of the presence of these files...

 

[Nermal]

The file with the extension .aot contains the result of the translation from x86_64 to arm64. We refer to this file as the AOT file. The name .aot comes from Ahead-Of-Time, which means that the translation is performed before a thread actually starts. The oahd is the management daemon for the AOT files.

That explains a bit. It seems that menuffy is an Intel app, so Rosetta has created an Arm version and has cached it into that directory. It's therefore the OS itself that created the files, which explains how they got in there in the first place.

I probably wouldn't worry about the files. I don't know whether there are any smarts behind Rosetta; it may eventually realise that the app's gone and will delete the files, or maybe they'll hang around forever. The actual code is typically a tiny fraction of an app's total size, so they're unlikely to be eating into your storage space.

 

[fisherking]

From the previous link (about Rosetta2):

Note that the folders and files under /var/db/oah are protected by SIP, so we cannot access even with admin privileges. After disabling SIP, we can access these folders and files with admin privileges.

So it appears there's a (risky?) way in erasing the pesky menuffy files. Does disabling SIP necessitate a restart?

you can google it, but you reboot into recovery, open the terminal there, and type in csrutil disable; put in your password, then type reboot. then you remove the files you want to remove, reboot again into recovery, and type csrutil enable in terminal, reboot again. and life goes on (google this tho!)

if you're uncomfortable with it, don't do it. again, those files are unattached to their app, which you've deleted, so they don't do anything. and there's LOTS of hidden files on our macs.

 

[Cham2000]

you can google it, but you reboot into recovery, open the terminal there, and type in csrutil disable; put in your password, then type reboot. then you remove the files you want to remove, reboot again into recovery, and type csrutil enable in terminal, reboot again. and life goes on (google this tho!)

if you're uncomfortable with it, don't do it. again, those files are unattached to their app, which you've deleted, so they don't do anything. and there's LOTS of hidden files on our macs.

Thanks. I'm tempted to try this, despite some risks. And according to the previous article, Rosetta2 will recreate new files if the older ones were trashed/erased, and if Rosetta2 do needs the files again. I feel the risk is low, except maybe at the SIP disabling/enable back parts...

 

[Cham2000]

Interesting!! Using Find Any File, search for any file with ".aot" in its name. You'll find tons of hidden files inside the private/var/bd/oah directory, even from apps that are supposed to be "universal" (not all of them, though). I found lots of files from apps and old screensavers I deleted some times ago.

So if I really wanted to erase my "pesky" menuffy files, then I should also do the same for all the other files from erased apps (and even old screensavers that I trashed). I'm wondering if I empty the full directories inside the oah folder would cause any issue at all, since (I think) Rosetta2 would recreate the needed files, if I trash everything.

And it's a pity that the Finder says that the oah directory is empty (it says 0 bytes in there!), while in fact it isn't empty at all, according to the search in FAF.

 

[idmean]

You seem to have developed some kind of obsession with these files. Clearly, they were created by the operating system and you are not supposed to delete them. Just leave it alone.

 

[xiiiblvck]

Bruh, are you getting a commission every time you mention “Find Any File”?

 

[fisherking]

i too think you should let it go; don't mess with these files, just use your mac. what's the actual issue at this point?

 

[bogdanw]

Folders & files created after starting menuffy


With SIP disabled, they can be deleted from Finder or Terminal

Apple Developer Documentation - Disabling and Enabling System Integrity Protection
https://developer.apple.com/documen...ling_and_enabling_system_integrity_protection

 

[Cham2000]

I'm now just wondering about all these useless files created by Rosetta2, for apps and screensavers that don't even exist anymore on the SSD. All these files are taking some space for nothing (I can't tell how much). Can we safely erase them?

This is a good example of all the garbage that accumulates over time on our SSD, despite some cleaning we could do at the "normal use" level.

 

[MacProFCP]

Today, I made a "small" mistake by installing an app that I didn't liked: menuffy (from this place: https://zaru.github.io/menuffy/index_en.html). After trashing it, I searched for all the files that were created by this app, using a good search tool (Find Any File, which is pretty good). I then found four files called menuffy.aot (about 95KB each), inside some directories with large numbers in their name, which are located in the /private/var/db/oah directory. The /private/var/db/oah directory isn't accessible by the admin user (the owner is called "_oahd"), and was apparently created by Rosetta2 (according to what I found on the Web). This part is sealed by Apple.

So I'm unable to remove the four menuffy.aot files (even with the sudo command in the Terminal). This is apparently a sealed part of the OS, to protect against "Bad Actor" Software. But then, how the app menuffy could have created these files there? I guess it's - apparently - the OS itself that made them, so it's probably not the app itself (??).

AFAIK, there isn't any possibility to uninstall/remove/erase Rosetta2 and reinstall it from scratch. Is that right?

And is there a way to know what's in these 4 weird menuffy.aot files? My search tool can tell me some info on them (94KB to 98KB, each file), their creation date (about the time of installation of menuffy), and their owner: _oahd. And yet, the app is supposed to be native on Silicon Macs (menuffy is an universal app), so I don't understand why Rosetta2 was involved in this.

So what to think of all this?

Try booting in Target Disc Mode and deleting it from another machine.

Or boot from another drive and again delete when it’s not bootable.

Lastly, you should be able to boot into Options and turn off the security settings to allow for root changes.

 

[Cham2000]

Lastly, you should be able to boot into Options and turn off the security settings to allow for root changes.

Thanks. I now understand what's going on with the menuffy.aot files, and I know exactly what to do if I really want to erase the files. But I'm not sure it's really worth the time and trouble to do it.

I have a total of 656 .aot files, for about 1GB (more or less) in total. Strangely, all of them were created during the last two weeks, while Rosetta2 is in use since almost 2 months now.

EDIT: Here's a page that shows how badly Rosetta could trash your SSD with garbage, as time passes...

How can I limit the disk usage of the Rosetta 2 oah cache?

On macOS 11, Rosetta2 apparently caches translated programs and shared libraries under /var/db/oah. On an M1-based CI instance where we are testing per-commit-novel x86_64 binaries under Rosetta2, ...

apple.stackexchange.com

 

[Mr. Awesome]

Something doesn't quite add up here. I get the same behaviour as you in that I can't even view /private/var/db/oah even when root. So how do you know there are extra files in there in the first place? How could Find Any File possibly "see" inside that directory if it doesn't allow viewing?

It may be that it's using Spotlight indexes or something like that that somehow can see inside the directory.

 

[fisherking]

find any file can't get in to the oah folder. but this is weird; i went to look at that folder in the finder, and i get this exciting animation... 🤔 anyway, am going back to my life, and not stressing about minutiae...

 

[svenmany]

I just noticed that I can look inside that folder in my Time Machine backups. That won't help in deleting things, but it is informative.

 

[svenmany]

stressing about minutiae...

It's also unimportant for me. However...

Now that I can see the directories in Time Machine, I can do a Finder "Get Info" on the oah folder. It reports that the oah folder is consuming 2.7 GB on disk. Over time, as I try various programs, it will grow. I'm going to keep an eye on it and see if it gets much worse.

I suspect all of "aot" stuff in there can be deleted. I think "aot" means "ahead of time" compilation. Maybe when an Intel app is launched, the OS inspects it and compiles the various libraries used into versions which bridge to the ARM APIs, but only if missing from the oah cache.

Interesting stuff, but I'm definitely not going to touch it unless it grows too much.

 

[fisherking]

It's also unimportant for me. However...

Now that I can see the directories in Time Machine, I can do a Finder "Get Info" on the oah folder. It reports that the oah folder is consuming 2.7 GB on disk. Over time, as I try various programs, it will grow. I'm going to keep an eye on it and see if it gets much worse.

I suspect all of "aot" stuff in there can be deleted. I think "aot" means "ahead of time" compilation. Maybe when an Intel app is launched, the OS inspects it and compiles the various libraries used into versions which bridge to the ARM APIs, but only if missing from the oah cache.

Interesting stuff, but I'm definitely not going to touch it unless it grows too much.

interesting. mine is zero bytes (on both my macs). my mini has rosetta, the air doesn't. am not running any intel apps on either mac (but needed rosetta2 for some installers...). hmm