Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

rkieru

macrumors member
Original poster
Jun 10, 2015
65
88
I've found a host of articles outlining this issue on older versions of the desktop operating system, but nothing about addressing it on macOS. I have a 500gb SSD in my 2014 Retina 5k iMac (macOS v10.13.6) and the system thinks that there is only 126 GB available.
storage-overview.png
More accurately; the OS reports that "System" is using over 300 GB of my total storage. It seems to like to jump between 310 and 350 GB for no discernible reason. I cannot imagine what backlog of temporary files would result in the OS reporting that large of a difference...

And in terms of user-added files (apps, documents, books, stuff in iTunes, my mail and messages, photos, etc) I've only got ~58 GB of files. How on earth is "System" accounting for so much and is there any way to address it in macOS?

Older articles suggested resetting NVRAM / SMC which I've done, or forcing Spotlight to reindex files (also completed)
 
So here is a fun follow-up mystery.

I had 10 snapshots from the last 24 hours. I have deleted them all and verified that I now have zero snapshots.

System has increased from using 310GB to... 317GB.

(There is nothing in the trash).
 
So here is a fun follow-up mystery.

I had 10 snapshots from the last 24 hours. I have deleted them all and verified that I now have zero snapshots.

System has increased from using 310GB to... 317GB.

(There is nothing in the trash).
Try rebooting then check again.

If it is still off, run the command below in Terminal and tell us what is says. Give it a couple minutes to finish. It will show all the base folders size in GB, including hidden and system folders.

Code:
sudo du -d 1 -x -c -g /
 
After restarting it reported that 'System" takes up 321.39 GB so again somehow it went up. By the time I had completed running the suggested terminal command "System" had reduced to 310.55 GB. Below is the dump from the Terminal Command...

I see a few errors related to Time Machine but I'm not sure how to interpret them, or the ones related to /private/var/

Code:
0    /.HFS+ Private Directory Data
1    /home
1    /usr
1    /.Spotlight-V100
1    /net
0    /.PKInstallSandboxManager-SystemSoftware
1    /bin
0    /Network
1    /sbin
5    /Library
0    /.Trashes
16    /System
1    /.fseventsd
du: /private/var/db/ConfigurationProfiles/Store: Operation not permitted
du: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k/0/com.apple.nsurlsessiond: Operation not permitted
du: /private/var/folders/qv/k3550p2d3nvg7dmzjvz3wqp00000gn/0/SafariFamily: Operation not permitted
du: /private/var/folders/qv/k3550p2d3nvg7dmzjvz3wqp00000gn/0/com.apple.LaunchServices.dv: Operation not permitted
du: /private/var/folders/qv/k3550p2d3nvg7dmzjvz3wqp00000gn/0/com.apple.nsurlsessiond: Operation not permitted
du: /private/var/folders/qv/k3550p2d3nvg7dmzjvz3wqp00000gn/0/com.apple.routined: Operation not permitted
5    /private
1    /.DocumentRevisions-V100
0    /.vol
55    /Users
41    /Applications
1    /opt
1    /dev
du: /Volumes/Time Machine Backups/Backups.backupdb/rkieru/2017-10-04-014537/Macintosh HD/private/var/db/ConfigurationProfiles/Store: Operation not permitted
du: /Volumes/Time Machine Backups/Backups.backupdb/rkieru/2017-10-04-014537/Macintosh HD/private/var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k/0/com.apple.nsurlsessiond: Operation not permitted
du: /Volumes/Time Machine Backups/Backups.backupdb/rkieru/2017-10-04-014537/Macintosh HD/private/var/folders/qv/k3550p2d3nvg7dmzjvz3wqp00000gn/0/SafariFamily: Operation not permitted
du: /Volumes/Time Machine Backups/Backups.backupdb/rkieru/2017-10-04-014537/Macintosh HD/private/var/folders/qv/k3550p2d3nvg7dmzjvz3wqp00000gn/0/com.apple.LaunchServices.dv: Operation not permitted
du: /Volumes/Time Machine Backups/Backups.backupdb/rkieru/2017-10-04-014537/Macintosh HD/private/var/folders/qv/k3550p2d3nvg7dmzjvz3wqp00000gn/0/com.apple.nsurlsessiond: Operation not permitted
du: /Volumes/Time Machine Backups/Backups.backupdb/rkieru/2017-10-04-014537/Macintosh HD/private/var/folders/qv/k3550p2d3nvg7dmzjvz3wqp00000gn/0/com.apple.routined: Operation not permitted
du: /Volumes/Time Machine Backups 1/Backups.backupdb/rkieru/2018-03-07-015141/Macintosh HD/private/var/db/ConfigurationProfiles/Store: Operation not permitted
du: /Volumes/Time Machine Backups 1/Backups.backupdb/rkieru/2018-03-07-015141/Macintosh HD/private/var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k/0/com.apple.nsurlsessiond: Operation not permitted
du: /Volumes/Time Machine Backups 1/Backups.backupdb/rkieru/2018-03-07-015141/Macintosh HD/private/var/folders/qv/k3550p2d3nvg7dmzjvz3wqp00000gn/0/SafariFamily: Operation not permitted
du: /Volumes/Time Machine Backups 1/Backups.backupdb/rkieru/2018-03-07-015141/Macintosh HD/private/var/folders/qv/k3550p2d3nvg7dmzjvz3wqp00000gn/0/com.apple.LaunchServices.dv: Operation not permitted
du: /Volumes/Time Machine Backups 1/Backups.backupdb/rkieru/2018-03-07-015141/Macintosh HD/private/var/folders/qv/k3550p2d3nvg7dmzjvz3wqp00000gn/0/com.apple.nsurlsessiond: Operation not permitted
du: /Volumes/Time Machine Backups 1/Backups.backupdb/rkieru/2018-03-07-015141/Macintosh HD/private/var/folders/qv/k3550p2d3nvg7dmzjvz3wqp00000gn/0/com.apple.routined: Operation not permitted
225    /Volumes
0    /cores
346    /
346    total
 
du: /Volumes/Time Machine Backups/Backups.backupdb/rkieru/2017-10-04
The /private/var/ errors are normal, bu something is really odd there with that
Time Machine Backups folder. It almost looks like you somehow either copied or made a TM backup in that local folder instead of the external drive.

Detach all external disks then run the command again to see if that TM data is still there.
 
I've done as you asked and re-run the terminal command and gotten exactly the same results (So I won't re-paste them here and waste space). I'm not sure if any of the following matters about my setup but I thought I'd be thorough.
  • My external drive is excluded from Time Machine's backup via the Time Machine preferences panel.
  • The actual Time Machine drive is part of an AirPort Time Capsule 802.11ac.
EDIT: I forgot to add also that the Time Capsule is used to backup both my computer and my spouse's laptop, though I don't think the latter has been backed up in the past 30 days.
 
Just to clarify - your recommendation is to delete:
  • /Volumes/Time Machine Backups
  • /Volumes/Time Machine Backups 1
Is that right? I don't mind completely wiping my Time Machine and starting again if it resolves the issue - just want to figure out if that's what I'm supposed to take away from that link and your follow-up text regarding deleting the folder.

If I'm reading my Terminal readout (ran sudo du -d 1 -x -c -g /Volumes) then the first is 116 GB and the latter is 109 GB.
 
Is that right?

Yes... just make sure all external drives, including the networked TM drive are disconnected when you do this so you do not accidentally delete the wrong thing.

I don't mind completely wiping my Time Machine and starting again if it resolves the issue...

Assuming your TM backups are working okay, deleting these folders should not result in you having to start again with TM backups. They should still be in the networked TC drive.
 
System is now reporting a much more sensible 67 GB. That's a rather dramatic reduction!
 
  • Like
Reactions: Weaselboy
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.