Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Sneaky downloads? 22Gb lost!

Sciuriware

Sciuriware

macrumors 6502a
Original poster
Jan 4, 2014
779
166
Gelderland
Hi all,

yesterday evening I noticed high activity on my UTP hub between Internet
and my Mac Studio. The Activity Monitor showed full speed downloads to a process
by the name 'nsurlsessiond'. The process stopped at ±9Gb and then restarted again
a few times. Afterwards the total received data at the bottom showed some 22Gb.

Meanwhile I found that my free space had dropped by the same amount.
(there was no other activity on the system, even not mine)
I scanned the disk for files larger than 9Gb only to find my own files.

My Mac Studio still runs MacOS 12.6.8, while 'Software Update' invites me to
upgrade to 13.5.1 which would download ±12Gb. For a moment I thought that APPLE
was secretly preloading Ventura but the amount of data involved does not match.

Finally: I do NOT have ANY subscription service other than MacOS automatic updates.
If this phenomenon has anything to do with preloading of upgrades,
I would fear for people with smaller disks than mine (2Tb).
Anyone?
;JOOP!
 
Sciuriware said:
I don't have iCloud; never had either.
;JOOP!
Click to expand...
Surprise: running Disk Utility First Aid seems to reveal a preloaded system update.
Am I the only one?
Screenshot 2023-08-30 at 10.31.38.png

;JOOP!
 
I'm not sure, but I think that's just the reference to what version you're running.

I found it on mine, and it's listed as only a snapshot, and when searching for it in Finder, it doesn't exist.
 
skottichan said:
I'm not sure, but I think that's just the reference to what version you're running.

I found it on mine, and it's listed as only a snapshot, and when searching for it in Finder, it doesn't exist.
Click to expand...
Finder will NEVER find virtual volumes; example: double click an .dmg
It will expand, mount, show up in the left column, but you will never find it anywhere on the system (-disk).

Still, my 22Gb are gone .....
;JOOP!
 
skottichan said:
Here, this may help?

View APFS snapshots in Disk Utility on Mac

In Disk Utility on Mac, view a list of APFS snapshots, copy information about the snapshots, and delete them.
support.apple.com
Click to expand...
I read it and more stuff on the Internet:
1) that's NOT the cause of 22Gb space loss,
2) keep off those snapshots.

Note: when I 'go' to System Preferences it 'invites' me to set up iCloud:
so, indeed, I do NOT have iCloud.
;JOOP!
 
Check for a large "Install blah" app in /Applications. Monterey has done this to me a few times.

If you are savvy with the command line, then ncdu is my preferred tool for locating random large files.
 
auxbuss said:
Check for a large "Install blah" app in /Applications. Monterey has done this to me a few times.

If you are savvy with the command line, then ncdu is my preferred tool for locating random large files.
Click to expand...
On this system there is no file larger than (say) 8Gb in|under /Applications or /System/Applications.
Besides, I had the system already screened for large files.
I do not need 'ncdu' : I wrote my own file manager tool.
Thanks anyway.
;JOOP!
 
Check the mountpoint /System/Volumes/Data as that contains all the data that was added after the installation of MacOS, these are now separated from the OS. That's where the "Macintosh HD - Data" volume that you see in Disk Utility is mounted at.

You can't use Finder as that blends the OS files and the rest together, you can use ls -alh in Terminal. All the later installed apps, all the user folders, all the OS preferences, and OS updates, it all gets stored somewhere there.

The update snapshot can indeed exist on a system that was previously updated and won't indicate that an update has been downloaded. AFAIK the snapshot is only added after an update was already installed.

While nsurlsessiond is running and downloading you can use Activity Monitor to inspect the files it has open but that won't work afterwards.

The process is used for everything OS related, so as was mentioned iCloud, as well as OS updates, Safari downloads, whatever is part of MacOS or uses OS-built-in services to handle networking could potentially use it. Apple's streaming services might use it too.

From what I can see it stores some of its data somewhere in the endless voids of /private/var/folders/. For me though the network IO in Activity Monitor is at 0 bytes after a week of uptime (I do not use iCloud or any Apple services either).
 
okkibs said:
Check the mountpoint /System/Volumes/Data as that contains all the data that was added after the installation of MacOS, these are now separated from the OS. That's where the "Macintosh HD - Data" volume that you see in Disk Utility is mounted at.

You can't use Finder as that blends the OS files and the rest together, you can use ls -alh in Terminal. All the later installed apps, all the user folders, all the OS preferences, and OS updates, it all gets stored somewhere there.

The update snapshot can indeed exist on a system that was previously updated and won't indicate that an update has been downloaded. AFAIK the snapshot is only added after an update was already installed.

While nsurlsessiond is running and downloading you can use Activity Monitor to inspect the files it has open but that won't work afterwards.

The process is used for everything OS related, so as was mentioned iCloud, as well as OS updates, Safari downloads, whatever is part of MacOS or uses OS-built-in services to handle networking could potentially use it. Apple's streaming services might use it too.

From what I can see it stores some of its data somewhere in the endless voids of /private/var/folders/. For me though the network IO in Activity Monitor is at 0 bytes after a week of uptime (I do not use iCloud or any Apple services either).
Click to expand...
I'm familiar with the 'modern' MacOS structure.
I use Finder ONLY to install/update applications from *.dmg files. F.e. Finder cannot see .* files.
Using Terminal (in fact some of the shell's) can be clumsy. So, I wrote a file manager ~Windows Commander.
I think that nsurlsessiond has done some updating: the App Store / Updates section is very terse nowadays;
- I keep records of some items, so I found that iMovie has been updated to 10.3.8, but only to a size of 4Gb.
Most likely some other stuff that I'm not aware of has been updated to the cost of those other 18Gb.
I can live with the idea that APPLE does not announce each and every update; if only the Russians, the Chinese
and the North Koreans keep out of my system.
I was confused, because it was about time for the monthly Monterey update, but it's still not here.
Thanks anyway for your contribution.
;JOOP!
 
You use programs such as DaisyDisk and GrandPerspective to figure out which files are using your disk space.
 
HDFan said:
You use programs such as DaisyDisk and GrandPerspective to figure out which files are using your disk space.
Click to expand...
Scanning with my own tools and comparing to backups must be enough.
Surely the 22Gb is buried in the system partition: invisible.
;JOOP!
 
dsemf said:
If you go to System Settings, do you have a pending update?

DS
Click to expand...
No, and I know it's about time for an update.

I reviewed my latest CCC backup and found only 12Gb of transfers that agree with what I changed myself on disk.
So, definitively, those 22Gb are hidden in the system partition.

Let's close the case.
;JOOP!
 
OP:

Here's how to find what's "hidden" on your drive:
Download DiskWave from here:
It's small in size and free.

Open DiskWave and go to the preferences.
Put a checkmark in "show invisible files".
Close preferences.

The DiskWave window shows you all your volumes and drives in plain English (no ridiculous graphical formats).
Click on any item "on the left".
Give DW a moment to scan and digest things.
Now, you'll see what's ON the volume, listed in order of "largest to smallest".
You can easily locate what's eating up your space.
 
Fishrrman said:
OP:

Here's how to find what's "hidden" on your drive:
Download DiskWave from here:
It's small in size and free.

Open DiskWave and go to the preferences.
Put a checkmark in "show invisible files".
Close preferences.

The DiskWave window shows you all your volumes and drives in plain English (no ridiculous graphical formats).
Click on any item "on the left".
Give DW a moment to scan and digest things.
Now, you'll see what's ON the volume, listed in order of "largest to smallest".
You can easily locate what's eating up your space.
Click to expand...
Interesting.
 
Fishrrman said:
OP:

Here's how to find what's "hidden" on your drive:
Download DiskWave from here:
It's small in size and free.

Open DiskWave and go to the preferences.
Put a checkmark in "show invisible files".
Close preferences.

The DiskWave window shows you all your volumes and drives in plain English (no ridiculous graphical formats).
Click on any item "on the left".
Give DW a moment to scan and digest things.
Now, you'll see what's ON the volume, listed in order of "largest to smallest".
You can easily locate what's eating up your space.
Click to expand...
Funny application, but:
1) seems to be written for Maverics,
2) did not reveal anything I could not see by my own filemanager (written in JAVA 20).
Thanks anyway.
;JOOP!
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back