Edmondo's Vault

Space Consumers - System

May 18, 20263 min read

Space Consumers — System

Swap files and sleep image — /private/var/vm/

The VM APFS volume is mounted at /private/var/vm/. It contains:

  • sleepimage — a hibernate dump of all RAM. Its size equals your total RAM. 32 GB RAM = 32 GB file. It is written when the system hibernates (not regular sleep). On a desktop Mac that never hibernates, it may still exist from a past hibernation.
  • swapfile0, swapfile1, etc. — active swap pages. Do not delete while system is running.
ls -lh /private/var/vm/
du -sh /private/var/vm/

The sleep image is safe to delete while the system is running (it’s not in use unless you’re currently in hibernation). It will regenerate on next hibernation.

To permanently prevent it from being recreated:

sudo pmset -a hibernatemode 0   # disable hibernation; system sleeps in RAM only
sudo rm /private/var/vm/sleepimage

Tradeoff: if power is lost during sleep, you lose unsaved work (same as Linux suspend-to-RAM).

Unified Log — /private/var/db/diagnostics/

This is the persistent storage for macOS’s Unified Logging system (logd). It is self-limiting by design — the Persist/ subdirectory caps at roughly 500 MB.

sudo du -sh /private/var/db/diagnostics/
sudo du -sh /private/var/db/diagnostics/*/  # breakdown by subdirectory

Subdirectories:

  • Persist/ — normal circular log store, ~500 MB cap. Expected.
  • Special/ — elevated-priority logs that bypass the cap. Can grow if a daemon is logging aggressively.
  • Signpost/ — performance tracing data. Can grow from instrumented apps.

If this is gigabytes, identify the noisy subsystem and quiet it rather than deleting files:

# Check what's generating the most log activity (requires sudo)
sudo log stats --overview

Do not delete unified log files directly

The Unified Log subsystem does not cope well with manual deletion. Use log CLI or wait for automatic rotation.

Core dumps — /cores/

macOS writes core dumps to /cores/ by default. Each dump can be as large as the process’s virtual address space (not RSS — virtual). An Electron app or JVM can easily produce a 4–8 GB core dump.

ls -lh /cores/
du -sh /cores/

Safe to delete entirely. No system function depends on them after the crash has been analyzed.

Crash reports

# Your crash reports
ls ~/Library/Logs/DiagnosticReports/
du -sh ~/Library/Logs/DiagnosticReports/
 
# System crash reports
sudo du -sh /Library/Logs/DiagnosticReports/

Small individually (a few MB each), but a repeatedly crashing daemon can generate hundreds. Safe to delete.

Spotlight index

sudo du -sh /System/Volumes/Data/.Spotlight-V100/

Typical range: 5–15 GB on a full developer machine. Safe to delete — Spotlight rebuilds automatically (will take time and CPU). To trigger a rebuild:

sudo mdutil -E /    # erase and rebuild index for root volume

ASL / system logs — /private/var/log/

sudo du -sh /private/var/log/

Usually 50–500 MB. Managed by aslmanager (Apple System Log manager — the legacy log rotation daemon). These are legacy logs; most modern Apple services use the Unified Log instead.

See also

Graph View

Backlinks