Skip to main content
Solved

MacBook Air disks running full outside user available partitions

  • January 20, 2023
  • 9 replies
  • 38 views
EXP_SimonF
Forum|alt.badge.img+3

We recently purchased 3 x M2 Macbook Airs with 256GB of storage. They were installed and has been used by a single user on each machine between November 11th and December 1st.

Within the last couple of days all 3 users have complained about disks running full. Neither user has large files, the one with the most data uses ~40Gb in total (*including* applications!). I have tried running both CleanMyMacX (yuck!) as well as Grand Perspective. Both apps show ~40GB storage used, and the rest is "invisible". 

We are running Jamf Cloud and Jamf Connect on all machines.

 

Disk Utility shows no APFS Snapshots.

All of them are running macOS 13.0.1 and neither user has enough available space to update to macOS til 13.1.

 

What to do? I seem to be looking at 3 reinstalls, but I would REALLY like to avoid this option :-)

Best answer by mm2270

Check to make sure there is no policy that's stuck, or a recon job. I had a similar experience about a year and a half back now where I had MacBook Pros with 1TB drives that were inexplicably filling up. In troubleshooting it, I found it was due to a policy stuck in a running state that was causing a Jamf temp file to rapidly fill up.

If I recall, the temp file was in /Library/Application\\ Support/JAMF/tmp/, but might be in some other location. I would, if you can, open a sudo shell on one of the affected Macs and run a
du -hs /Library/Application\\ Support/JAMF
on it, to see what it comes back with for the space being used on that directory. If it looks abnormally large, then that might be the cause.

    9 replies

    jamf-42
    Forum|alt.badge.img+17
    • jamf-42
    • Esteemed Contributor
    • 744 replies
    • January 20, 2023

    you might be able to clear some using https://titanium-software.fr/en/onyx.html

    mm2270
    Forum|alt.badge.img+24
    • mm2270
    • Legendary Contributor
    • 7886 replies
    • Answer
    • January 20, 2023

    Check to make sure there is no policy that's stuck, or a recon job. I had a similar experience about a year and a half back now where I had MacBook Pros with 1TB drives that were inexplicably filling up. In troubleshooting it, I found it was due to a policy stuck in a running state that was causing a Jamf temp file to rapidly fill up.

    If I recall, the temp file was in /Library/Application\\ Support/JAMF/tmp/, but might be in some other location. I would, if you can, open a sudo shell on one of the affected Macs and run a
    du -hs /Library/Application\\ Support/JAMF
    on it, to see what it comes back with for the space being used on that directory. If it looks abnormally large, then that might be the cause.

    junjishimazaki
    Forum|alt.badge.img+10
    • junjishimazaki
    • New Contributor
    • 423 replies
    • January 20, 2023

    Hi, on one of those macs. Go to About this Mac-->More Info, then scroll down to the Storage section. Select Storage Settings. That also breaks down what is taking up space. 

    M
    Forum|alt.badge.img+12
    • mschroder
    • Valued Contributor
    • 359 replies
    • January 20, 2023

    Check if Mail logging is enabled on these Macs. Mail logs will get VERY BIG, and they don't show up as used space, since nobody has the permissions to see them. I had a case like this, took me quite some time to find the culprit.

    M
    Forum|alt.badge.img+1
    • mikelaundrie
    • New Contributor
    • 3 replies
    • January 21, 2023

    I recommend using OmniDiskSweeper as root to see where the storage is being used.  

    To run it as root, open Terminal and run sudo /Applications/OmniDiskSweeper.app/Contents/MacOS/OmniDiskSweeper

     

    EXP_SimonF
    Forum|alt.badge.img+3
    • EXP_SimonF
    • Author
    • New Contributor
    • 5 replies
    • January 23, 2023

    Thanx a bunch!

    What Grand Perspective couldn't see, OmniDiskSweeper showed me in 30 seconds. And Grand Perspective was even originally launched from terminal with sudo as you suggest doing with OmniDiskSweeper.

    Frankly I am a bit miffed this worked :-)

    And it was Jamf all along - the folder in /Library/Application Support/JAMF/tmp was 180Gb+.

    Still convinced it is a bug relating to macOS 13.0.1, but we'll see in the coming weeks if it fills up again...

    mm2270
    Forum|alt.badge.img+24
    • mm2270
    • Legendary Contributor
    • 7886 replies
    • January 23, 2023

    Thanx a bunch!

    What Grand Perspective couldn't see, OmniDiskSweeper showed me in 30 seconds. And Grand Perspective was even originally launched from terminal with sudo as you suggest doing with OmniDiskSweeper.

    Frankly I am a bit miffed this worked :-)

    And it was Jamf all along - the folder in /Library/Application Support/JAMF/tmp was 180Gb+.

    Still convinced it is a bug relating to macOS 13.0.1, but we'll see in the coming weeks if it fills up again...


    I told ya the JAMF tmp folder might be the cause. 

    I would not however just chalk it up to an OS bug. Check your policy logs for the affected machines, both from the Jamf Pro console and from the Macs themselves. I’m betting there’s some rogue policy that hasn’t exited on them that’s the cause. It might be a script prompting for user input at the shell level that’s never coming. That’s what it was for me. 

    EXP_SimonF
    Forum|alt.badge.img+3
    • EXP_SimonF
    • Author
    • New Contributor
    • 5 replies
    • January 23, 2023

    I told ya the JAMF tmp folder might be the cause. 

    I would not however just chalk it up to an OS bug. Check your policy logs for the affected machines, both from the Jamf Pro console and from the Macs themselves. I’m betting there’s some rogue policy that hasn’t exited on them that’s the cause. It might be a script prompting for user input at the shell level that’s never coming. That’s what it was for me. 


    Thanx, you were right, but even when looking in Jamf, nothing seems out of the ordinary. There is nothing pending, no more than 132 entries in the most busy of the logs, so it has to be something gone awry locally. And only on those 3 machines.

    I will look into the local files on the 2 other machines (since I've already deleted the .tmp files on the one cured today)...

    And to be precise, I am not necessarily blaming macOS itself, I just think it's JAMF in conjunction with macOS 13.0.1 Ventura that's getting us into trouble. We have several machines running 13.0 and a couple running 13.1, but the only machines with huge tmp-directories are running 13.0.1.

    We'll see if the problem persists if I only empty the directories and continue :-)

    mm2270
    Forum|alt.badge.img+24
    • mm2270
    • Legendary Contributor
    • 7886 replies
    • January 23, 2023

    Thanx, you were right, but even when looking in Jamf, nothing seems out of the ordinary. There is nothing pending, no more than 132 entries in the most busy of the logs, so it has to be something gone awry locally. And only on those 3 machines.

    I will look into the local files on the 2 other machines (since I've already deleted the .tmp files on the one cured today)...

    And to be precise, I am not necessarily blaming macOS itself, I just think it's JAMF in conjunction with macOS 13.0.1 Ventura that's getting us into trouble. We have several machines running 13.0 and a couple running 13.1, but the only machines with huge tmp-directories are running 13.0.1.

    We'll see if the problem persists if I only empty the directories and continue :-)


    Ok, good luck in tracking down the root cause. It sounds like it's being a bit elusive.

    In terms of it possibly being a combination of Jamf and macOS Ventura, it's definitely possible. Are you using an on-prem Jamf Pro, or is it cloud hosted?


    Terms & ConditionsCookie settingsAccessibility statement