MacBook Air disks running full outside user available partitions

[EXP_SimonF]

We recently purchased 3 x M2 Macbook Airs with 256GB of storage. They were installed and has been used by a single user on each machine between November 11th and December 1st.

Within the last couple of days all 3 users have complained about disks running full. Neither user has large files, the one with the most data uses ~40Gb in total (*including* applications!). I have tried running both CleanMyMacX (yuck!) as well as Grand Perspective. Both apps show ~40GB storage used, and the rest is "invisible". 

We are running Jamf Cloud and Jamf Connect on all machines.

Disk Utility shows no APFS Snapshots.

All of them are running macOS 13.0.1 and neither user has enough available space to update to macOS til 13.1.

What to do? I seem to be looking at 3 reinstalls, but I would REALLY like to avoid this option :-)

[mm2270 · Accepted solution]

Check to make sure there is no policy that's stuck, or a recon job. I had a similar experience about a year and a half back now where I had MacBook Pros with 1TB drives that were inexplicably filling up. In troubleshooting it, I found it was due to a policy stuck in a running state that was causing a Jamf temp file to rapidly fill up.

If I recall, the temp file was in /Library/Application\ Support/JAMF/tmp/, but might be in some other location. I would, if you can, open a sudo shell on one of the affected Macs and run a
du -hs /Library/Application\ Support/JAMF
on it, to see what it comes back with for the space being used on that directory. If it looks abnormally large, then that might be the cause.

[jamf-42]

you might be able to clear some using https://titanium-software.fr/en/onyx.html

[mm2270 · Accepted solution]

Check to make sure there is no policy that's stuck, or a recon job. I had a similar experience about a year and a half back now where I had MacBook Pros with 1TB drives that were inexplicably filling up. In troubleshooting it, I found it was due to a policy stuck in a running state that was causing a Jamf temp file to rapidly fill up.

If I recall, the temp file was in /Library/Application\ Support/JAMF/tmp/, but might be in some other location. I would, if you can, open a sudo shell on one of the affected Macs and run a
du -hs /Library/Application\ Support/JAMF
on it, to see what it comes back with for the space being used on that directory. If it looks abnormally large, then that might be the cause.

[junjishimazaki]

Hi, on one of those macs. Go to About this Mac-->More Info, then scroll down to the Storage section. Select Storage Settings. That also breaks down what is taking up space. 

[mschroder]

Check if Mail logging is enabled on these Macs. Mail logs will get VERY BIG, and they don't show up as used space, since nobody has the permissions to see them. I had a case like this, took me quite some time to find the culprit.

[mikelaundrie · Accepted solution]

I recommend using OmniDiskSweeper as root to see where the storage is being used.  

To run it as root, open Terminal and run sudo /Applications/OmniDiskSweeper.app/Contents/MacOS/OmniDiskSweeper

[EXP_SimonF]

Thanx a bunch!

What Grand Perspective couldn't see, OmniDiskSweeper showed me in 30 seconds. And Grand Perspective was even originally launched from terminal with sudo as you suggest doing with OmniDiskSweeper.

Frankly I am a bit miffed this worked :-)

And it was Jamf all along - the folder in /Library/Application Support/JAMF/tmp was 180Gb+.

Still convinced it is a bug relating to macOS 13.0.1, but we'll see in the coming weeks if it fills up again...

[mm2270]

I told ya the JAMF tmp folder might be the cause. 

I would not however just chalk it up to an OS bug. Check your policy logs for the affected machines, both from the Jamf Pro console and from the Macs themselves. I’m betting there’s some rogue policy that hasn’t exited on them that’s the cause. It might be a script prompting for user input at the shell level that’s never coming. That’s what it was for me. 

[EXP_SimonF]

Thanx, you were right, but even when looking in Jamf, nothing seems out of the ordinary. There is nothing pending, no more than 132 entries in the most busy of the logs, so it has to be something gone awry locally. And only on those 3 machines.

I will look into the local files on the 2 other machines (since I've already deleted the .tmp files on the one cured today)...

And to be precise, I am not necessarily blaming macOS itself, I just think it's JAMF in conjunction with macOS 13.0.1 Ventura that's getting us into trouble. We have several machines running 13.0 and a couple running 13.1, but the only machines with huge tmp-directories are running 13.0.1.

We'll see if the problem persists if I only empty the directories and continue :-)

[mm2270]

Ok, good luck in tracking down the root cause. It sounds like it's being a bit elusive.

In terms of it possibly being a combination of Jamf and macOS Ventura, it's definitely possible. Are you using an on-prem Jamf Pro, or is it cloud hosted?