The directory /private/var/folders growing very large on lab stations

[denmoff]

i've created an EA script that reports the size of /private/var/folders. I'm seeing, on some lab stations, this directory is getting up to as much as 67GB. Most of the office Macs are under 2GB, which still seems high to me.

As i understand it, /private/var/folders/ is like some kind of icon cache. And the more users that login, the bigger it gets.

How are others dealing with this? I'm thinking of scripting the removal of this folder on a regular basis.

[rdwhitt · Accepted solution]

I ran into an issue on some of our high traffic student kiosk stations where the hard drives were constantly filling up and it was always the /private/var/folders that caused it. I have a smartgroup that will report when this group of machines get to be over 80% HDD Utilization. When that happens, an ongoing policy scoped to that group will run and delete the contents of that directory using:

rm -rf /private/var/folders/*

It's not particularly elegant, but it gets the job done on these stations.

-Rob

[denmoff]

Not loving the removal of the folder's contents as a solution, but it seems like the most effective way to go. Are there any side-effects to deleting the contents of that folder?

[#4]

The only side effects I can imagine are that the various system services that cache into /var/folders will consume system resources as they rebuild their various entries, such as IconServices. So you might see a brief slowdown, similar to the optimization that occurs after a system upgrade.

Rebooting into Safe Boot mode also removes those folders, allegedly.

[tep]

I have implemented a policy that executes "rm -rf /private/var/folders/*" on logout of our lab computers, and have gotten some reports of blank icons on the dock and in Finder. I assume this is because the icon cache isn't getting rebuilt before a new user logs in. Is there a better way to purge the contents?

[denmoff]

It's been recommended that the system be restarted after the rm. Maybe that would help and maybe reduce the policy frequency to once per week?

[Bobst]

I have seen the same problem and a restart has to be done. I would add a force reboot on the script you are running on log out. If anyone comes up with a better solution please feel free to share. We are seeing this on 10.9.X, MacBook Airs mostly.

[salrin_michael]

Deleting the entire contents of /private/var/folders/ will require a restart and erroneous issues such as printing (kudos to Bobst). Especially if a users is currently logged in. Plus enabling ongoing restarts on labs and laptop carts isn't exactly convenient. Yesterday I found a computer with 120GB in the respective folder. We are currently testing a script that runs and only deletes the previous day's cached folders in /private/var/folders/, thereby removing folders that are not currently in use. If a new user logs in, the tomorrow it will be removed. We are using a Launchd .plist that calls for the .sh the command, we are running the following command < find /private/var/folders/* -type d -mtime 1 -exec rm -r {} ; > Let us know if this command works for you, ANY feedback is welcome!!

[CasperSally]

This is what we run when boot drive reaches 80%>

find /var/folders -name "*.iscachebmp" -type f -exec rm -v "{}" ;

works great, no complaints. no reboot.

[jgrubbs]

Hey CasperSally, I can confirm that the command you listed works like a charm!

[CasperSally]

beware if you're running find /var/folders -name "*.iscachebmp" -type f -exec rm -v "{}" ; as an execute command on a policy, which worked for me in 9.32, appears broke in 9.65. Running it as a script instead works.