Mac not writing swap files

kirkmc

macrumors newbie
Original poster
Nov 4, 2012
16
1
My iMac - mid-2017, 16 GB RAM - was running slowly today, and I checked in iStat Menus to see if there was an app hogging RAM, and I noticed that there were no swap files. The VM partition is mounted, but instead of swap files there from /private/var/vm, there's just a file called kernelcore which is just 1 MB.

+-> Volume disk4s4 79E6E0E7-4930-4C19-B3C4-8737778C8A4A
| ---------------------------------------------------
| APFS Volume Disk (Role): disk4s4 (VM)
| Name: VM (Case-insensitive)
| Mount Point: Not Mounted
| Capacity Consumed: 1074810880 B (1.1 GB)
| FileVault: No

$ ls -l /private/var/vm/
total 2048
-rw------- 1 root wheel 1048576 Jan 12 20:29 kernelcore

I rebooted in safe mode, nothing changed. I reinstalled Catalina over my current installation; nothing changed.

Interestingly, iStat Menus shows me that the change occurred around 2:09 pm last Thursday. At the time, I wasn't doing much, waiting for a 3pm appointment, and might not have even been using my Mac. I didn't install anything that day, and I don't recall updating anything.

Unfortunately, Time Machine doesn't back up log files; if it did, I'd be able to see what happened at that time.

Does anyone know what could have caused this, and what I would need to do to fix it, short of a clean install and migration?

Thanks in advance.
 

Attachments

topcat001

macrumors regular
Nov 17, 2019
133
49
Usually, on macos swap files are dynamic and will be created and deleted as needed. If you run a big memory hog, like Chrome with many tabs open for a long time, it should begin swapping and the files should appear. I would not expect to see anything after a fresh reboot.

Btw if you're still running dynamic_pager all is well. Easy to check in a Terminal:
Bash:
launchctl list|grep -i pager
 

kirkmc

macrumors newbie
Original poster
Nov 4, 2012
16
1
Macs are always writing to VM, once even half of the memory is used. On my MacBook Pro right now, there's 1 GB swap, even though more than half the RAM is free. Also, I can’t find anything about kernelcore, even in Apple's developer documentation.

As you can see from the iStat Menus screenshot, there is always swap file usage, and it suddenly stopped
 
Last edited:

gilby101

macrumors regular
Mar 17, 2010
205
71
Tasmania
The iStatMenus screenshots suggest to me that the Mac did a reboot. That is exactly how mine looks at a reboot.

And on my Mac (plenty of RAM) is can be a long time before any swapfile is created. As I expect you know, macOS delays using a swap file as long as possible preferring to compress memory.

Edit:

Looked again at your original post. There is something odd in that the VM volume is not mounted. Mine is like this:
| +-> Volume disk1s4 4D3944BE-46CB-49F4-BB73-0E6401546C98
| | ---------------------------------------------------
| | APFS Volume Disk (Role): disk1s4 (VM)
| | Name: VM (Case-insensitive)
| | Mount Point: /private/var/vm
| | Capacity Consumed: 2148552704 B (2.1 GB)
| | FileVault: No
| |

And that is with no swapfile created created (free memory is still just over 2GB)
% ls -l /private/var/vm
total 4196352
-rw------- 1 root wheel 1048576 13 Jan 08:58 kernelcore
-rw------T 1 root wheel 2147483648 17 Dec 19:48 sleepimage

Are you sure that your diskutil extract was for the boot disk and not for a clone (or similar)? It is unusual for the boot disk to be disk4.

launchctl list|grep -i pager
That gives nothing on my Mac (10.15.2).
 
Last edited:

topcat001

macrumors regular
Nov 17, 2019
133
49
That gives nothing on my Mac (10.15.2).
My bad; I did not fully explain. Exactly as you said, the swapfileX files will not be there unless the system is actually swapping. macos tends to compress memory as much as possible before it will swap.

The dynamic_pager daemon manages swap files and is run on demand, so no wonder it does not show up on a random ps listing. It does not run all the time. The following command is better for verifying that the paging service is running.
Bash:
$ sudo launchctl list|grep -i pager
-       0       com.apple.dynamic_pager
The - in the first column means it is not currently running (but the service is active), 0 is the return code from the last run (success).

Good catch on the unmounted disk. For sure something is unusual! I suggest the OP post the full output (and also the exact commands used) of diskutil. Can we see your output for the following:
Bash:
diskutil list
diskutil ap list
 
  • Like
Reactions: gilby101

kirkmc

macrumors newbie
Original poster
Nov 4, 2012
16
1
The VM volume is mounted; it shows the mount point. If it wasn't mounted, then it wouldn't show a mount point there and would say Not mounted. And, if I cd to /private/var/vm, then run open ., it opens in a Finder window, with a disk icon rather than a folder icon, showing that it is mounted as a volume.

Re the commands above, here is the output, just for the startup volume (I have several external disks connected).

$ diskutil list


/dev/disk0 (internal, physical):


#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *500.3 GB disk0
1: EFI EFI 314.6 MB disk0s1
2: Apple_APFS Container disk1 500.0 GB disk0s2


/dev/disk1 (synthesized):

#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +500.0 GB disk1
Physical Store disk0s2
1: APFS Volume Mac SSD - Data 336.3 GB disk1s1
2: APFS Volume Preboot 80.1 MB disk1s2
3: APFS Volume Recovery 528.5 MB disk1s3
4: APFS Volume VM 3.2 GB disk1s4
5: APFS Volume Mac SSD 10.8 GB disk1s5


-----


$ diskutil ap list
APFS Container (1 found)
|
+-- Container disk1 13E8A044-3567-4673-BD80-3F8E123FE8B2
====================================================
APFS Container Reference: disk1
Size (Capacity Ceiling): 499963170816 B (500.0 GB)
Capacity In Use By Volumes: 350962331648 B (351.0 GB) (70.2% used)
Capacity Not Allocated: 149000839168 B (149.0 GB) (29.8% free)
|
+-< Physical Store disk0s2 0C9A6C8A-3AD7-4A33-9848-EA86806169D4
| -----------------------------------------------------------
| APFS Physical Store Disk: disk0s2
| Size: 499963170816 B (500.0 GB)
|
+-> Volume disk1s1 1BDDB11C-AFAD-44F6-AF3F-C0663E701BAB
| ---------------------------------------------------
| APFS Volume Disk (Role): disk1s1 (Data)
| Name: Mac SSD - Data (Case-insensitive)
| Mount Point: /System/Volumes/Data
| Capacity Consumed: 336145854464 B (336.1 GB)
| FileVault: Yes (Unlocked)
|
+-> Volume disk1s2 D69E5974-5181-4410-A239-54B40A099241
| ---------------------------------------------------
| APFS Volume Disk (Role): disk1s2 (Preboot)
| Name: Preboot (Case-insensitive)
| Mount Point: Not Mounted
| Capacity Consumed: 80105472 B (80.1 MB)
| FileVault: No
|
+-> Volume disk1s3 9B8016AF-E236-4463-9A4A-6B59B5305C41
| ---------------------------------------------------
| APFS Volume Disk (Role): disk1s3 (Recovery)
| Name: Recovery (Case-insensitive)
| Mount Point: Not Mounted
| Capacity Consumed: 528498688 B (528.5 MB)
| FileVault: No
|
+-> Volume disk1s4 4A97B1EB-252A-4884-AA32-EE92337E03E6
| ---------------------------------------------------
| APFS Volume Disk (Role): disk1s4 (VM)
| Name: VM (Case-insensitive)
| Mount Point: /private/var/vm
| Capacity Consumed: 3222364160 B (3.2 GB)
| FileVault: No
|
+-> Volume disk1s5 9938750C-4369-4E66-A942-44889F603B6D
---------------------------------------------------
APFS Volume Disk (Role): disk1s5 (System)
Name: Mac SSD (Case-insensitive)
Mount Point: /
Capacity Consumed: 10823806976 B (10.8 GB)
FileVault: Yes (Unlocked)
 

topcat001

macrumors regular
Nov 17, 2019
133
49
Thanks, yes indeed vm is mounted. In your original listing (first post) the vm volume was disk4s4 and not mounted, and we were wondering where that came from. The current listing is what we expect to see.

As mentioned earlier, the swap files will show up at some point when the system is actually using them.
 
  • Like
Reactions: gilby101

kirkmc

macrumors newbie
Original poster
Nov 4, 2012
16
1
As mentioned earlier, look at the screenshot from iStat Menus. It shows a sudden stopping of swap. The Mac was not restarted at that time, and swap is pretty much always used on a Mac with 16 GB RAM. The swap was definitely needed when I noticed this on Sunday, as I was editing photos and every action took about ten seconds to display, which is not the usual performance on my Mac.
 

topcat001

macrumors regular
Nov 17, 2019
133
49
I was just going to comment about that. It seems something happened at that time which led to all the swap being freed. I'm puzzled about that.

Could you please run:
Bash:
sudo launchctl list|grep -i pager
and see if the dynamic_pager service is listed? This is a read only command and should not alter anything.
 

topcat001

macrumors regular
Nov 17, 2019
133
49
Ok so at this point in time everything *looks* normal. Are you still experiencing any slowdowns?
 

gilby101

macrumors regular
Mar 17, 2010
205
71
Tasmania
+-> Volume disk1s4 4A97B1EB-252A-4884-AA32-EE92337E03E6
| ---------------------------------------------------
| APFS Volume Disk (Role): disk1s4 (VM)
| Name: VM (Case-insensitive)
| Mount Point: /private/var/vm
| Capacity Consumed: 3222364160 B (3.2 GB)
| FileVault: No
I am glad we have sorted out the mixup over disks. That looks much better.

The Capacity Consumed is almost exactly what I have right now for my iMac which has a 1GB swap file. Looks 'normal', as @topcat001 says.

How much of the 1GB is being consumed. On my iMac, iStatMenus tells me it is 116MB out of 1GB. What does yours say?

And what does ls -l /var/vm say now? Mine is like this
% ls -l /var/vm
total 6293504
-rw------- 1 root wheel 1048576 13 Jan 08:58 kernelcore
-rw------T 1 root wheel 2147483648 17 Dec 19:48 sleepimage
-rw------- 1 root wheel 1073741824 14 Jan 11:38 swapfile0
 

kirkmc

macrumors newbie
Original poster
Nov 4, 2012
16
1
So I spent about an hour and a half on a call with Apple. Just before I got to the senior advisor, when I launched a bunch of apps, my Mac started writing swap again. It wrote one file, but only wrote 5 MB of swap. We did a screen sharing session, and the advisor could see how much Photos was lagging; it barely wrote swap, even though there was a lot of RAM used. (I had several photo editing apps open.) Since then, the Mac Mac been using swap correctly.

The AppleCare guy said he had never seen anything like this. He thinks it's a hardware issue, because I did re-install Catalina, start up in safe mode, etc. He had me collect a bunch of data and he's passed it on to engineers to see what they think. His thought is that there's something wrong on the logic board that affects I/O, memory transfer, etc.

And he couldn't find anything about that kernelcore file, which is being rewritten or at least touched at each reboot.
 

topcat001

macrumors regular
Nov 17, 2019
133
49
Very interesting! I have been seeing the kernelcore file appear on my Catalina macs, but have not found any official docs describing it. I'm fairly familiar with the kernel architecture of macos but my knowledge lags behind by a few OS releases, in other words a bit outdated on specific details.

However, I think kernelcore is part of the hybrid sleep image. The basic kernel state is saved in kernelcore, the driver state and some app state in sleepimage, and the rest in swapfiles. You'll often see swapfiles appear across a sleep/wake, if they didn't exist before.
 

kirkmc

macrumors newbie
Original poster
Nov 4, 2012
16
1
There’s no sleep image on a desktop Mac; my MacBook Pro doesn’t have that file. Even the Apple guy had never heard of it before, and found nothing in his resources.
Also, there were no invisible files in that directory.
 

topcat001

macrumors regular
Nov 17, 2019
133
49
sleepimage will be there if hibernation is enabled. It is the hibernation image. For example:
Bash:
$ pmset -g
shows
Code:
System-wide power settings:
Currently in use:
 standbydelaylow      4200
 standby              1
 halfdim              1
 hibernatefile        /var/vm/sleepimage ******
 powernap             0
 gpuswitch            0
 disksleep            10
 standbydelayhigh     4200
 sleep                10
 autopoweroffdelay    28800
 hibernatemode        3 ******
 autopoweroff         1
 ttyskeepawake        1
 displaysleep         5
 highstandbythreshold 50
 acwake               0
 lidwake              1
In the above I have marked the hibernation settings with ******. kernelcore is undocumented in the public docs AFAIK.
 

kirkmc

macrumors newbie
Original poster
Nov 4, 2012
16
1
Yes, but it’s not enabled by default on desktop Macs.

hibernatemode = 0 (binary 0000) by default on supported desktops. The system will not back memory up to persistent storage.
 

gilby101

macrumors regular
Mar 17, 2010
205
71
Tasmania
hibernatemode = 0 (binary 0000) by default on supported desktops
I know that is what 'man pmset' says, but that is not my experience with Catalina. Clean build of 10.15.2 on iMac 2019 has hibernate mode = 3.

What does pmset -g say for you?

There’s no sleep image on a desktop Mac
So what is consuming your 3GB VM volume? I am guessing it is just like mine with 2GB sleep image and 1GB swapfile0. Of course, if you have rebooted since showing the 3GB VM, it may be different by now.
 
  • Like
Reactions: topcat001

kirkmc

macrumors newbie
Original poster
Nov 4, 2012
16
1
It's hibernate mode 0

I'm guessing that the volume is larger than necessary. It's probably a sort of sparseimage, but is likely larger than needed to provision for the next swap file.

But there's no sleepimage; just three swap files and kernelcore.
 

topcat001

macrumors regular
Nov 17, 2019
133
49
It seems on your machine hibernatemode = 0 (somehow, "pmget -g" please), and typically each swapfile = 1 GB, kernelcore = 1 MB. All of this adds up to 3 GB (a "ls -lh /var/vm" will confirm my guess).

The swap files are themselves "sparse", used as necessary. Apart from metadata, all used space should be in files.
 
  • Like
Reactions: gilby101