Something is Eating 3+ GB of HD space per hour?

[ArtOfWarfare]

My 2018 15" MacBook Pro has no space.

At around 2 PM, I got an alert telling me that my computer was running out of disk space. It said I had 10 GB left.

I searched for large files and cleared out a few, leaving me with about 25 GB of free space.

About 4 hours later, I got another alert telling me I was running out of disk space. This alert said I had just 500 MB left.

I cleared some more stuff, but at this moment (a few minutes later), I'm down to 400 MB left. What on earth is eating my hard drive up? Whatever it is, the files it's making aren't particularly large.

I've closed all applications, but still Finder's Info on my Hard Drive is showing my Available space as dropping. In the time that I wrote that last sentence, I lost about 140 MB of space.

I have no idea what to do. Activity Monitor shows that kernal_task has written 350 GB, and that bash has written 320 GB... but over what timeframe? How do I restart the stats it to show me what is presently writing to my disk? And how do I find the files which are presently being written?

100 MB left.

 

[ArtOfWarfare]

I did Show Info on my hard drive + all the folders under /

/bin: 5 MB
/Applications: 42 GB
/Library: 8 GB
/opt: 44 MB
/private: 3 GB
/sbin: 3 MB
/System: 16 GB
/Users: 65 GB
/usr: 5 GB
/var: 3 GB
/Volumes: ... still Calculating Size. IDK why this is taking a long time, I opened it in Finder and it all adds up to around 550 MB? Actually, as I was typing this it finished and told me it's 1 byte.

So... this all adds up to around 140 GB. My hard drive should have 360 GB of space available that's just being used for... I have no idea what for or how to find out.

(I'm using a web browser from another computer to make my posts here.)

Edit: Whatever is going on, it seems like everytime my hard drive hits ~50 MB left, suddenly it jumps back up to ~1 GB.

Edit 2x: I suppose I should go with the assumption it's a virus mining bitcoin. I see bash is currently consuming 100% CPU despite the fact that I have no terminal windows open anywhere... the user is root for that.

Now that bash process has dropped to jut 2% but Finder is at 60% and "deleted" is at 6% CPU...

 

[0128672]

One thought: do you have Time Machine enabled and its Back up automatically option? If so, it's creating local snapshots that might be eating up your space. Turn off back up automatically and wait a few minutes for the local snapshots to be deleted.

About Time Machine local snapshots - Apple Support

Time Machine lets you restore files from local snapshots of the files on your Mac, even when your Time Machine backup disk isn't available.

support.apple.com

Just saw your edits, so hoping it's not a virus. Sounds more serious than TM local snapshots.

 

[ArtOfWarfare]

One thought: do you have Time Machine enabled and its Back up automatically option? If so, it's creating local snapshots that might be eating up your space. Turn off back up automatically and wait a few minutes for the local snapshots to be deleted.

About Time Machine local snapshots - Apple Support

Time Machine lets you restore files from local snapshots of the files on your Mac, even when your Time Machine backup disk isn't available.

support.apple.com

I do not have it running.

This laptop is used just for development work. Everything that's important is in a git repo, so there's not much reason to use Time Machine.

Would Time Machine's files be hidden like this? Macintosh HD Info clearly shows that my Capacity is 499.96 GB, but that only 15 MB is available (and it shows 495 GB as used). Opening "Get Info" for everything in / (including all the hidden folders that I'm aware of, see my earlier post) only added up to 140 GB. So... it's bizarre.

If this were just a logging process going haywire somewhere, I'd think these Get Info windows would show them. I... don't know what would invisibly eat 360 GB of diskspace. I have the ~10 GB recovery partition and that's all for partitions shown by Disk Utility.

Activity Monitor shows kernal_task as increasing pretty quickly for how much it's written.... it's writing around .14 GB per 5 second refresh. That's about 50 MB/second, which matches what the graph at the bottom shows...

That'd be over 1 GB per minute.

There's a thread over here about kernal_task writing 2 TB per month:

kernel_task writing >2TB a month to SSD, Worried about SSD Lifespan

kernel_task has been writing to the SSD like a mad man, it has > 2TB written in a month with 49TB Disk writes till date ( my MacBook is 8 months old) At this rate the SSD would die soon considering SSD's have limited disk writes. How do I stop this from happening / will my machine be fine? I've...

forums.macrumors.com

But I'm way over that. At the rate it's going, it'd write 2 TB in about a day. And it's a real issue because it's really consuming all my disk space so that other apps can't run properly.

Is it safe to reboot when I have no disk space? I'd imagine there's some important writes that happen at boot up and the boot will just fail if there's no disk space available for those writes...

 

[ArtOfWarfare]

I finally decided to go ahead and reboot. Now right clicking Macintosh HD and picking Get Info shows only 113 GB used and 386 GB available...

So I guess everything is fine after a reboot? How anti-climatic.

 

[0128672]

I finally decided to go ahead and reboot. Now right clicking Macintosh HD and picking Get Info shows only 113 GB used and 386 GB available...

So I guess everything is fine after a reboot? How anti-climatic.

The best kind of anti-climatic though ... If you figure out what caused it, I hope you'll post back.

 

[Analog Kid]

I was going to suggest run away memory allocation consuming swap space, but I think swap has an upper limit, right?

 

[joevt]

Command-Shift-Period to show invisible files. Then use Calculate All Sizes in the Get Info dialog to show all sizes, and sort by size.

lsof to get a list of open files and their process info.

Sometimes I get a broken deleted process that takes a lot of CPU but a restart usually stops that.

 

[ArtOfWarfare]

Command-Shift-Period to show invisible files. Then use Calculate All Sizes in the Get Info dialog to show all sizes, and sort by size.

lsof to get a list of open files and their process info.

Sometimes I get a broken deleted process that takes a lot of CPU but a restart usually stops that.

lsof | grep deleted showed only ~10 files yesterday, the largest of which was only 200 MB (and the rest were much too small to matter at all.)

Is anyone familiar with "Beyond Trust"? This laptop belongs to my employer and I think they installed that about a week ago.

I installed Redis via Homebrew ~3 weeks ago, but I'd be surprised if it caused problems like this.

Those are the only software changes that have happened recently... it's running Catalina version 10.15.7... I probably installed it sometime last year. I know some other people on my team have updated to Big Sur but I don't see much point.

 

[auxbuss]

I installed Redis via Homebrew ~3 weeks ago, but I'd be surprised if it caused problems like this.

homebrew puts its db in `/usr/local/var/db/redis/` by default, so its easy to check. (Confirm via `config get dir` in redis.)

However, since you have homebrew installed, I'd install `ncdu`, which will show you immediately where storage is being used. You might need to run it as `ncdu / --exclude /System/Volumes`, due to recursion issues with macOS's latest file system.