OS X out of disk space when isn't
 

This morning my hard drive was out of disk space.
First I just opened "Macintosh HD" and checked the sizes of all the folders (approx 20gb in all seven folders combined)
That seemed normal, so I deleted warcraft and some music to make a little room and installed "Omni disk sweeper" and "Disk inventory X"
I ran Omni disk sweeper and it said I had 19.97 gigs on the drive.
However the drive says I have a capacity of 37.14 and that I am using 34.27.
So there is about 14gb that may or may not be on the drive, but either way the drive thinks it's there. Anybody know how I can fix this?
Thanks


P.S. I am using a 12inch 1.33ghz Powerbook PC. With a 40 gig drive.

Do you have an external hard drive that you plug in ?

As an alternative to using OmniDiskSweeper or DiskInventory, open a Terminal window (Terminal is under /Applications/Utilities) and enter the following command:
sudo du -x -h -d 1 /
Look to see which sub-folder is taking up the most space and repeat with that folder. If you have trouble interpreting the results, just copy & paste them back here and we can help.
(This method will work in cases where the above 3rd-party utilities fail to show where the disk space is going - i.e. the case where the files are in folders that you don't have permission to read. Note that the 'du' command may take several minutes to finish, so be sure to wait until you get the prompt back.)

I'm a big fan of GrandPerspective, http://grandperspectiv.sourceforge.net/. You can't beat it for a quick graphical overview of everything on the HD. (It seems to show everything: that big red rectangle in the upper left is the sleep image!)

I also like GrandPerspective - but it definitely doesn't show everything.
For example, it doesn't show anything about the files under the folder /var/spool/cups
This folder is owned by 'root' and only has read permission for owner (i.e. for 'root'). It is folders like this that might be hiding large files that wouldn't show up in the scans done by any of the above-mentioned utilities - since they run with the permissions of your user account. To see everything, you need 'root' privileges - e.g. via the use of 'sudo' in the 'du' command I suggested above.

Do you use File Vault?

Thanks. I stand corrected.

Or you could download an app that shows hidden files - Onyx or tinkertool will do it, then check through the system files to see what is there - When I have known people with problems like this it is usually that Norton 'space muncher' or whatever its called, where it basically fills up your hard drive with a 1 file in one of your cache folders - i have seen it as big as 30GB before, so if you use norton, it could be that!

HTH

The problem is not with hidden files - these will be found by the above disk-space-inventory utilities. The problem is with files & folders that the user running the utility does not have permission to look at.

By the way, it is not generally recommended to run any Norton software on OS X - at least not on Tiger. Norton hasn't done a good job of keeping their apps up to date with changes in the system.

ok...we're gtting closer.
 

Ok So I tried terminal...(I know nothing about how terminal works)
I typed in the sudo thing and sure enough there was a folder called "private" with 14gb in it, it seems to be in a file called private/var.
Any idea what that is, or if I can safely delete it somehow?
here is the copy of the terminal info:

No you can not yet delete anything.

do sudo du -x -h -d 1 /private/var and post that result.
if the biggie is log repeat again against that
sudo du -x -h -d 1 /private/var/log

seems to be the spool..?
 

I think the spool is where CUPS and other printer-related stuff are located in.

Yes - there is 14 GB taken up in the /private/var/spool folder
So continue to "zoom in" with the 'du' command:

sudo du -x -d 1 /private/var/spool

so it's in the cups
 

I officially have no idea what anything in this message means.

Means your printer spool, or less likely something hiding in your prnter spool, has a lot of "stuff" in it.

cups


I'm anticipating that Hayne will want a directory listing of /private/var/spool/cups. I'm also guessing that list is longer than what you can copy/paste there.

That would indeed be the next step.

accsl:
Please launch the "Terminal" application (under /Applications/Utilities) and copy & paste the following commands, press Return, then copy & paste the results back here so we can see:

id
sudo ls -aol /private/var/spool/cups | head -n 30
echo "done"

Here are the spooled cups?
 

Out of curiosity, could we see the results of the following commands as well?

sudo file /var/spool/cups/00000255
sudo file /var/spool/cups/0000090f
sudo file /var/spool/cups/0000198c

Trevor

is this what you need?
 

So a huge PDF file is stuck in the printer spool, with nowhere to go?

Let's delete it so I can give my boss back his computer.

I'm no good at sudo rm-ing anything (and I don't want to mess your Mac), so I'm gonna let someone more experienced with the terminal help out here.

So those 3 big files are PDF files.
To delete them, run the following commands:

sudo rm /var/spool/cups/00000255
sudo rm /var/spool/cups/0000090f
sudo rm /var/spool/cups/0000198c

I'm concerned that there are additional large files in that directory. We only looked at 30 files previously. So, before you give this computer back to your boss, can you show us the results of

sudo ls -aolS /private/var/spool/cups | head -n 30

That added -S option to ls should show us the largest 30 files in the directory.

Trevor

I thought that was the light at the end of the tunnel...
 

So I did it, and then I did it again, and it said that there was no such file.
so I shut down and restarted and it still seems to have the same problem.

http://www.benspot.com/problem.jpg
..

Yes, the three files that were deleted were too small to be the sole source of the problem.
So, the first file is 45,702,992 bytes, or about 45 MB. The second file is 14,130,568 bytes, or about 14 MB. The third file is 4,195,752 bytes, or about 4 MB. You've got a lot more large files in that directory. Which is why I asked you in my previous post to show us the largest 30 files in that directory.

Could you copy/paste the command I gave above so that we can check that?

Trevor

Last login: Wed Jul 11 12:08:17 on ttyp1
Welcome to Darwin!
Oscars-comp:~ roadieone$ sudo ls -aolS /private/var/spool/cups | head -n 30
total 28717752
-rw-r----- 1 root lp - 82535977 Jun 29 18:19 d00179-001
-rw-r----- 1 root lp - 82535977 Jun 29 19:51 d00180-001
-rw-r----- 1 root lp - 82535977 Jun 29 21:03 d00181-001
-rw-r----- 1 root lp - 82535977 Jun 29 21:47 d00182-001
-rw-r----- 1 root lp - 82535977 Jun 29 22:03 d00183-001
-rw-r----- 1 root lp - 82535977 Jun 30 00:29 d00184-001
-rw-r----- 1 root lp - 82535977 Jun 30 00:41 d00185-001
-rw-r----- 1 root lp - 82535977 Jun 30 01:01 d00186-001
-rw-r----- 1 root lp - 82535977 Jun 30 02:24 d00187-001
-rw-r----- 1 root lp - 82535977 Jun 30 02:45 d00188-001
-rw-r----- 1 root lp - 82535977 Jun 30 03:21 d00189-001
-rw-r----- 1 root lp - 82535977 Jun 30 06:14 d00190-001
-rw-r----- 1 root lp - 82535977 Jun 30 07:12 d00191-001
-rw-r----- 1 root lp - 82535977 Jun 30 08:42 d00192-001
-rw-r----- 1 root lp - 82535977 Jun 30 09:13 d00193-001
-rw-r----- 1 root lp - 82535977 Jun 30 09:31 d00194-001
-rw-r----- 1 root lp - 82535977 Jun 30 09:47 d00195-001
-rw-r----- 1 root lp - 82535977 Jun 30 10:28 d00196-001
-rw-r----- 1 root lp - 82535977 Jun 30 11:15 d00197-001
-rw-r----- 1 root lp - 82535977 Jun 30 12:19 d00198-001
-rw-r----- 1 root lp - 82535977 Jun 30 13:17 d00199-001
-rw-r----- 1 root lp - 82535977 Jun 30 14:40 d00200-001
-rw-r----- 1 root lp - 82535977 Jun 30 16:04 d00201-001
-rw-r----- 1 root lp - 82535977 Jun 30 17:05 d00202-001
-rw-r----- 1 root lp - 82535977 Jun 30 18:18 d00203-001
-rw-r----- 1 root lp - 82535977 Jun 30 19:27 d00204-001
-rw-r----- 1 root lp - 82535977 Jun 30 19:40 d00205-001
-rw-r----- 1 root lp - 82535977 Jun 30 21:46 d00206-001
-rw-r----- 1 root lp - 82535977 Jun 30 22:19 d00207-001
Oscars-comp:~ roadieone$

No. In post #25, I asked that you give me the results of
sudo ls -aolS /private/var/spool/cups | head -n 30

You gave me the results of 'sudo ls -aol', and did not add the 'S'. Please copy/paste the command from post #25.

Trevor

Sorry.

I realized the error and edited the previous post. but apparently not before you read it.

Odd. That's a whole lot of 82 MB files from June 30. What happened on June 30?

In any event, to delete all files that follow that pattern, try copy/pasting the following command:

sudo rm /var/spool/cups/d0????-001

(Yes, those question marks are intended.)

Once you've done that, please show us the results of

sudo ls -aolS /var/spool/cups | head -n 50

Trevor

The latest...
 

Last login: Wed Jul 11 12:24:01 on ttyp1
Welcome to Darwin!
Oscars-comp:~ roadieone$ sudo rm /var/spool/cups/d0????-001
Password:
rm: /var/spool/cups/d0????-001: No such file or directory
Oscars-comp:~ roadieone$ sudo ls -aolS /var/spool/cups | head -n 50
total 28717752
-rw-r----- 1 root lp - 82535977 Jun 29 18:19 d00179-001
-rw-r----- 1 root lp - 82535977 Jun 29 19:51 d00180-001
-rw-r----- 1 root lp - 82535977 Jun 29 21:03 d00181-001
-rw-r----- 1 root lp - 82535977 Jun 29 21:47 d00182-001
-rw-r----- 1 root lp - 82535977 Jun 29 22:03 d00183-001
-rw-r----- 1 root lp - 82535977 Jun 30 00:29 d00184-001
-rw-r----- 1 root lp - 82535977 Jun 30 00:41 d00185-001
-rw-r----- 1 root lp - 82535977 Jun 30 01:01 d00186-001
-rw-r----- 1 root lp - 82535977 Jun 30 02:24 d00187-001
-rw-r----- 1 root lp - 82535977 Jun 30 02:45 d00188-001
-rw-r----- 1 root lp - 82535977 Jun 30 03:21 d00189-001
-rw-r----- 1 root lp - 82535977 Jun 30 06:14 d00190-001
-rw-r----- 1 root lp - 82535977 Jun 30 07:12 d00191-001
-rw-r----- 1 root lp - 82535977 Jun 30 08:42 d00192-001
-rw-r----- 1 root lp - 82535977 Jun 30 09:13 d00193-001
-rw-r----- 1 root lp - 82535977 Jun 30 09:31 d00194-001
-rw-r----- 1 root lp - 82535977 Jun 30 09:47 d00195-001
-rw-r----- 1 root lp - 82535977 Jun 30 10:28 d00196-001
-rw-r----- 1 root lp - 82535977 Jun 30 11:15 d00197-001
-rw-r----- 1 root lp - 82535977 Jun 30 12:19 d00198-001
-rw-r----- 1 root lp - 82535977 Jun 30 13:17 d00199-001
-rw-r----- 1 root lp - 82535977 Jun 30 14:40 d00200-001
-rw-r----- 1 root lp - 82535977 Jun 30 16:04 d00201-001
-rw-r----- 1 root lp - 82535977 Jun 30 17:05 d00202-001
-rw-r----- 1 root lp - 82535977 Jun 30 18:18 d00203-001
-rw-r----- 1 root lp - 82535977 Jun 30 19:27 d00204-001
-rw-r----- 1 root lp - 82535977 Jun 30 19:40 d00205-001
-rw-r----- 1 root lp - 82535977 Jun 30 21:46 d00206-001
-rw-r----- 1 root lp - 82535977 Jun 30 22:19 d00207-001
-rw-r----- 1 root lp - 82535977 Jun 30 22:26 d00208-001
-rw-r----- 1 root lp - 82535977 Jul 1 01:24 d00209-001
-rw-r----- 1 root lp - 82535977 Jul 1 01:37 d00210-001
-rw-r----- 1 root lp - 82535977 Jul 1 01:44 d00211-001
-rw-r----- 1 root lp - 82535977 Jul 1 03:56 d00212-001
-rw-r----- 1 root lp - 82535977 Jul 1 05:31 d00213-001
-rw-r----- 1 root lp - 82535977 Jul 1 06:33 d00214-001
-rw-r----- 1 root lp - 82535977 Jul 1 08:34 d00215-001
-rw-r----- 1 root lp - 82535977 Jul 1 10:35 d00216-001
-rw-r----- 1 root lp - 82535977 Jul 1 10:52 d00217-001
-rw-r----- 1 root lp - 82535977 Jul 1 12:19 d00218-001
-rw-r----- 1 root lp - 82535977 Jul 1 13:28 d00219-001
-rw-r----- 1 root lp - 82535977 Jul 1 14:07 d00220-001
-rw-r----- 1 root lp - 82535977 Jul 2 09:13 d00221-001
-rw-r----- 1 root lp - 82535977 Jul 2 11:10 d00222-001
-rw-r----- 1 root lp - 82535977 Jul 2 11:51 d00223-001
-rw-r----- 1 root lp - 82535977 Jul 2 13:24 d00224-001
-rw-r----- 1 root lp - 82535977 Jul 2 14:53 d00225-001
-rw-r----- 1 root lp - 82535977 Jul 2 15:12 d00226-001
-rw-r----- 1 root lp - 82535977 Jul 2 16:18 d00227-001
Oscars-comp:~ roadieone$

Hmm. So that didn't work.

I'm not sure why the wildcards aren't working (i.e. the ?s in the command). Perhaps someone else can explain that. Meanwhile, to get those deleted, you can use the following command, which will ask you whether you want to delete each one of those 82 MB files. If you are asked about one that doesn't follow the pattern, you may want to say no.

sudo rm -i /var/spool/cups/d0*


Once you've done that, please show us the results of

sudo ls -aolS /var/spool/cups | head -n 50

Trevor

It's because of the permissions on that folder (/var/spool/cups) and the fact that wildcards are expanded by the shell before the command is executed - i.e. before the 'sudo' is executed.

Here's an example of a similar situation:

OK, then the * in my next attempt to delete these files won't work either. So how does one delete those files without

1. becoming temporary root user, such as using sudo -s, and then deleting them with wildcards, or
2. deleting every one individually, or
3. temporarily changing the permissions on the folder, removing them, and then changing the permissions back?

Trevor

The easiest way is definitely using 'sudo -s' to get a root shell and then being very careful what you do in that shell and being sure to exit from it immediately afterwards.

But you could use 'find' - e.g. something like:

sudo find /var/spool/cups -name 'd0????-001' -delete

It would probably be a good idea to use the '-maxdepth' option to limit the 'find' to files directly under that folder:

sudo find /var/spool/cups -maxdepth 1 -name 'd0????-001' -delete

Great! Thanks Hayne.

So, accsl, can you use Hayne's command to delete the files,

sudo find /var/spool/cups -maxdepth 1 -name 'd0????-001' -delete

then follow up with

sudo ls -aolS /var/spool/cups | head -n 50

...to take a look at the 50 biggest files in the directory?

Trevor

I think that did it!
 

Last login: Thu Jul 12 09:02:34 on ttyp1
Welcome to Darwin!
Oscars-comp:~ roadieone$ sudo find /var/spool/cups -maxdepth 1 -name
'd0????-001' -delete
Oscars-comp:~ roadieone$ sudo ls -aolS /var/spool/cups | head -n 50
total 7056
drwx--x--- 358 root lp - 12172 Jul 12 09:07 .
-rw------- 1 root lp - 9985 Jul 10 10:02 c00357
-rw------- 1 root lp - 9985 Jul 10 10:06 c00358
-rw------- 1 root lp - 9963 Jun 29 18:19 c00179
-rw------- 1 root lp - 9963 Jun 29 19:51 c00180
-rw------- 1 root lp - 9963 Jun 29 21:03 c00181
-rw------- 1 root lp - 9963 Jun 29 21:47 c00182
-rw------- 1 root lp - 9963 Jun 29 22:03 c00183
-rw------- 1 root lp - 9963 Jun 30 00:29 c00184
-rw------- 1 root lp - 9963 Jun 30 00:41 c00185
-rw------- 1 root lp - 9963 Jun 30 01:01 c00186
-rw------- 1 root lp - 9963 Jun 30 02:24 c00187
-rw------- 1 root lp - 9963 Jun 30 02:45 c00188
-rw------- 1 root lp - 9963 Jun 30 03:21 c00189
-rw------- 1 root lp - 9963 Jun 30 06:14 c00190
-rw------- 1 root lp - 9963 Jun 30 07:12 c00191
-rw------- 1 root lp - 9963 Jun 30 08:42 c00192
-rw------- 1 root lp - 9963 Jun 30 09:13 c00193
-rw------- 1 root lp - 9963 Jun 30 09:31 c00194
-rw------- 1 root lp - 9963 Jun 30 09:47 c00195
-rw------- 1 root lp - 9963 Jun 30 10:28 c00196
-rw------- 1 root lp - 9963 Jun 30 11:15 c00197
-rw------- 1 root lp - 9963 Jun 30 12:19 c00198
-rw------- 1 root lp - 9963 Jun 30 13:17 c00199
-rw------- 1 root lp - 9963 Jun 30 14:40 c00200
-rw------- 1 root lp - 9963 Jun 30 16:04 c00201
-rw------- 1 root lp - 9963 Jun 30 17:05 c00202
-rw------- 1 root lp - 9963 Jun 30 18:18 c00203
-rw------- 1 root lp - 9963 Jun 30 19:27 c00204
-rw------- 1 root lp - 9963 Jun 30 19:40 c00205
-rw------- 1 root lp - 9963 Jun 30 21:46 c00206
-rw------- 1 root lp - 9963 Jun 30 22:19 c00207
-rw------- 1 root lp - 9963 Jun 30 22:26 c00208
-rw------- 1 root lp - 9963 Jul 1 01:24 c00209
-rw------- 1 root lp - 9963 Jul 1 01:37 c00210
-rw------- 1 root lp - 9963 Jul 1 01:44 c00211
-rw------- 1 root lp - 9963 Jul 1 03:56 c00212
-rw------- 1 root lp - 9963 Jul 1 05:31 c00213
-rw------- 1 root lp - 9963 Jul 1 06:33 c00214
-rw------- 1 root lp - 9963 Jul 1 08:34 c00215
-rw------- 1 root lp - 9963 Jul 1 10:35 c00216
-rw------- 1 root lp - 9963 Jul 1 10:52 c00217
-rw------- 1 root lp - 9963 Jul 1 12:19 c00218
-rw------- 1 root lp - 9963 Jul 1 13:28 c00219
-rw------- 1 root lp - 9963 Jul 1 14:07 c00220
-rw------- 1 root lp - 9963 Jul 2 09:13 c00221
-rw------- 1 root lp - 9963 Jul 2 11:10 c00222
-rw------- 1 root lp - 9963 Jul 2 11:51 c00223
-rw------- 1 root lp - 9963 Jul 2 13:24 c00224
Oscars-comp:~ roadieone$

Just clicked on the drive and there are 16 available gigs!
You guys are awesome! and I'm sure if I understood anything about what just happened in terminal I would be even more wowed that you were able to figure it out.
Thank you very much.
accsl