Zero KB available - free space dissapearing
 

When I first switched to a mac, I was advised that I would not need antivirus software but today I have found a serious problem I dont understand, that might be a virus.

I must admit to using bitorrent. Today I left my computer on while it was connected to bit torrent and also safari was connecting to the internet regularly through something i have set up on Automator (to contact a single trusted website).

Bit torrent was downloading several files, total size probably about 2gb. I had about 20GB free space.

When I got home this evening I had zero kb free space. I have a 100GB HD (allowing for about 92GB real space). When I added the contents of the various folders (applications, documents, music, movies, photos, desktop etc) it amounted to 66GB. So what happened to the remaining 26GB?

I deleted some small files (maybe 200MB) but it still showed zero KB available. Then I deleted several gig - eventually it started to show I had 1.5 GB available. But if I opened a file, or closed a file, the free space would reduce by about 0.05GB, and would not go back up. Every time I opened or closed a file or application I had less free space available.


then suddenly it jumped back to 5.3 GB available. But I ought to now have about 30GB available.

I dont understand what is happening. Is it perhaps a virus or hacker while I left the computer connected to bit torrent? I have been using bit torrent for a while and never experienced anything like this. I am connected through a hardware firewall (but with open ports for bit torrent and Mail).

I have tried to repair permissions but permissions are fine. I have run verify disk but the disk is fine. Also, I have tried using another account on the computer but the problem persists. Naturally I have also tried restarting.

I am really worried.

Can you help please?

I have an MBP, 2.16.

Thanks kindly

DDD

It's almost certainly not a virus.

First, restart your computer. If a process has gone bonkers and is filling error logs with messages, that might take care of it. Next, use a utility such as WhatSize to find out what's taking up all your space.

so I tried restarting it. That didnt solve it.

then I got that weird thing I pointed out when every time I opened a file it took 0.05GB off the available space. Thankfully that has stopped.

I used Whatsize. The only thing that I can see that could have happened is that files that are supposed to be only a few hundred MB seem to be taking several gig - this is the stuff I downloaded. I think it may be to do with partially downloaded stuff that has not been fully recalculated and wont be until it is complete.

I should probably complete the downloads but for some reason transmission now seems to think that I have downloaded 0kb of files that had many mb already downloaded. so i will remove them and try again!

Using whatsize I did notice a lot of stuff I dont think I really need - like apple audio for ilife and garageband, neither of which I use. Can I remove that?

I also have 2.5GB in logs (in the 'library'). Is this a record of crashes? Do I need to keep it?

I am still very concerned as I still dont think it all adds up.

By the way, are there viruses for macs after all?

thanks

ddd

It's likely the stuff you are downloading has gotten corrupt, causing odd file sizes. You could try downloading the files again.

The logs are also definately way too large. Open some of the large log files and paste back any error messages that might somehow be related to the problem.

Make sure you have the latest version of Transmission, which is currently 0.95. Earlier versions have had some bugs related to file sizes.

The topic of viruses on Macs is a bit controversial. There are only 2 trojans that have been made for OS X, one is considered 'alive', but you need to manually download it, open the installer, enter your admin password, click OK, and restart your computer for it to do anything. The other one has been dead for a while now. It also required you to enter an admin password for it to do anything.

Some say because there are less Macs than PCs that they are less targeted. Others disagree saying that OS X is a prime target for attacks because nobody has created a 'real' virus for it yet. Some say it's simply because OS X is 'more secure'. There's a lot of argument about this.

By the way, is it possible for running programmes to use up huge chunks of HD space temporarily? I am currently running What Size, Firefox, and Transmission (connected really slowly) and the available space seems to jump about dropping gradually, but quickly, by up to 5GB and then jumping up again suddenly?

Thanks for this info. I am trying to re download the files and will see what happens.

I have the latest version of transmission.

Regarding the logs. there are 2 recent ones, both from a few hours ago. I will paste the one that opens. I dont really understand it. It would seem to relate to transmission, to something I tried to do with a new Nokia phone and a piece of 3rd party software called phone director - I tried to get them to connect together and upload some software to the phone but it didnt work.

It looks like it also relates to some dashboard widgets, including the radio tuner (which I was not even using at the time but seems to be permanently active and which is often a problematic device for me).

I am really confused by the meaning of the log though - is it telling me I was trying to download too many files simultaniously? From looking at the log it looks like there are lots of things going wrong! Is there anything I can learn from it?

The other log, which will not open, is 2.44GB! Shall I just delete it by hand?


The log which opens is pasted here:

You should also boot to your OS X Install Disk, select Disk Utility from one of the menus, go to the First Aid tab, and run "Repair Disk" (not Repair Disk Permissions). If it finds any errors, repeat until no errors are found.

Trevor

No - don't delete it yet.
First let's have a look at what is in it so as to perhaps get a clue about what is happening.
You didn't mention the name of that large log file.
For the sake of concreteness, let's say that it is called "foo.log" and replace "foo.log" with the actual name of the log file in the commands below.

Please launch the "Terminal" application (under /Applications/Utilities) and copy & paste the following commands (all together), press Return, then copy & paste the results back here so we can see:

id
ls -l /var/log/foo.log
head -n 50 /var/log/foo.log
tail -n 50 /var/log/foo.log
echo "done"

Hi all

thanks for your messages. So it seems that at least part of the problem was perhaps caused by a new release of transmission. A couple of days later they sent another release that was to correct a bug that corrupted downloaded files.

Using whatsize I identified the ballooned files and have deleted them. I am now trying to download again and will see if that has fixed it. By deleting those files and some other things I didnt need, I freed up enough space to make things manageable for now, but I am concerned about the meaning of the 2.5gb log file, and the meaning of the content of the log file I pasted here.

On Saturday I should have time to go through your advice and will contact you all again then.

For now, thanks very much for your tips and hints and help.

DDD

The file is called console.log.0. it is in logs\console

when i follow your instructions terminal tells me:

tail: /var/log/console.log.0: No such file or directory

Any suggestions...

Is is supposed to be "/var/logs/console.log.0"??? I never used the terminal to load logs before.

So I realise your terminal commands didnt refer to the same kind/location of log file. The original log file I was referring to was in Library/logs/console. It is 2.5gb and is called console.log/0. There are about 9 other smaller log files here, ranging from 4 kb to 24.4mb.


However, when I tried to find other log files I found 2 more 2GB log files in private/ var / log location. they are called asl.log and asl.log.33. (There are about 40 smaller log files here ranging from 0 bytes to 256KB).

When I tried to open them in console they started to open but the amount of processing going on just about killed my computer, and somewhere another 1gb dissapeared.

I also notice that in private/var/vm there is a 2gb file called sleep image. not sure if that is significant.

I am really concerned that free space seems to just randomly disappear, and at all the space being wasted in the log files. also at the number of log files - seems like a lot.

I dont know much about log files. I assume that they tell you what has gone wrong with your machine (if you know how to understand them).

So what should I learn from them, do I have a serious problem, what should I delete?

Also, just to clarify, I have run the daily, weekly, monthly processes and I have run Cache Out X. If there is a way to post screen shot I will do that...

PLEASE HELP!!! VERY WORRIED ABOUT MY LOVELY COMPUTER!

i added the screen grabs for reference. there are three and they show the log files in their sozes and locations.

Log files can sometimes grow to alarming sizes (and I think 2.5GB is fairly alarming) because some process has gone haywire and is writing repeated (and probably identical) error messages to the log. It -would- be nice to open that log file and see what is being written, but if you really can't reasonably open it, I would delete the log files (they don't do you any good if you can't see them, anyway) and keep close watch on the log files and inspect them frequently, particularly if they seem to be growing rapidly. It -is- of some consequence what is causing it to grow so large, but you should be able to find that out after it is deleted and re-created when the process writes to it again. There was one version of Adobe Reader that had a propensity to do this to log files because of a font issue, but I think that's long since fixed; but that doesn't mean that some other program may be going crazy.

There may also be terminal commands to allow you to view some portion of the log file, but I expect any manipulation of a file that size is going to be a problem.

Joe VanZandt

It should be no problem to look at portions of these large log files using the Terminal commands I suggested above - but it might take a minute to get the results.

I think the problem you were having when you tried to run my suggested Terminal commands was that the log file was not under the /var/log folder.

If the log file is in the /Library/Logs/Console folder, then you would use that folder name instead of "/var/log" in the commands I gave above.

But usually the console log files (on Tiger) are in a sub-folder of /Library/Logs/Console that is named after your user's numerical user id - e.g. something like 501, so the actual folder name is something like:
/Library/Logs/Console/501
and so the full path to the filename (which is what you need to use instead of the "/var/log/foo" that I have in the commands above) would be:

/Library/Logs/Console/501/console.log.0

just by the way, what is a normal size and number of log files in the various locations?

Ok.

I followed your advice and was able to open the logs. First up is: /Library/Logs/Console/501/console.log.0 - this was the first one we were talking about, 2.45gb. It bizzarely refers to WhatSize, even though I only downloaded WhatSize after I started posting here, and it was WhatSize that allerted me to this file in the first place.

It also refers to automator. I use automator pretty much daily to click a link on a website every 500seconds in order to keep my profile active while I am not at my computer. In the workflow, I use an applescript to close the Safari window, but it does not always manage to close the window, and lately when I have been getting home after a day away from the computer there will be hundreds of open safari windows. I just quit safari to close them all. I have been running automator in this way for months, although the apple script seems to be becoming less effective over time.

I have skype set to open when i turn on the computer, but i usually close it straight away. it has only been set up like this for a few weeks.

That;s all I can really say about what little I understand about this first log file, so I will post it here for your thoughts...

Following your instructions I have opened var/log/asl.log

I dont understand any of that at all!

I have been forced to split it into two postings for size.

Part 1:

Posted here:

Part 2 of that same log (asl.log)

Strangely, when I tried to run the process for the file asl.log.33 i see it has been deleted, though not by me!!!

Right, well then there you have the scripts of the two huge log files. Can anyone tell me what they mean, and hence what I should be doing differently, and if i am damaging anything in my computer.

Any other advice on the matter, as I have never looked into log files. not sure how many I should have, what size is normal, how long to keep them for and so on.

I am still worried about this peculiar thing my computer occasionally does of some files just suddenly getting huge - well actually i dont know that for a fact, all i do know is that very occasionally, i will just see my free space over the course of a few minutes reduce in size by several GB with no real explanation. I think it comes back but i am not sure.

The purpose of looking at the extracts from the start (via 'head') and the end (via 'tail') of those log files was to see if there was one program that was repeatedly issuing an error message. There are several cases of repeated messages, but the extracts are too short for me to see what if anything is the culprit. Looking at the timestamps at the beginning of the messages, you can see that several have occurred within milliseconds of each other - but then there is a gap of minutes before anything else.

You could look closer at the log files (e.g. by increasing the lines counts given via the "-n" options in those commands to try to see what program is issuing most of the messages, but it might be easier to just remove those older log files (the ones with names ending with a number) and then look closely at the new log files to see what sort of messages are currently appearing. I.e. have a look at the log files every hour or so and see what is there.

The current log files are those without a number at the end of their names. The system automatically (via a maintenance script that runs more or less daily) renames the older files to have a number at the end and then starts a new file. Usually the files for the last 7 days are kept.
So it was probably the maintenance script that resulted in the apparent deletion of that one log file.

Console.app only loads the latest portion of the log. Wouldn't it would be easier to use that? http://i18.tinypic.com/86rs02s.png

If that works with files in the GB range - by all means use it.
But many GUI utilities have difficulty with files in the GB size.

as i mentioned earlier, the computer nearly died when I tried to open the logs with console. I will take your advice and delete the files and see what new ones emerge. I will post any findings here in the next few days....

Interestingly, I can't remove the asl.log file. says it is in use. any suggestions? should i just wait and it will go away?

darn, i also cant restore it to its rightful place, from the trashcan, as it is supposed to be in 'private' which seems to be hidden in finder. it is 2.04 gb. meanwhile it seems according the whatsize, there is a file in the location from which i removed asl.log (private / var...), also called asl.log that is 2.03gb!!! ???

So I dont understand which one is in use etc etc...

this has been one confusing experience.

Restart and then empty the trash with the Option key held down. If that fails, enter the following in a Terminal window: (With no spaces after the tilde! I repeat… NO SPACES AFTER THE TILDE (~)! Deviation will most assuredly delete important files.):

OK it seems to have been sorted. Files are gone and so far have not returned in that size at all.

Generally speaking though, I wonder if you all think any of this could be connected to the problem I was having.

1. I have noted in the last month or two, since installing an extra 1gb of ram from crucial, which the machine has recognised, that things are running a little slower. I dont know if the ram thing is connected. For example, slider bars at the side of firefox windows are sticky far more often, and when using the expose show all windows function the animation is a lot less smooth - juttering a bit.

2. The computer sometimes freezes when I use front row.

3. I use automator to run a process of accessing a web link through safari about every 550 minutes all day. Automator opens the safari window and access the web page, then it uses an applescript to close the window. While I sit at my computer and work this all runs smoothly and the windows close, but if i go out for the day and leave it running at some point pretty quickly it stops closing the windows and after a day there could be as many as 80 open safari windows on my machine - I usually just quit safari to close them.


Let me know if you think any of this could be related to the log errors, and what you think about the other problems.

Your help, my friends, is greatly appreciated and I hope I can return the favour.

Thanks

DDD

It's hard to tell, but you could download "memtest" (http://www.memtestosx.org/) and let it run. Do the FULL test, even though it takes a very long time to run. That should tell you if there's any problems with your memory, and where it might be. If the Crucial memory is faulty, they have a superb return policy.

Joe VanZandt