Swapfile and sleepimage file creation? I recently installed an SDD into my MacPro, and was paying attention to the storage used, both to be comfortable the SSD size was going to be enough, and also that the TM backup hard drive wouldn't fill too fast. This morning I noticed the /private/var/vm folder had swapfiles totaling 64GB. My question would be how to reduce this and to understand why it happens. The SSD size is only 128GB, and was running 60GB or so. This runaway issue was about to create a 'no room' problem, although I suppose that would have forced a reboot anyway. 

I read What are the “sleepimage” and “swapfile” documents? and it warned not to delete these files. I searched some more, and found that a reboot wiped it all out. After the boot, there’s one swapfile of 67MB, versus the 64 files each a full GB. 

I never saw this before. I understand a reboot is the answer, but is there anything to do to prevent it occurring? I’d at least like to understand what process or app set this in motion.  

I am running 10.6.8 Snow Leopard
Probably one (or more) process on your system was running wild.

Use your Mac as usual. From time to time check the folder /var/vm and if you run across a lot of swap files open Terminal.app and enter:

ps xa | awk '{print $1}' | xargs -n 1 sudo vmmap | grep -A3 'Summary' &gt; /Users/YourUserName/Desktop/vmmap_summary.txt


Depending on the number of running processes this will take about 30-60 seconds. Your account has to be able to run sudo (=usually an admin account).

This creates a text file called vmmap_summary.txt on your desktop which contains some memory and swap information of all running processes sorted by PID. Some will fail because their process id is already gone.

Example (truncated to the first four PIDs):

==== Summary for process 1
ReadOnly portion of Libraries: Total=51.8M resident=12.9M(25%) swapped_out_or_unallocated=38.9M(75%)
Writable regions: Total=92.9M written=808K(1%) resident=2112K(2%) swapped_out=0K(0%) unallocated=90.8M(98%)

==== Summary for process 21  
ReadOnly portion of Libraries: Total=77.0M resident=30.9M(40%) swapped_out_or_unallocated=46.1M(60%)  
Writable regions: Total=88.5M written=1116K(1%) resident=5144K(6%) swapped_out=0K(0%) unallocated=83.4M(94%)

==== Summary for process 22
ReadOnly portion of Libraries: Total=150.1M resident=60.1M(40%) swapped_out_or_unallocated=90.0M(60%)
Writable regions: Total=93.2M written=1460K(2%) resident=5440K(6%) swapped_out=0K(0%) unallocated=87.8M(94%)

==== Summary for process 23
ReadOnly portion of Libraries: Total=77.2M resident=31.3M(41%) swapped_out_or_unallocated=45.9M(59%)
Writable regions: Total=96.9M written=1412K(1%) resident=2036K(2%) swapped_out=0K(0%) unallocated=94.9M(98%)


Check for any bad behaving process (swapped_out>>>0k).

To get the process name of a misbehaving PID and some more information enter:

ps aux | awk '$2 == PID  { print $0 }'


Example output for a process with the ID 21 — ps aux | awk '$2 == 21  { print $0 }' — would be:  

root              21   0,0  0,0  2507740   6552   ??  Ss   10:03am   0:01.48 /usr/libexec/kextd


Now hunt down what may be wrong with the app or daemon.