Mac not writing swap files

[kirkmc]

My iMac - mid-2017, 16 GB RAM - was running slowly today, and I checked in iStat Menus to see if there was an app hogging RAM, and I noticed that there were no swap files. The VM partition is mounted, but instead of swap files there from /private/var/vm, there's just a file called kernelcore which is just 1 MB.

+-> Volume disk4s4 79E6E0E7-4930-4C19-B3C4-8737778C8A4A
| ---------------------------------------------------
| APFS Volume Disk (Role): disk4s4 (VM)
| Name: VM (Case-insensitive)
| Mount Point: Not Mounted
| Capacity Consumed: 1074810880 B (1.1 GB)
| FileVault: No

$ ls -l /private/var/vm/
total 2048
-rw------- 1 root wheel 1048576 Jan 12 20:29 kernelcore

I rebooted in safe mode, nothing changed. I reinstalled Catalina over my current installation; nothing changed.

Interestingly, iStat Menus shows me that the change occurred around 2:09 pm last Thursday. At the time, I wasn't doing much, waiting for a 3pm appointment, and might not have even been using my Mac. I didn't install anything that day, and I don't recall updating anything.

Unfortunately, Time Machine doesn't back up log files; if it did, I'd be able to see what happened at that time.

Does anyone know what could have caused this, and what I would need to do to fix it, short of a clean install and migration?

Thanks in advance.

 

[topcat001]

Usually, on macos swap files are dynamic and will be created and deleted as needed. If you run a big memory hog, like Chrome with many tabs open for a long time, it should begin swapping and the files should appear. I would not expect to see anything after a fresh reboot.

Btw if you're still running dynamic_pager all is well. Easy to check in a Terminal:

launchctl list|grep -i pager

 

[kirkmc]

Macs are always writing to VM, once even half of the memory is used. On my MacBook Pro right now, there's 1 GB swap, even though more than half the RAM is free. Also, I can’t find anything about kernelcore, even in Apple's developer documentation.

As you can see from the iStat Menus screenshot, there is always swap file usage, and it suddenly stopped

 

[gilby101]

The iStatMenus screenshots suggest to me that the Mac did a reboot. That is exactly how mine looks at a reboot.

And on my Mac (plenty of RAM) is can be a long time before any swapfile is created. As I expect you know, macOS delays using a swap file as long as possible preferring to compress memory.

Edit:

Looked again at your original post. There is something odd in that the VM volume is not mounted. Mine is like this:
| +-> Volume disk1s4 4D3944BE-46CB-49F4-BB73-0E6401546C98
| | ---------------------------------------------------
| | APFS Volume Disk (Role): disk1s4 (VM)
| | Name: VM (Case-insensitive)
| | Mount Point: /private/var/vm
| | Capacity Consumed: 2148552704 B (2.1 GB)
| | FileVault: No
| |

And that is with no swapfile created created (free memory is still just over 2GB)
% ls -l /private/var/vm
total 4196352
-rw------- 1 root wheel 1048576 13 Jan 08:58 kernelcore
-rw------T 1 root wheel 2147483648 17 Dec 19:48 sleepimage

Are you sure that your diskutil extract was for the boot disk and not for a clone (or similar)? It is unusual for the boot disk to be disk4.

launchctl list|grep -i pager

That gives nothing on my Mac (10.15.2).

 

[kirkmc]

The Mac was running the whole time.

 

[topcat001]

That gives nothing on my Mac (10.15.2).

My bad; I did not fully explain. Exactly as you said, the swapfileX files will not be there unless the system is actually swapping. macos tends to compress memory as much as possible before it will swap.

The dynamic_pager daemon manages swap files and is run on demand, so no wonder it does not show up on a random ps listing. It does not run all the time. The following command is better for verifying that the paging service is running.

$ sudo launchctl list|grep -i pager
-       0       com.apple.dynamic_pager

The - in the first column means it is not currently running (but the service is active), 0 is the return code from the last run (success).

Good catch on the unmounted disk. For sure something is unusual! I suggest the OP post the full output (and also the exact commands used) of diskutil. Can we see your output for the following:

diskutil list
diskutil ap list

 

[kirkmc]

The VM volume is mounted; it shows the mount point. If it wasn't mounted, then it wouldn't show a mount point there and would say Not mounted. And, if I cd to /private/var/vm, then run open ., it opens in a Finder window, with a disk icon rather than a folder icon, showing that it is mounted as a volume.

Re the commands above, here is the output, just for the startup volume (I have several external disks connected).

$ diskutil list


/dev/disk0 (internal, physical):


#: TYPE NAME SIZE IDENTIFIER
0: GUID_partition_scheme *500.3 GB disk0
1: EFI EFI 314.6 MB disk0s1
2: Apple_APFS Container disk1 500.0 GB disk0s2


/dev/disk1 (synthesized):

#: TYPE NAME SIZE IDENTIFIER
0: APFS Container Scheme - +500.0 GB disk1
Physical Store disk0s2
1: APFS Volume Mac SSD - Data 336.3 GB disk1s1
2: APFS Volume Preboot 80.1 MB disk1s2
3: APFS Volume Recovery 528.5 MB disk1s3
4: APFS Volume VM 3.2 GB disk1s4
5: APFS Volume Mac SSD 10.8 GB disk1s5


-----


$ diskutil ap list
APFS Container (1 found)
|
+-- Container disk1 13E8A044-3567-4673-BD80-3F8E123FE8B2
====================================================
APFS Container Reference: disk1
Size (Capacity Ceiling): 499963170816 B (500.0 GB)
Capacity In Use By Volumes: 350962331648 B (351.0 GB) (70.2% used)
Capacity Not Allocated: 149000839168 B (149.0 GB) (29.8% free)
|
+-< Physical Store disk0s2 0C9A6C8A-3AD7-4A33-9848-EA86806169D4
| -----------------------------------------------------------
| APFS Physical Store Disk: disk0s2
| Size: 499963170816 B (500.0 GB)
|
+-> Volume disk1s1 1BDDB11C-AFAD-44F6-AF3F-C0663E701BAB
| ---------------------------------------------------
| APFS Volume Disk (Role): disk1s1 (Data)
| Name: Mac SSD - Data (Case-insensitive)
| Mount Point: /System/Volumes/Data
| Capacity Consumed: 336145854464 B (336.1 GB)
| FileVault: Yes (Unlocked)
|
+-> Volume disk1s2 D69E5974-5181-4410-A239-54B40A099241
| ---------------------------------------------------
| APFS Volume Disk (Role): disk1s2 (Preboot)
| Name: Preboot (Case-insensitive)
| Mount Point: Not Mounted
| Capacity Consumed: 80105472 B (80.1 MB)
| FileVault: No
|
+-> Volume disk1s3 9B8016AF-E236-4463-9A4A-6B59B5305C41
| ---------------------------------------------------
| APFS Volume Disk (Role): disk1s3 (Recovery)
| Name: Recovery (Case-insensitive)
| Mount Point: Not Mounted
| Capacity Consumed: 528498688 B (528.5 MB)
| FileVault: No
|
+-> Volume disk1s4 4A97B1EB-252A-4884-AA32-EE92337E03E6
| ---------------------------------------------------
| APFS Volume Disk (Role): disk1s4 (VM)
| Name: VM (Case-insensitive)
| Mount Point: /private/var/vm
| Capacity Consumed: 3222364160 B (3.2 GB)
| FileVault: No
|
+-> Volume disk1s5 9938750C-4369-4E66-A942-44889F603B6D
---------------------------------------------------
APFS Volume Disk (Role): disk1s5 (System)
Name: Mac SSD (Case-insensitive)
Mount Point: /
Capacity Consumed: 10823806976 B (10.8 GB)
FileVault: Yes (Unlocked)

 

[topcat001]

Thanks, yes indeed vm is mounted. In your original listing (first post) the vm volume was disk4s4 and not mounted, and we were wondering where that came from. The current listing is what we expect to see.

As mentioned earlier, the swap files will show up at some point when the system is actually using them.

 

[kirkmc]

As mentioned earlier, look at the screenshot from iStat Menus. It shows a sudden stopping of swap. The Mac was not restarted at that time, and swap is pretty much always used on a Mac with 16 GB RAM. The swap was definitely needed when I noticed this on Sunday, as I was editing photos and every action took about ten seconds to display, which is not the usual performance on my Mac.

 

[topcat001]

I was just going to comment about that. It seems something happened at that time which led to all the swap being freed. I'm puzzled about that.

Could you please run:

sudo launchctl list|grep -i pager

and see if the dynamic_pager service is listed? This is a read only command and should not alter anything.

 

[kirkmc]

- 0 com.apple.dynamic_pager

 

[topcat001]

Ok so at this point in time everything *looks* normal. Are you still experiencing any slowdowns?

 

[gilby101]

+-> Volume disk1s4 4A97B1EB-252A-4884-AA32-EE92337E03E6
| ---------------------------------------------------
| APFS Volume Disk (Role): disk1s4 (VM)
| Name: VM (Case-insensitive)
| Mount Point: /private/var/vm
| Capacity Consumed: 3222364160 B (3.2 GB)
| FileVault: No

I am glad we have sorted out the mixup over disks. That looks much better.

The Capacity Consumed is almost exactly what I have right now for my iMac which has a 1GB swap file. Looks 'normal', as @topcat001 says.

How much of the 1GB is being consumed. On my iMac, iStatMenus tells me it is 116MB out of 1GB. What does yours say?

And what does ls -l /var/vm say now? Mine is like this
% ls -l /var/vm
total 6293504
-rw------- 1 root wheel 1048576 13 Jan 08:58 kernelcore
-rw------T 1 root wheel 2147483648 17 Dec 19:48 sleepimage
-rw------- 1 root wheel 1073741824 14 Jan 11:38 swapfile0

 

[kirkmc]

So I spent about an hour and a half on a call with Apple. Just before I got to the senior advisor, when I launched a bunch of apps, my Mac started writing swap again. It wrote one file, but only wrote 5 MB of swap. We did a screen sharing session, and the advisor could see how much Photos was lagging; it barely wrote swap, even though there was a lot of RAM used. (I had several photo editing apps open.) Since then, the Mac Mac been using swap correctly.

The AppleCare guy said he had never seen anything like this. He thinks it's a hardware issue, because I did re-install Catalina, start up in safe mode, etc. He had me collect a bunch of data and he's passed it on to engineers to see what they think. His thought is that there's something wrong on the logic board that affects I/O, memory transfer, etc.

And he couldn't find anything about that kernelcore file, which is being rewritten or at least touched at each reboot.

 

[topcat001]

Very interesting! I have been seeing the kernelcore file appear on my Catalina macs, but have not found any official docs describing it. I'm fairly familiar with the kernel architecture of macos but my knowledge lags behind by a few OS releases, in other words a bit outdated on specific details.

However, I think kernelcore is part of the hybrid sleep image. The basic kernel state is saved in kernelcore, the driver state and some app state in sleepimage, and the rest in swapfiles. You'll often see swapfiles appear across a sleep/wake, if they didn't exist before.

 

[kirkmc]

There’s no sleep image on a desktop Mac; my MacBook Pro doesn’t have that file. Even the Apple guy had never heard of it before, and found nothing in his resources.
Also, there were no invisible files in that directory.

 

[topcat001]

sleepimage will be there if hibernation is enabled. It is the hibernation image. For example:

$ pmset -g

shows

System-wide power settings:
Currently in use:
 standbydelaylow      4200
 standby              1
 halfdim              1
 hibernatefile        /var/vm/sleepimage ******
 powernap             0
 gpuswitch            0
 disksleep            10
 standbydelayhigh     4200
 sleep                10
 autopoweroffdelay    28800
 hibernatemode        3 ******
 autopoweroff         1
 ttyskeepawake        1
 displaysleep         5
 highstandbythreshold 50
 acwake               0
 lidwake              1

In the above I have marked the hibernation settings with ******. kernelcore is undocumented in the public docs AFAIK.

 

[kirkmc]

Yes, but it’s not enabled by default on desktop Macs.

hibernatemode = 0 (binary 0000) by default on supported desktops. The system will not back memory up to persistent storage.

 

[gilby101]

hibernatemode = 0 (binary 0000) by default on supported desktops

I know that is what 'man pmset' says, but that is not my experience with Catalina. Clean build of 10.15.2 on iMac 2019 has hibernate mode = 3.

What does pmset -g say for you?

There’s no sleep image on a desktop Mac

So what is consuming your 3GB VM volume? I am guessing it is just like mine with 2GB sleep image and 1GB swapfile0. Of course, if you have rebooted since showing the 3GB VM, it may be different by now.

 

[kirkmc]

It's hibernate mode 0

I'm guessing that the volume is larger than necessary. It's probably a sort of sparseimage, but is likely larger than needed to provision for the next swap file.

But there's no sleepimage; just three swap files and kernelcore.

 

[topcat001]

It seems on your machine hibernatemode = 0 (somehow, "pmget -g" please), and typically each swapfile = 1 GB, kernelcore = 1 MB. All of this adds up to 3 GB (a "ls -lh /var/vm" will confirm my guess).

The swap files are themselves "sparse", used as necessary. Apart from metadata, all used space should be in files.

 

[Biscotti]

Has there been any updates on this?!

 

[gilby101]

Has there been any updates on this?!

What aspect are you referring to? As far as I am concerned the use of hibernatemode and sleepimage/swapfile has not changed. And there have been no major changes to macOS memory management - even with the introduction of M1 Macs.

 

[Biscotti]

What aspect are you referring to? As far as I am concerned the use of hibernatemode and sleepimage/swapfile has not changed. And there have been no major changes to macOS memory management - even with the introduction of M1 Macs.

I just picked up a refurbished 16GB RAM M1 MBP 13" and it would not compress files or swap memory. I could take it to red by opening all my apps and it still would not swap or compress to memory.

I reinstalled the OS and since it seems to be better, and now is writing to Swap. It's still not swapping as much as my 3 other machines, but it's also my first and only 16GB M1.

 

[gilby101]

I just picked up a refurbished 16GB RAM M1 MBP 13" and it would not compress files or swap memory. I could take it to red by opening all my apps and it still would not swap or compress to memory.

There are settings to block all compression and swapping. Maybe these were set when you got it. But you have now cleared that by...

I reinstalled the OS and since it seems to be better, and now is writing to Swap. It's still not swapping as much as my 3 other machines, but it's also my first and only 16GB M1.

For a long time, macOS and OS X have been biased towards compressing and only swapping (paging to disk) when really needed. It is not unreasonable to assume there are some minor differences to the compression and swapping parameters in M1 Macs. But I have not seen any commentary on this from someone with sound knowledge of the kernel.