Sneaky downloads? 22Gb lost!

[Sciuriware]

Hi all,

yesterday evening I noticed high activity on my UTP hub between Internet
and my Mac Studio. The Activity Monitor showed full speed downloads to a process
by the name 'nsurlsessiond'. The process stopped at ±9Gb and then restarted again
a few times. Afterwards the total received data at the bottom showed some 22Gb.

Meanwhile I found that my free space had dropped by the same amount.
(there was no other activity on the system, even not mine)
I scanned the disk for files larger than 9Gb only to find my own files.

My Mac Studio still runs MacOS 12.6.8, while 'Software Update' invites me to
upgrade to 13.5.1 which would download ±12Gb. For a moment I thought that APPLE
was secretly preloading Ventura but the amount of data involved does not match.

Finally: I do NOT have ANY subscription service other than MacOS automatic updates.
If this phenomenon has anything to do with preloading of upgrades,
I would fear for people with smaller disks than mine (2Tb).
Anyone?
;JOOP!

 

[Mike Boreham]

Nsurlsessiond is all about iCloud syncing. Sustained use is probably associated with iCloud Photos.

 

[Sciuriware]

I don't have iCloud; never had either.
;JOOP!

 

[Sciuriware]

Nsurlsessiond is all about iCloud syncing. Sustained use is probably associated with iCloud Photos.

And: I compared the entire disk (as far as MacOS allows me) to my archive and backups: no files added.
Where oh where are those 22Gb?
;JOOP!

 

[Sciuriware]

I don't have iCloud; never had either.
;JOOP!

Surprise: running Disk Utility First Aid seems to reveal a preloaded system update.
Am I the only one?

;JOOP!

 

[skottichan]

I'm not sure, but I think that's just the reference to what version you're running.

I found it on mine, and it's listed as only a snapshot, and when searching for it in Finder, it doesn't exist.

 

[Sciuriware]

I'm not sure, but I think that's just the reference to what version you're running.

I found it on mine, and it's listed as only a snapshot, and when searching for it in Finder, it doesn't exist.

Finder will NEVER find virtual volumes; example: double click an .dmg
It will expand, mount, show up in the left column, but you will never find it anywhere on the system (-disk).

Still, my 22Gb are gone .....
;JOOP!

 

[skottichan]

Here, this may help?

View APFS snapshots in Disk Utility on Mac

In Disk Utility on Mac, view a list of APFS snapshots, copy information about the snapshots, and delete them.

support.apple.com

 

[Sciuriware]

Here, this may help?

View APFS snapshots in Disk Utility on Mac

In Disk Utility on Mac, view a list of APFS snapshots, copy information about the snapshots, and delete them.

support.apple.com

Thanks, I must study on this.
See you later.
;JOOP!

 

[Sciuriware]

Here, this may help?

View APFS snapshots in Disk Utility on Mac

In Disk Utility on Mac, view a list of APFS snapshots, copy information about the snapshots, and delete them.

support.apple.com

I read it and more stuff on the Internet:
1) that's NOT the cause of 22Gb space loss,
2) keep off those snapshots.

Note: when I 'go' to System Preferences it 'invites' me to set up iCloud:
so, indeed, I do NOT have iCloud.
;JOOP!

 

[auxbuss]

Check for a large "Install blah" app in /Applications. Monterey has done this to me a few times.

If you are savvy with the command line, then ncdu is my preferred tool for locating random large files.

 

[Sciuriware]

Check for a large "Install blah" app in /Applications. Monterey has done this to me a few times.

If you are savvy with the command line, then ncdu is my preferred tool for locating random large files.

On this system there is no file larger than (say) 8Gb in|under /Applications or /System/Applications.
Besides, I had the system already screened for large files.
I do not need 'ncdu' : I wrote my own file manager tool.
Thanks anyway.
;JOOP!

 

[okkibs]

Check the mountpoint /System/Volumes/Data as that contains all the data that was added after the installation of MacOS, these are now separated from the OS. That's where the "Macintosh HD - Data" volume that you see in Disk Utility is mounted at.

You can't use Finder as that blends the OS files and the rest together, you can use ls -alh in Terminal. All the later installed apps, all the user folders, all the OS preferences, and OS updates, it all gets stored somewhere there.

The update snapshot can indeed exist on a system that was previously updated and won't indicate that an update has been downloaded. AFAIK the snapshot is only added after an update was already installed.

While nsurlsessiond is running and downloading you can use Activity Monitor to inspect the files it has open but that won't work afterwards.

The process is used for everything OS related, so as was mentioned iCloud, as well as OS updates, Safari downloads, whatever is part of MacOS or uses OS-built-in services to handle networking could potentially use it. Apple's streaming services might use it too.

From what I can see it stores some of its data somewhere in the endless voids of /private/var/folders/. For me though the network IO in Activity Monitor is at 0 bytes after a week of uptime (I do not use iCloud or any Apple services either).

 

[Sciuriware]

Check the mountpoint /System/Volumes/Data as that contains all the data that was added after the installation of MacOS, these are now separated from the OS. That's where the "Macintosh HD - Data" volume that you see in Disk Utility is mounted at.

You can't use Finder as that blends the OS files and the rest together, you can use ls -alh in Terminal. All the later installed apps, all the user folders, all the OS preferences, and OS updates, it all gets stored somewhere there.

The update snapshot can indeed exist on a system that was previously updated and won't indicate that an update has been downloaded. AFAIK the snapshot is only added after an update was already installed.

While nsurlsessiond is running and downloading you can use Activity Monitor to inspect the files it has open but that won't work afterwards.

The process is used for everything OS related, so as was mentioned iCloud, as well as OS updates, Safari downloads, whatever is part of MacOS or uses OS-built-in services to handle networking could potentially use it. Apple's streaming services might use it too.

From what I can see it stores some of its data somewhere in the endless voids of /private/var/folders/. For me though the network IO in Activity Monitor is at 0 bytes after a week of uptime (I do not use iCloud or any Apple services either).

I'm familiar with the 'modern' MacOS structure.
I use Finder ONLY to install/update applications from *.dmg files. F.e. Finder cannot see .* files.
Using Terminal (in fact some of the shell's) can be clumsy. So, I wrote a file manager ~Windows Commander.
I think that nsurlsessiond has done some updating: the App Store / Updates section is very terse nowadays;
- I keep records of some items, so I found that iMovie has been updated to 10.3.8, but only to a size of 4Gb.
Most likely some other stuff that I'm not aware of has been updated to the cost of those other 18Gb.
I can live with the idea that APPLE does not announce each and every update; if only the Russians, the Chinese
and the North Koreans keep out of my system.
I was confused, because it was about time for the monthly Monterey update, but it's still not here.
Thanks anyway for your contribution.
;JOOP!

 

[HDFan]

You use programs such as DaisyDisk and GrandPerspective to figure out which files are using your disk space.

 

[Sciuriware]

You use programs such as DaisyDisk and GrandPerspective to figure out which files are using your disk space.

Scanning with my own tools and comparing to backups must be enough.
Surely the 22Gb is buried in the system partition: invisible.
;JOOP!

 

[auxbuss]

Surely the 22Gb is buried in the system partition: invisible.

Nothing is invisible, though it might be to your homebrew. You can tell by running `df -Hl`, or just running Disk Utility.

 

[Sciuriware]

Nothing is invisible, though it might be to your homebrew. You can tell by running `df -Hl`, or just running Disk Utility.

That's how I found out in the first place; remains: where?
;JOOP!

 

[dsemf]

That's how I found out in the first place; remains: where?
;JOOP!

If you go to System Settings, do you have a pending update?

DS

 

[Sciuriware]

If you go to System Settings, do you have a pending update?

DS

No, and I know it's about time for an update.

I reviewed my latest CCC backup and found only 12Gb of transfers that agree with what I changed myself on disk.
So, definitively, those 22Gb are hidden in the system partition.

Let's close the case.
;JOOP!

 

[Fishrrman]

OP:

Here's how to find what's "hidden" on your drive:
Download DiskWave from here:

DiskWave Homepage

It's small in size and free.

Open DiskWave and go to the preferences.
Put a checkmark in "show invisible files".
Close preferences.

The DiskWave window shows you all your volumes and drives in plain English (no ridiculous graphical formats).
Click on any item "on the left".
Give DW a moment to scan and digest things.
Now, you'll see what's ON the volume, listed in order of "largest to smallest".
You can easily locate what's eating up your space.

 

[Sciuriware]

OP:

Here's how to find what's "hidden" on your drive:
Download DiskWave from here:

DiskWave Homepage

It's small in size and free.

Open DiskWave and go to the preferences.
Put a checkmark in "show invisible files".
Close preferences.

The DiskWave window shows you all your volumes and drives in plain English (no ridiculous graphical formats).
Click on any item "on the left".
Give DW a moment to scan and digest things.
Now, you'll see what's ON the volume, listed in order of "largest to smallest".
You can easily locate what's eating up your space.

Interesting.

 

[Sciuriware]

OP:

Here's how to find what's "hidden" on your drive:
Download DiskWave from here:

DiskWave Homepage

It's small in size and free.

Open DiskWave and go to the preferences.
Put a checkmark in "show invisible files".
Close preferences.

The DiskWave window shows you all your volumes and drives in plain English (no ridiculous graphical formats).
Click on any item "on the left".
Give DW a moment to scan and digest things.
Now, you'll see what's ON the volume, listed in order of "largest to smallest".
You can easily locate what's eating up your space.

Funny application, but:
1) seems to be written for Maverics,
2) did not reveal anything I could not see by my own filemanager (written in JAVA 20).
Thanks anyway.
;JOOP!