i feel your pain sir! i myself have gone down this rabbit hole and well thats how i found you. My MacBook air is constantly out of space. Yet i don't even have my resume on my own computer because its always out of drive space. i might as well own a chromebook

I have macos sierra. I want to add some log files of my application into tmp directory (/var/folders/q1/pp3rvw2n2y78bdhft8clvbkr0000gn/T/). For the same reason my program is creating one dictionary into above location and adding log files into it. But after restarting the macing the newly added directory and the files are automatically wiped out.

I want to keep this files on same location for further use. Any idea stop the wiping the some files from above location while system is rebooting?

Maybe you are using the API's, but the "tmp" directories are exactly that, temporary. The system will clear them out periodically, and restart is one of those times.

as of in 2024 today, i am having 2021 folders and files still in my company PC. the most annoying thing is they get indexed by Spotlight search and popup on top of my real targets.

I wouldn't do this. It is always best to use logging API's and even if you don't want to do that and you're going to manually do your logging it is best to log to either /var/log/ (for system apps) or ~/Library/Logs (for user apps).

Looking for detailed information on obscure workings of OS X can be very difficult, so thanks for this excellent page!

Just quickly wanted to let you know, that my Mac refused to start up again, after I deleted the /var/folders folder for some LaTeX/Biber/BibTeX-reasons. I already thought about reinstalling OS X, but then I just recreated an empty folders folder via the Terminal on the OS X Recovery-Partition on my HDD and it startet again.

Been there buddy, my system is still completely tossed.

It's now 2023. Latest mac version is Ventura 13.5.
I'm currently at High Sierra having just upgraded from Sierra. I had this issue immediately with HS as well as some corrupt files.
I want to know if this got fixed in any of the versions since High Sierra? I don't want to jump to Ventura as that big of a jump is down right scary!
Please let me know as soon as you can.

Hi everyone, I renamed the var/folders/ to var/folders___ and after restarting the mac - it didn't load the OS, - anybody can help how can I rename it back ?

I tried to connect terminal and tried with SUDO to rename it back but it says have not permission to rename it because they are read-only.

Thanks

I wrote this specifically to answer that question: http://www.magnusviri.com/O...

Thank you James for your answer, I reinstalled the system, the next time will follow your answer.

James, thanks for so detailed post. Some things are clear now for me.

My /var/folders are 7.3G. Interesting thing, that after Xcode removal (which is about 10G) I didn't noticed any freeing of space on my 128G SSD. That lead me to investigate which folders and what files are occupying space on my Mac.

I see that /var/folders/* content could be harmlessly removed, although will better keep an eye on that, for self interest.

I still do not understand why they had to create a new directory /var/folders. Why not use a subdirectory in /tmp or /var/tmp?

It makes about as much sense as naming a folder "folders".

I think that the justification is that if the folder doesn't exist yet under /tmp then another user can create /var/folders/{uid} and either take control or block the "rightful owner" from using it.

Thank you for this detailed explanation of the /var/folders directory! We're a school board with a load of MacBook Air laptops with teensy SSD drives, so we kept running out of space until we discovered the accumulating cache files in this directory were the culprit.

Our solution was to create a LogoutHook script in /var that retains the top level folder structure but deletes the cache files contained within, freeing up space. Thus the contents of "cleanuponlogout.sh" are:

------
#!/bin/sh

#

# Delete the contents of items in /private/var/folders/ to free up disk space

cd /private/var/folders

for file in */

do rm -Rf /private/var/folders/$file*

done

------

and we run the following command to add the LogoutHook to /var/root/com.apple.loginwindow.plist:

defaults write /var/root/Library/Preferences/com.apple.loginwindow LogoutHook /private/var/cleanuponlogout.sh

This eliminates the SecurityAgent error on logout because the folder structure remains the same.

(sorry, not sure how to format code in this editor)

Thank you, but how did you mass deploy this?

There are several ways to mass deploy stuff like this. The easiest is Apple Remote Desktop. More more complicated solutions include Ansible, Radmind, Puppet, etc. I use Radmind to mass deploy stuff to my computers. Mass deployment is a pretty broad topic and there are a lot of resources out there for accomplishing it.

Hi I'm Jason

and I did the unthinkable. I deleted the var folder on my mac. I was on low storage memory with my Mac book air so i saw a folder called private and the var folder took up about 6 gb. By the way I had about 2 gb left on my computer so i thought I should just delete it. I delete the Whole "var" folder and I was like heck yeah more storage! so i continued to securely empty my trash. It was still deleting when I went on the internet to actually search what the var folder was for and then. google chrome had a error i had never really seen before so i totally flipped out and realised the var folder was IMPORTANT. I cancelled the secure empty trash and tried to return the var folder to its place in the private folder. BAM! There was another var folder. so I deleted the new var folder so i could put the old one back. it would tell me i couldn't delete it. so i freaked out i couldn't do anything. I restarted my computer then it was totally stuffed up. I couldn't even log in anymore. i would log in a loading bar appeared under the apple sign then it freezes and a bunch of codes came up then it restarts and sends me to the login screen again.

please help I totally stuffed up my mac and i don't know what to do. and if you can't help i'll go to the apple store to get it fixed.

Boot to the Recovery Partition and restore from Time Machine backup.

http://support.apple.com/en...

If you don't have a Time Machine backup, go to Apple Store, have them fix your computer, and setup Time Machine backup.

I did exactly this lols

I've noticed that the /var/folders tree is used extensively by the Migration Assistant as well as the OS X installation programs. Everything gets copied there first and then moved into it's final destination but not sure why all this extra work (as opposed to installing it in the ultimate location the first time). Would think this would make the installation go a bit more quickly, but not sure what they are trying to accomplish with the current way it's done. Do you have any ideas?

I'm pretty sure I know exactly why they do it. If the process fails the last thing you want is a half migrated or half updated hard drive. By putting it in a temporary location they make sure all of the files are on the disk before starting to make real changes to the system. The downside of this is that it fails if the disk space is too small.

In fact you are better off also listing the owners of the folders. For instance here is what I get with 'ls -lah /var/folders/zz':

total 0
drwxr-xr-x 19 root wheel 646 Aug 12 22:39 .
drwxr-xr-x 6 root wheel 204 Aug 19 12:38 ..
drwxr-xr-x 6 root wheel 204 Oct 19 16:20 zyxvpxvq6csfxvn_n0000000000000
drwxr-xr-x 3 _networkd _networkd 102 Oct 19 16:18 zyxvpxvq6csfxvn_n000003000000r
drwxr-xr-x 4 _lp _lp 136 Oct 19 20:22 zyxvpxvq6csfxvn_n000003800000t
drwxr-xr-x 4 _appleevents _appleevents 136 Oct 19 16:18 zyxvpxvq6csfxvn_n000006w00001q
drwxr-xr-x 4 _mdnsresponder _mdnsresponder 136 Oct 19 16:18 zyxvpxvq6csfxvn_n0000084000021
drwxr-xr-x 4 _spotlight _spotlight 136 Oct 19 16:18 zyxvpxvq6csfxvn_n00000b400002s
drwxr-xr-x 4 _securityagent _securityagent 136 Oct 19 16:18 zyxvpxvq6csfxvn_n00000bh00002w
drwxr-xr-x 4 _atsserver _atsserver 136 Oct 19 16:18 zyxvpxvq6csfxvn_n00000c4000031
drwxr-xr-x 3 zmwang staff 102 Oct 4 00:55 zyxvpxvq6csfxvn_n00000cc000033
drwxr-xr-x 4 _softwareupdate _softwareupdate 136 Oct 19 16:18 zyxvpxvq6csfxvn_n00000s0000068
drwxr-xr-x 3 Guest _guest 102 Aug 15 23:02 zyxvpxvq6csfxvn_n00000s4000069
drwxr-xr-x 4 _coreaudiod _coreaudiod 136 Oct 19 16:18 zyxvpxvq6csfxvn_n00000s800006_
drwxr-xr-x 4 _locationd _locationd 136 Oct 19 16:18 zyxvpxvq6csfxvn_n00000sm00006d
drwxr-xr-x 2 _timezone _timezone 68 Oct 16 17:27 zyxvpxvq6csfxvn_n00000t800006k
drwxr-xr-x 4 _cvmsroot _cvms 136 Oct 19 16:18 zyxvpxvq6csfxvn_n00000th00006m
drwxr-xr-x 3 _usbmuxd _usbmuxd 102 Oct 19 16:18 zyxvpxvq6csfxvn_n00000tm00006n
drwxr-xr-x 4 _netbios _netbios 136 Oct 19 16:18 zyxvpxvq6csfxvn_n00000vr00006y

From this I'd argue that you shouldn't create missing folders yourself, or at least you should do the right chown after that (provided that you know the rightful owner). Otherwise you might run into deeper trouble.

Nice and informative article, though. Great job!

If I indeed get the "Unapproved caller" error, I'm installing Linux.
The only good thing I find in OSX after using for a year is the multi-touch gesture controlled Safari!

> I messed up the /var/folders permission accidentally with chown -R...

You know, chown -R is one of the most dangerous things, probably next to rm -rf, when you are working in system directories. You can't blame that on /var/folders being a stupid name.

> The only good thing I find in OSX after using for a year is the multi-touch gesture controlled Safari!

YMMV, but there are many fine things about OS X. Especially for design maniacs — the open source community has an abundance of great developers but a lack of decent designers. (For the record, I love open source; I'd say 80%–90% of my software by usage — other than OS builtins — is free and open source). If I'm gonna look at the GUI of Ubuntu/Debian/Fedora/Mint/openSUSE/Arch all day long... God, I don't even want to think about that. For me, Linux is tty only.

Also, if you've been using OS X for a year and only found SAFARI likable, then there's nothing I could say... If you want multitouch gestures, I believe Opera has a host of multitouch gestures (along with many more features), though I seldom use them (keyboard guy here). To me, Safari wasn't even an option before 10.10 — except for Reader view. (By the way, I do like Safari now due to the revamped design).

Yeh, this might be surprisingly helpful if all things fail. I messed up the /var/folders permission accidentally with chown -R because of a homebrew error I got, now I'm getting all sorts of permission errors.

Well, I'd try zapping the whole thing now since it'd be recreated launchd. IMO if it fails to boot after this (as I read that's the consequence in another place) it'd be extremely stupid, undocumented random hash named folders in "/var/folders" (WHAT A NAME!) which is supposedly cache causing boot failure.

Just taking a look at the folder structure in /var/folders/zz/ and looking at your script to recreate the folder structure, I noticed that /var/folders/zz/zyxvpxvq6csfxvn_ngzzzzzvzzzzzy does not exist on some of my machines. Notably on some of our public lab machines that were imaged with 10.9.4 back in August. On my personal machine /var/folders/zz/zyxvpxvq6csfxvn_ngzzzzzvzzzzzy does exist however. Not sure the significance of this folder, or if its required by the system.

It doesn't matter if the folder exists so it wont hurt if you create it. If any of the folders I listed are missing, as I found, you could get errors. I think I once saw an official list of what was required but I don't remember how it compared to my list. Either way, too many folders wont hurt anything.

I'm not having the "Unapproved Caller" error message but I have been dealing with full hard drives even though we periodically remove user home folders it seems that /private/var/folders is filling up. I'm going to test the script next week on our systems. Thanks for the info and the comment discussion was super helpful as well!

Thanks for the info. We're at a large university and our /var/folders was getting out of hand, over 1500 unique folders! Looks like we'll end up removing each one per user at logout, or when we clean out the users home folders after they exile (48hours). We were not watching this folder before, now we are! Thanks, Rusty

We're discussing how we want to tackle this issue now. Unsure if we should purge /var/folders/ when we purge the home folder, or purge the entire /var/folders/ on a regular nightly or weekly basis. We are leaning towards removing these files when we purge a home folder after 4 days of inactivity. Is anyone doing this nightly or weekly? Have you seen a performance hit?

Have you filed a problem ticket with Apple? We filed an Apple Enterprise ticket and they acted like we are the only one having issues with drives filling up do to /var/folders.

Any time you remove caches that will slow things down on the next login. I have no idea what a good time is. You could write a script that gets the size of all of the folders and empty it when it goes over a certain amount. Or you could just set periodic time. I never measured delays when removing caches, but they were noticeable.

thanks for thorough explanation!

Thanks for this article James, wish I had seen it before I went through this “Unapproved Caller” issue trying to upgrade to 10.9.4 yesterday. I followed similar instructions to remove /var/folders here: http://forums.macrumors.com..., but I was a bit hesitant because I didn’t know what I was zapping. The ends justified the means, as my machine appears to work fine now, but it was great to get a clear and thorough explanation of the problem.

Glad to help!

I tried an "online fix" for reindexing spotlight correctly which included the steps -

rm -Rf /var/folders and restarting the Mac.

Unexpectedly, encountered the "Unapproved Caller" error.
Maybe, a disk repair or PRAM reset would have fixed it.
But, by then had network reinstalled the OS.

Just came across this today after seeing a SuperDuper backup which was 20G smaller then the original , with /var/folders (which SuperDuper doesn't copy) being the lion's share of that.

After a reboot from the SD clone and a cleanup, /var/folders was down to 1GB (which is still a fairly sizeable chunk of cache) but then it climbed to 5GB. I noticed that it seemed to be creating folders in there for a number of users which have not logged in since the reboot, and I also noticed that there were com.apple.IconServicesAgent processes running for those users - and some of these users are not even normal users but role users e.g. macports and smbup.

What on earth can that be about?

Note - I really wouldn't rather post as guest, but I tried to sign up with google AND Facebook, and in both cases, Disqus wanted me to then create a full account. Thanks, but I really don't want one more account.

This is why we empty the folder out regularly. We've also noticed gigantic sizes. I doubt the folks at Apple who designed IconServicesAgent realize what is going on. Best thing is to submit a bug at http://bugreporter.apple.com. I seriously don't think anyone at Apple realizes that one computer could see 100+ users log in to it. It seems like all most of them think their computers are always one-to-one and when we say we have 1000's of unique users they can't figure out how it's possible. Blogs like mine probably exist to explain how to use the OS in these situations because most at Apple don't realize some computers are being used this way.

I guess the gist of my post is that if you empty /var/folders (and I think it should be emptied periodically but it's not), create the default structure that I listed above or else you could get an unbootable computer.

About Disqus, it was an extremely easy way to do comments for my blog. If it weren't for Disqus, I wouldn't have comments at all. I'm glad it allows guest posts.

Since I've written that last post I've been keeping an eye on my Mac. It's bad enough that it's using 1GB of disk space for some kind of cache (that really is a huge amount of cache for a user's desktop) but it's much worse - it repeatedly ups that to 5GB with folders for several other users on my machine - two normal users, and macports and smbup, which are Unix accounts but not Mac accounts, if you follow me.

To add insult to injury, there are also com.apple.IconServicesAgent processes running for each of these users, which cumulatively used up more than 600 MB of RAM. Now THAT is annoying, though fortunately not as annoying as it would have been pre Mavericks.

I'll submit a bug as you suggested, but I wonder if any attention will be paid.

About DIsqus, I only moaned about the guest post thing because it offers to let me sign in with various systems, but then wants me to create an account anyway, so why offer the other system sign in?

So, I logged a bug with Apple (ID #16331134 ) and I see that it's listed as "Duplicate of 16338665" which I can't find when I search - presumably its content is private to Apple, if not its existence.

To muddy the waters even more - all day today I don't see the extra processes at all. Over the weekend, I had a thought to stop the creation of the folders, which was that I created a file in place with each folder's name. This seemed to cause consternation, as the processes started and consumed loads of CPU to which I was alerted by the sound of my fans.
I deleted the blocker files, and then with some difficulty killed the processes. Now I don't have the random extra processes. I DO have the extra folders, but the spurious ones are now each < 200K rather than 1 GB - I can live with that.

I don't know if this is helpful or not, but since this is likely to be a place where people find/share information about /var/folders/ I'll throw it out there.

In 10.9 (either 10.9.1 and/or v. 10.9.0) I found that IconServicesAgent was using an extremely high amount of CPU. I came across a forum post (on Apple's Discussion Forum, I believe) which pointed me to this https://gist.github.com/sgr... which suggested running `mkdir ${TMPDIR}/com.apple.IconServices` and so I added this to my ~/.zshrc:

# Begin

ICONDIR="${TMPDIR}/com.apple.IconServices"

if [ ! -d "$ICONDIR" ]
then

echo -n "$NAME: Creating $ICONDIR... "

mkdir -p "$ICONDIR"

chmod 777 "$ICONDIR"

echo " done."

fi

# End

The purpose being that I wanted to know when that folder was created, if it was created.

I found that it _did_ effectively solve the problem of making the CPU drop, however the system did demonstrate missing icons.

I have not seen this folder missing lately, and have not seen the CPU rise to such a high level. I don't know if it's a coincidence or if it was fixed in 10.9.2.

FWIW…

So what did the solution to fixing the Unapproved Caller message? I get it now also, I got it after testing a file and locking the Var folder. It began saying Unapproved Caller, so I went back to the Var folder and took off the Lock I put on it. Then it worked fine again. I added the lock one quick time, test reasons. Then wanted to add a admin to the get info /Var folder, but it wouldn't let me add because the lock was closed on the get info window for /var So the message had appeared again. But now, I am stuck with it, because before the lock was open on the Get info window for /var. This time it was locked, and gave me the Unapproved Caller message.

Same boat as you, setting up macs, and ran into this.

Let mek now if you had an actual fix. I cannot access any systemwide changes, nor the directory utility.

Thank you in advance,

Alan Andrews

Alan,

I'm not sure what you're describing. Did you select the "/var" folder (which is very different from "/var/folders") in the Finder, get the "Get Info" panel and then check the "Lock" checkbox? That's probably a bad idea. The /var folder is is extremely important and shouldn't be changed at all or else the computer might not boot at all. If that's what happened then you should try to reverse it. This link describes how to unlock a file from the command line.

http://blog.magnusviri.com/...

Or just this: chflags nouchg /var

To get command line control of the computer, try to ssh in if you've got it enabled, or boot to single user mode. I talk about that in the next link.

http://blog.magnusviri.com/...

Hope that helps.

As far as the "Unapproved Caller" message goes, if I deleted "/var/folders" and then recreated it with the required structure that I talked about in my post then it worked fine. I've been checking my computers every day and I haven't seen any problems since I started doing this.

James, yes I was talking about the Var/folders/ zzzzzzzzz "etc.

But what I had done is given myself permission to the Var folder, then locked it for a moment. Basically that is what did it. The problems began there. Since then logged in single user mode, and actually sudo rm -r f /some of the zzzzzzzz files. Once I deleted those I reboot, reset the SMC, option booted into recovery mode, fixed permissions and made sure disks were repaired. Although I never really have faith in either one of those tasks. I proceeded to reboot, and install via network. So once the OS 9.2 was downloaded and ready to go, I just did one more thing. I opened terminal and typed in resetpasswords and a window will open for you to clear the cal and add a new PW.

Installed the OS, started it and worked perfectly. Crossing fibers tightly now. Because I know how it goes all too well. But maybe luck on my side.

Thanks again, James.

Alan Andrews

Senior Visual Designer

alanandrews.net

James,
How did you recreate the structure? Maybe I just can't read correctly. I think recreating it with the required structure is the step I'm missing.