Skip navigation

Time Machine always requires deep traversal?

13599 Views 174 Replies Latest reply: Feb 18, 2014 8:41 AM by bernuli RSS
  • Pondini Level 8 Level 8 (38,710 points)
    Currently Being Moderated
    Jan 25, 2013 8:11 AM (in response to ZX48)

    ZX48 wrote:

    . . .

    What files is this a list of by the way? (I don't understnad Terminal coding much at all).

     

    Those are the files in the hidden File System Event Store, a log of changes to files and folders that OSX keeps on each disk/partition.  It's what Time Machine, Spotlight, and some other processes use to find recent changes, so they don't have to examine every file on your system to see what's changed lately.  See the blue box in How Time Machine works its Magic for more.

     

    The last one (with the UUID) is an identifier -- if OSX finds a serious problem, it will delete and replace the Event Store, and give it a new UUID, so those other processes know it's incomplete.  When Time Machine finds that, it will do a deep traversal, comparing everything on your system to the latest backup.  You'll see the "Scanning xxxx items" on the TM prefs window when it's doing that (on Snow Leopard only).

     

    We don't know just what's wrong with it, or any other way to fix it, other than deleting it.

     

    So, Safe Boot hasn't fixed the problem.

    Rats.     That did seem to fix it for a number of folks.

     

    All I can suggest is booting into single-user mode and deleting it via:

     

    sudo rm -R /.fseventsd/* 

     

    The next backup will be a lengthy one (a deep traversal), but thereafter they should be quick.

  • bernuli Level 1 Level 1 (50 points)
    Currently Being Moderated
    Jan 25, 2013 8:21 AM (in response to Pondini)

    Pondini wrote:

     

     

    All I can suggest is booting into single-user mode and deleting it via:

     

    sudo rm -R /.fseventsd/* 

     

    The next backup will be a lengthy one (a deep traversal), but thereafter they should be quick.

     

    That fix works great for me.  I don't see anything wrong with doing it from single user mode.  If there are any experts on the fseventsd daemon, would love to get an opinion. 

     

    An alternative could be disabling and then re-enabling journaling vi Disk Utility. You have to hold the option key down when selecting the file menu, then re-enabling journaling from the file menu.  I'll try that and check back. But I think removing .fseventsd is the safest method.

     

     

    B

  • bernuli Level 1 Level 1 (50 points)
    Currently Being Moderated
    Jan 25, 2013 8:23 AM (in response to ZX48)

    Thanks for the report.  Safe mode fixed the problem for me once, but I was not able to identify why.

     

     

    B

  • Pondini Level 8 Level 8 (38,710 points)
    Currently Being Moderated
    Jan 25, 2013 8:27 AM (in response to bernuli)

    bernuli wrote:

    . . .

    An alternative could be disabling and then re-enabling journaling vi Disk Utility.

    I guess it's worth a try, but journalling and the Event Store are two very different things.

  • bernuli Level 1 Level 1 (50 points)
    Currently Being Moderated
    Jan 25, 2013 10:41 AM (in response to Pondini)

    Pondini wrote:

     

    bernuli wrote:

    . . .

    An alternative could be disabling and then re-enabling journaling vi Disk Utility.

    I guess it's worth a try, but journalling and the Event Store are two very different things.

     

    Oh, right.  I had those 2 things cross referenced. Cycling journaling off then on did nothing to improve TM performance.  Thanks for pointing that out.

     

    I did however remove the .fseventsd directory on both my boot volume and TM usb drive.  Did this from single user mode.  (It is a little tricky to rm on the USB drive from single user mode.)

     

    The big thing is to clear the the fseventsd on the boot drive.

     

    Anyway my backup time went from 7 minutes down to 5 seconds. (11 seconds after starting up Mail, Safari and iTunes).

     

    Good to clear once in a while, otherwise you end up with a large amount of real directories in the backup instead of hard links.

     

    B

  • Pondini Level 8 Level 8 (38,710 points)
    Currently Being Moderated
    Jan 25, 2013 10:51 AM (in response to bernuli)

    bernuli wrote:

    . . .

    I did however remove the .fseventsd directory on . . . my . . . TM usb drive.

    That doesn't seem to be a problem.

     

     

    The big thing is to clear the the fseventsd on the boot drive.

    Yup.    I still wish there was a reliable way to fix it instead, but that is what OSX does sometimes -- such as after an abnormal shutdown or disconnection:

     

    Jan 23 12:29:22 JPsiMac-10v8.local fseventsd[83]: event logs in /Volumes/S.Test.Backups/.fseventsd out of sync with volume.  destroying old logs. (1304040 1 1645432)

    Jan 23 12:29:22 JPsiMac-10v8.local fseventsd[83]: log dir: /Volumes/S.Test.Backups/.fseventsd getting new uuid: 2AA0319E-D34B-4200-BADA-2EF73ED0D7EB

     

    Those are on an external HD, of course, but it will do the same on a boot volume if necessary.

     

    Good to clear once in a while, otherwise you end up with a large amount of real directories in the backup instead of hard links.

    I don't think it should be done as a regular thing, at least not for most users.  It seems to affect only a small number of users, and as far as I can tell, only on Snow Leopard.

  • ZX48 Calculating status...
    Currently Being Moderated
    Feb 5, 2013 1:11 AM (in response to Pondini)

    OK. I can't seem to get this to work. I logged into single user mode (Command+s). Prompt displayed root

     

    I typed: sudo rm -R /.fseventsd/*

     

    It then asked me if I wanted to delete the file (I assume becasue each was listed as rw------)

     

    I said "y" to each file - it took ages, but eventually I got to the bottom of the list and the prompts stopped.

     

    I reran the command, but the same thing happened. It didn't look like anything was actually deleted... I pressed cntrl+c to stop.

     

    I then restarted as normal and ran terminal list command: It finds 13384 files in .fseventsd

     

    What did I do wrong?

     

    Can you please explain to me precisely what commands I shoudl type in terminal or single user mode?

    Is there a way to "accept all"?

     

    Should I have said "Y" to the prompt?

  • Pondini Level 8 Level 8 (38,710 points)
    Currently Being Moderated
    Feb 5, 2013 7:59 AM (in response to ZX48)

    Sorry, try it this way:

     

    sudo rm -rf /.fseventsd

  • ZX48 Level 1 Level 1 (0 points)
    Currently Being Moderated
    Feb 5, 2013 8:05 AM (in response to Pondini)

    What does the -rf mean?

     

    And the * ? (I thought this would make it recursive or something..?)

  • Pondini Level 8 Level 8 (38,710 points)
    Currently Being Moderated
    Feb 5, 2013 8:14 AM (in response to ZX48)

    There's an explanation of nearly every command right on your Mac. 

     

    Type "man" (MANual page) before the command in Terminal:  man rm

     

    As you'll see, the -f means remove without prompting for confirmation.

     

    and since -r means remove all the contents, the /* shouldn't be necessary.

     

    (I copied the earlier command from one of the prior posts; then just now saw the other one.)

  • ZX48 Level 1 Level 1 (0 points)
    Currently Being Moderated
    Feb 5, 2013 8:16 AM (in response to Pondini)

    Thanks. I just tried it, but it again didn't work.

    DO I need to run the:

     

    /sbin/fsck -fy

     

    AND

     

    /sbin/mount -uw /

     

    first?

  • ZX48 Level 1 Level 1 (0 points)
    Currently Being Moderated
    Feb 5, 2013 8:30 AM (in response to ZX48)

    OK. That has seemed to clear it out. Same directory now just 8 items in it.

     

    Out of inerest, when i rebooted the fans went crazt for 5-10 seconds.

     

    Just testing with TM now....scanning...1.4 million items...preparing...637 items...backing up 540 of 663.5 MB (VERY FAST!)...now stalled...

  • bernuli Level 1 Level 1 (50 points)
    Currently Being Moderated
    Feb 5, 2013 8:30 AM (in response to ZX48)

    Yes, those 2 commands are required.  Sorry I should have mentioned that.

     

    When you boot into single user mode, your hard drive comes up as read only, preventing you from modifying or deleting anything.  Run those 2 commands then you will be able to clear fseventsd.

     

    rm -rf /.fseventsd/* will then work

     

    let me explain what that does

     

    the rm command is used to delete a single file.  by adding -rf to the command will delete a file or directory and everything below it. 

     

    Be very careful about what you type after the -rf.  If you typed rm -rf / and then hit enter by accident, it will start deleting everything on your hard drive.  Use control c to cancel the command at any time.

     

    It may seem confusing, but these steps are totally worth doing IMO.

     

    B

  • Pondini Level 8 Level 8 (38,710 points)
    Currently Being Moderated
    Feb 5, 2013 8:32 AM (in response to ZX48)

    ZX48 wrote:

     

    OK. That has seemed to clear it out. Same directory now just 8 items in it.

    Great!

     

    Out of inerest, when i rebooted the fans went crazt for 5-10 seconds.

     

    Just testing with TM now....scanning...1.4 million items...preparing...637 items...backing up 540 of 663.5 MB (VERY FAST!)...now stalled...

    Yes, both of those are normal.  The first backup will probably be quite slow, even if small. 

  • ZX48 Level 1 Level 1 (0 points)
    Currently Being Moderated
    Feb 6, 2013 12:50 AM (in response to Pondini)

    First backup was not so long actually:

     

    05/02/2013 16:26:48com.apple.backupd[333]Starting standard backup
    05/02/2013 16:26:48com.apple.backupd[333]Backing up to: /Volumes/MyBook/Backups.backupdb
    05/02/2013 16:26:50com.apple.backupd[333]Event store UUIDs don't match for volume: Snow Leopard SSD
    05/02/2013 16:26:50com.apple.backupd[333]Node requires deep traversal:/ reason:must scan subdirs|new event db|
    05/02/2013 16:28:44com.apple.backupd[333]No pre-backup thinning needed: 3.90 GB requested (including padding), 46.22 GB available
    05/02/2013 16:33:14com.apple.backupd[333]Copied 48694 files (630.4 MB) from volume Snow Leopard SSD.
    05/02/2013 16:33:20com.apple.backupd[333]No pre-backup thinning needed: 3.15 GB requested (including padding), 45.59 GB available
    05/02/2013 16:33:37com.apple.backupd[333]Copied 1818 files (532 KB) from volume Snow Leopard SSD.
    05/02/2013 16:33:45com.apple.backupd[333]Starting post-backup thinning
    05/02/2013 16:36:58com.apple.backupd[333]Deleted backup /Volumes/MyBook/Backups.backupdb/SL/2013-01-25-215113: 45.61 GB now available
    05/02/2013 16:40:26com.apple.backupd[333]Deleted backup /Volumes/MyBook/Backups.backupdb/SL/2013-01-25-175211: 45.97 GB now available
    05/02/2013 16:40:26com.apple.backupd[333]Post-back up thinning complete: 2 expired backups removed
    05/02/2013 16:40:27com.apple.backupd[333]Backup completed successfully.

     

    New backups parts are much faster now, but I notice that the system still spends a long time cleaning up old backups (8 minutes). Is this because my backup HD is quite full? (95%).

     

    06/02/2013 08:31:45com.apple.backupd[3271]Starting standard backup
    06/02/2013 08:31:45com.apple.backupd[3271]Backing up to: /Volumes/MyBook/Backups.backupdb
    06/02/2013 08:31:49com.apple.backupd[3271]No pre-backup thinning needed: 3.15 GB requested (including padding), 47.19 GB available
    06/02/2013 08:32:16com.apple.backupd[3271]Copied 1875 files (813 KB) from volume Snow Leopard SSD.
    06/02/2013 08:32:17com.apple.backupd[3271]No pre-backup thinning needed: 3.15 GB requested (including padding), 47.19 GB available
    06/02/2013 08:32:31com.apple.backupd[3271]Copied 1853 files (567 KB) from volume Snow Leopard SSD.
    06/02/2013 08:32:39com.apple.backupd[3271]Starting post-backup thinning
    06/02/2013 08:36:30com.apple.backupd[3271]Deleted backup /Volumes/MyBook/Backups.backupdb/SL/2013-01-30-103436: 47.70 GB now available
    06/02/2013 08:40:23com.apple.backupd[3271]Deleted backup /Volumes/MyBook/Backups.backupdb/SL/2013-01-30-083936: 48.06 GB now available
    06/02/2013 08:40:23com.apple.backupd[3271]Post-back up thinning complete: 2 expired backups removed
    06/02/2013 08:40:24com.apple.backupd[3271]Backup completed successfully.

     

    Prior to removing .fseventsd, the total tiem was about 23 minutes or so.

    Interestingly, the fseventsd directory already has 32 items in it.

     

    The external also sits there for a long time afterwards churning away. Is that normal?

1 ... 6 7 8 9 10 ... 12 Previous Next

Actions

More Like This

  • Retrieving data ...

Bookmarked By (5)

Legend

  • This solved my question - 10 points
  • This helped me - 5 points
This site contains user submitted content, comments and opinions and is for informational purposes only. Apple disclaims any and all liability for the acts, omissions and conduct of any third parties in connection with or related to your use of the site. All postings and use of the content on this site are subject to the Apple Support Communities Terms of Use.