/private/var/audit/20201003230440.crash_recovery

Boot into Safe Mode, then reboot normally, and check again.

Start up your Mac in safe mode - Apple Support

Safe Mode cleans up and rebuilds various caches. (It may not clear this case.)

If the Safe Mode boot fails to resolve this, then launch Terminal.app and issue the command:

audit -e 

It appears that auditing is enabled, which is common. And that the audit data is not getting cleaned up. Which is not common. (I have the expected week or so of those audit files locally, which means log rotation is working here. But is apparently not working there.) (dialabrain: sudo is your friend. Or can be your enemy. Depending on the command.)

If the deletion via the audit command fails, yes, you can sudo rm and remove those files. With care.

For details on auditing and the above command, use the command-line command:

man audit

And because your data is important, you will want to have complete and current backups before any of this. The above-listed commands are all benign, but some command mistakes can be bad (including those errors involving sudo rm), and other errors and issues are also possible. And there’s already something a little weird happening here.

I had these files in that /private/var/audit folder dating from current back to 2018. Used the following command to trim all but the last 90 days worth:

sudo find /private/var/audit/ -type f -mtime +90 -maxdepth 1 -exec rm -f {} \;

Ironically, Apple's audit app and audit_control were written under contract to Apple by McAfee Research (see man audit_control for that tidbit). Apple has the audit command marked as deprecated in its man page.

The /etc/security/audit_control config file on my Ventura 13.5 suggests it will expire files after 10MB of storage is consumed by them but before the trim job above, I had over 250MB of them.

VikingOSX wrote:

The /etc/security/audit_control config file on my Ventura 13.5 suggests it will expire files after 10MB of storage is consumed by them but before the trim job above, I had over 250MB of them.

I had about 150MB in Monterey and 69MB in Ventura. I guess the config file fibs.

Interesting. I don't have access to /private/var/audit.

MrHoffman wrote:

(dialabrain: sudo is your friend. Or can be your enemy. Depending on the command.)

I just assumed I didn't have access…

dialabrain wrote:

MrHoffman wrote:

(dialabrain: sudo is your friend. Or can be your enemy. Depending on the command.)

I just assumed I didn't have access…

Ah, okay. An acquaintance, then. 😉

MrHoffman wrote:

Ah, okay. An acquaintance, then. 😉

wut? 😎