Hi,
This is my first post here, but I ran into this issue today and it was very alarming. In my case, I determined it was caused by the `newsd` service, which is part of the Apple News app.
I was able to use the directory names as a clue. Ex:
% ls -ld ~/Documents/com.apple.app-analytics.production.upload-dropbox/01234A56-78B9-01CD-EFG2-H3I456JK7890
rwxr-xr-x 2 xxx staff 64 Jun 8 17:04 /Users/xxx/Documents/com.apple.app-analytics.production.upload-dropbox/01234A56-78B9-01CD-EFG2-H3I456JK7890
First, open the console App and click the `Start` button in the top right to begin streaming logs.
My system was creating a new directory about every 10 minutes. Using a terminal, run this command every so often:
ls -lht ~/Documents/com.apple.app-analytics.production.upload-dropbox
You can also use a utility like `watch` to monitor for a new directory to be created if you have it installed. The `-lht` options will print the newest directories at the top.
When a new directory is created, copy its name and paste it into the Console App's search bar to look for a match. These are the results I got:
default 17:04:47.871510-0500 newsd will start session with identifier=01234A56-78B9-01CD-EFG2-H3I456JK7890
default 17:04:48.360395-0500 newsd did end session with identifier=01234A56-78B9-01CD-EFG2-H3I456JK7890
Notice that the directories are created with the same timestamp as the log entries.
I did this for several cycles and it was the `newsd` service every time. I should also mention that I don't use Apple News on my Mac, and I have opted out of all analytics sharing. I sent them a report with similar information earlier today, so hopefully it gets fixed soon.
Thanks,
M