Serious Time Machine bug on Mountain Lion

Gilby101 wrote:

. .

I initially suspected the Microsoft Silverlight install because it had created an ExcludeByPath key with one path /Library/Application Support/Microsoft/PlayReady. After removing it and not touching Silverlight, the exclusiuon of /Applications, etc. recurred. Long ago, but I have kept .plists from that tiome and will send them to you.

Ah, great . . well, not great -- no culprit yet, but another piece of the puzzle, and somebody who's been that deep into TM. 😉

Occasionally use BackupLoupe to analyse backups - useful app for many reasons..

Indeed it is.

Use Hazel to copy com.apple.TimeMachine.plist to a folder on my desktop every time it changes and it does change on every TM backup.

Yup, status updates.

I am more concenred about those with the permanent problem and who wouyld not be able to do a full recovery.

Yes, they're the ones in big trouble; I've helped two recover so far, but of course their evidence is gone. No breadcrumbs to follow.

Thanks very much; I see I have an e-mail from someone I suspect is you, with a couple of plists; I'll get back to you either here or by reply . . . may be a while.

Thanks very much!

ivansky wrote:

As I posted in related threads, I did have the problem with backups growing much too large when I first migrated my data to a new computer running Mountain Lion. I logged a job with Apple but haven't received a solution. So I think my issue qualifies?

Yes, I saw your post there, and posted an update there myself last night. I'm far from certain, but your description doesn't seem to fit -- this seems to be a rogue app telling Time Machine to skip one or more entire top-level folders: Applications, Library, System and the (hidden) private.

is there an easy way to check if my Time Machine backups are recognised as valid backups, without having to boot to an OS X DVD?

Yes. Just look at your recent backups via the Finder. See if the top-level folders above are there.

I should also mention that my problem started exactly at the time I moved to X.8.3 because that's what my new laptop ran. My problem also went away without me changing any TImeMachine settings - I never reset the TimeMachine system, it just started working again. Not before it had a number of failed backups though, because the backup increased in size by a hundred fold while it was working, so it ran out of space.

Also doesn't match -- for some users it started before 10.8.3.

Thanks for the update -- sounds like there is, or was, another problem, but at least you seem free of this one.

Let us know if you find anything significant.

Chr1st0f3r wrote:

. . .

When it comes to apps, the only app that I had recently installed when I first dicovered my TM issue was Silverlight, besides from that app I've not installed any apps for a very long time on my computer. So perhaps there could be a connection? Or it's just a coincidence I don't know. I just thought that I should mention this since I haven't thought about the fact that an app could be the cause until I started to read this thread.

Hmm. I suppose it's possible some other app, previously installed but not used in a while did it. Seems unlikely, though.

Or an app that was updated.

And it's still possible to be something from Apple.

Thanks for the info. Another puzzle piece.

Topher Kessler wrote:

I perhaps should have been clearer in my explanations, but since nobody ought to be formatting their drives, they should see the system pick up where it left off.

Sometimes they do tend to panic, and those following tend to put more weight into the over-reaction than the original post. Maybe my last overdone BOLDFACE post there will calm them down a bit.

I've never understood why folks get protective of their TM backups. They're not at all permanent, and are not an archive, and can be remade quickly if something goes awry.

True, but to have only one set of backups, and wonder if they're not going to work for a full restore or with Setup/Migration Assistant is a legitimate worry. I helped two in that pickle in the last couple of days; they got their home folders back, but not /Applications or /Library. Scary.

Gilby101 wrote:

. . .

I initially suspected the Microsoft Silverlight install because it had created an ExcludeByPath key with one path /Library/Application Support/Microsoft/PlayReady. After removing it and not touching Silverlight, the exclusiuon of /Applications, etc. recurred. Long ago, but I have kept .plists from that tiome and will send them to you.

Yes, got them, and it seems very likely that we're looking for some other app that uses the same facility. One of the other plists I got has a single item for a different app listed first; the others follow, just as in yours.

Thanks again!

dape_75 wrote:

Back then (last year) I had this problem as well. Every now and then 35GB backups without changing anything. A full reset of TM did not help.

I know it's been a long time, but do you recall if it helped at all? Even briefly?

At some point though, everything seemed to be normal again until I got a new SSD last week and wanted to make a full restore from TM.

Only backups dated from Dec 2012 and earlier, all 10.8.2 (I have updated to 10.8.3 on the day it was rleased) were found.

That does sound like this problem.

I formatted the TimeCapsule drive and did a fresh backup which seems to have the correct size. As I have no acces to my computer until saturday, I cannot confirm fully. It did not solve the problem though.

Were you trying to do a full restore (via the Recovery HD), or had you installed OSX and were using Setup/Migration Assistant?

I will send you my plist on Saturday.

Great! Please include your "dape_75" alias here so I know it's you.

Unfortunately i don't know at what time i installed sophos anti vir. It is just a feeling but maybe it is related to the problem.

Doubtful. But I will check with one of our anti-malware gurus (you might be interested in his site: Thomas Reed's Mac Malware Guide) to be sure.

dape_75 wrote:

. . .

I believe a TM reset helped for two or three days until intermittent large backup appeared again.

That may actually help us.

It looks like a rouge app, likely 3rd-party, is telling TM not to back up /Applications, /Library, and /System, but in a way that doesn't show on the TM Preferences window. Check your backups for those; if they're missing, that seems to be the problem, and the reset will fix it, at least momentarily.

If they're present on some recent backups, but not others, see if you can pinpoint exactly when it happened, and try to recall anything you might have run at about that time. If it's within the last 24 hours, we might want to see if there's a clue in your logs.

But if there's no change, then your large backups must have another cause. One of the apps in #A2 of Time Machine - Troubleshooting should help.

I am on my ipad and can't figure out how to quote correctly here. Sorry for that!

Sorry, can't help with that - - I don't do Windoze or iDevices. 😝

brianvegas wrote:

. . .

there isn't an obvious common date/time or application install that I can find.

Rats. Still looking for a culprit. . .

Note: none of these machines had ever been set to exclude these folders and in all cases entering Time machine gave access to all the other files which had been properly backed up.

Right. What I found in your plist and a couple of others are "Fixed Path Exclusions" that cannot be set by, or seen on, the Preferences window. They can only be set via the tmutil UNIX command.

That's a perfectly legitimate thing for an app to do -- if it has, say, a large cache, it would be good practice to exclude it from hourly backups.

But certainly not the top-level folders!

I wonder if a developer put it in a test version, but forgot to take it out. 😟

Got before-and-after copies of the plist from one user, and I think I know what happened, if not where.

Among other groups of settings in the plist, there can be IncludeByPath (which I suspect should always be there), and ExcludeByPath. And of course, Apple has an API and a UNIX command (tmutil for those keeping score) that will read/write to the plist.

Neither of those can be set by, or seen on, the TM Preferences window, so you don't know they're there.

A working plist has all the top-level folders listed in IncludeByPath, including some hidden ones. It may or may not have ExcludeByPath.

If an app had, say, a cache that could get large and change frequently, it would be good practice for an app to use that to exclude it from backups. Perfectly sensible.

But in doing that, it looks like the app is reading the wrong array (Include), deleting it, adding the app's file to it, and filing it in the Exclude array. The way the API works, that might be easy to do (if you don't bother to look at the results).

What's really odd is, so far I have plists from 3 users. Each reference different files being added, but have the same results. Makes me wonder if this is somewhere in Apple's code after all.

Gadzooks!

Further investigation makes us lean more to Apple's code, given the way the API works, and with the same thing happening with apparently-unrelated 3rd-party apps.

That's a good thing: if we can replicate and document it well enough, they may be able to find and fix it fairly quickly.