Why does "var" hold 413 GB of space on my 1TB hard drive?

Well, various things store data in /var. /var is actually a symbolic link to /private/var, so it's actually just one location.

If you go to /var and do a 'ls -al' in terminal, print the results here and we can say which folder is hogging all the data. If it's /db, that's one thing, and if it's /tmp, that's another (and a reboot may get you a LOT of disk space back).

If it's /log, you can just delete the items inside it.

(120753)

Good point. Though, if something is spewing 400 GB of stuff to /var/log, it makes sense to figure out what it is, so not only can you clean up after it, but you can figure out how to stop it as well 😉

For information about the Other category in the Storage display, see this support article. If the Storage display seems to be inaccurate, try rebuilding the Spotlight index.

Empty the Trash if you haven't already done so. If you use iPhoto, empty its internal Trash first:

iPhoto ▹ Empty Trash

Do the same in other applications, such as Aperture, that have an internal Trash feature. Then restart the computer. That will temporarily free up some space.

According to Apple documentation, you need at least 9 GB of available space on the startup volume (as shown in the Finder Info window) for normal operation—not the mythical 10%, 15%, or any other percentage. You also need enough space left over to allow for growth of the data. There is little or no performance advantage to having more available space than the minimum Apple recommends. Available storage space that you'll never use is wasted space.

When Time Machine backs up a portable Mac, some of the free space will be used to make local snapshots, which are backup copies of recently deleted files. The space occupied by local snapshots is reported as available by the Finder, and should be considered as such. In the Storage display of System Information, local snapshots are shown as Backups. The snapshots are automatically deleted when they expire or when free space falls below a certain level. You ordinarily don't need to, and should not, delete local snapshots yourself. If you followed bad advice to disable local snapshots by running a shell command, you may have ended up with a lot of data in the Other category. Ask for instructions in that case.

See this support article for some simple ways to free up storage space.

You can more effectively use a tool such as OmniDiskSweeper (ODS) or GrandPerspective (GP) to explore the volume and find out what's taking up the space. You can also delete files with it, but don't do that unless you're sure that you know what you're deleting and that all data is safely backed up. That means you have multiple backups, not just one. Note that ODS only works with OS X 10.8 or later. If you're running an older OS version, use GP.

Deleting files inside a photo or iTunes library will corrupt the library. Changes to such a library must be made from within the application that created it. The same goes for Mail files.

Proceed further only if the problem isn't solved by the above steps.

ODS or GP can't see the whole filesystem when you run it just by double-clicking; it only sees files that you have permission to read. To see everything, you have to run it as root.

Back up all data now.

If you have more than one user account, make sure you're logged in as an administrator. The administrator account is the one that was created automatically when you first set up the computer.

Install the app you downloaded in the Applications folder as usual. Quit it if it's running.

Triple-click anywhere in the corresponding line of text below on this page to select it, then copy the selected text to the Clipboard by pressing the key combination command-C:

sudo /Applications/OmniDiskSweeper.app/Contents/MacOS/OmniDiskSweeper

sudo /Applications/GrandPerspective.app/Contents/MacOS/GrandPerspective

Launch the built-in Terminal application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad and start typing the name.

Paste into the Terminal window by pressing command-V. You'll be prompted for your login password, which won't be displayed when you type it. Type carefully and then press return. You may get a one-time warning to be careful. If you see a message that your username "is not in the sudoers file," then you're not logged in as an administrator. Ignore any other messages that appear in the Terminal window.

The application window will open, eventually showing all files in all folders, sorted by size. It may take a few minutes for the app to finish scanning.

I don't recommend that you make a habit of doing this. Don't delete anything as root. If something needs to be deleted, make sure you know what it is and how it got there, and then delete it by other, safer, means. When in doubt, leave it alone or ask for guidance.

When you're done with the app, quit it and also quit Terminal.

In a Terminal window try this simple command:

cd /private/var

sudo du -skc * | sort -n

it will show you very quickly where you space is going.

You should be careful what you delete in the /private/var folder. Do a bit more research to see what is and what isn't safe or a good idea to remove. I would disagree with what Neil said about removing everything in /var/log (or /private/var/log -- same location) -- he said /log but am sure he meant /var/log. You might need to see some of the log file info to track down problems. There are usually several compressed log files that you might consider removing but I would recommend keeping at least the most recent of the log files in /var/log -- the compressed ones are the ones that end in zip or bz2 or gz.

Good luck...

Beautifully answered Linc! 🙂

That's normal.

It may not be excessive if you have hundreds of gigabytes of garbage in the /var hierarchy. If you don't see anything in another hour, give up on it and ask for other instructions.

If I were to guess - there are two likely "hogs" in the /var folder - one is an interrupted install or migration assistant - they both save a copy of the entire hard drive in the /var/tmp tree and then move it into the needed locations as the installation or migration progresses. Another possible "hog" is the /var/log tree with a run-a-way app generating tons and tons of error or diagnostic messages.

A simple look in /var/log will show the latter (the sort puts the largest at the end of the list) -- do the following in a Terminal window -- Terminal.app is located in /Applications/Utilities:

sudo du -skc /var/log/* | sort -n

A simple "du" type command will narrow down the former:

sudo du -skc /var/tmp/*

Might take a few seconds or certainly no more than a minute or two unless you have either a problem with the disk or some sort of "competition" for disk resources like indexing for spotlight or backups in progress or something like that going on at the same time

Figuring out why the big chunks are being consumed is the harder question to answer.

Good luck

Back up all data before proceeding.

Triple-click anywhere in the line below on this page to select it:

/var/folders

Right-click or control-click the line and select

Services ▹ Reveal in Finder (or just Reveal)

from the contextual menu.* A folder should open with an item selected. Move the selected item to the Trash. You may be prompted for your password.

*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. In the Finder, select

Go ▹ Go to Folder...

from the menu bar and paste into the box that opens by pressing command-V. You won't see what you pasted because a line break is included. Press return.

Restart the computer in safe mode. Certain caches maintained by the system will be rebuilt.

Safe mode is much slower to start up than normal. The next normal startup may also be somewhat slow.

When the login screen appears, restart as usual (not in safe mode) and empty the Trash. There's no need to log in while in safe mode.

Note: If a firmware password is set, you can’t start in safe mode. In that case, ask for instructions.

What backups do you have?