{"code":"var Component=(()=>{var p=Object.create;var h=Object.defineProperty;var g=Object.getOwnPropertyDescriptor;var k=Object.getOwnPropertyNames;var u=Object.getPrototypeOf,m=Object.prototype.hasOwnProperty;var y=(s,i)=>()=>(i||s((i={exports:{}}).exports,i),i.exports),f=(s,i)=>{for(var t in i)h(s,t,{get:i[t],enumerable:!0})},r=(s,i,t,a)=>{if(i&&typeof i==\"object\"||typeof i==\"function\")for(let n of k(i))!m.call(s,n)&&n!==t&&h(s,n,{get:()=>i[n],enumerable:!(a=g(i,n))||a.enumerable});return s};var b=(s,i,t)=>(t=s!=null?p(u(s)):{},r(i||!s||!s.__esModule?h(t,\"default\",{value:s,enumerable:!0}):t,s)),F=s=>r(h({},\"__esModule\",{value:!0}),s);var o=y((w,l)=>{l.exports=_jsx_runtime});var v={};f(v,{default:()=>c});var e=b(o());function d(s){let i={a:\"a\",code:\"code\",em:\"em\",h2:\"h2\",h3:\"h3\",img:\"img\",li:\"li\",ol:\"ol\",p:\"p\",pre:\"pre\",span:\"span\",strong:\"strong\",table:\"table\",tbody:\"tbody\",td:\"td\",th:\"th\",thead:\"thead\",tr:\"tr\",ul:\"ul\",...s.components};return(0,e.jsxs)(e.Fragment,{children:[(0,e.jsx)(i.p,{children:\"Here is a storage problem that defeats every tool most people reach for.\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"Your Mac says the disk is nearly full. You open a storage analyser and add up what it found \\u2014 and the total comes to tens of gigabytes \",(0,e.jsx)(i.em,{children:\"less\"}),\" than macOS says is in use. Disk Utility reports no snapshots. You delete apps, you offload photos, you empty the Trash, and the number barely moves. Restarting helps for an hour, then the space disappears again.\"]}),`\n`,(0,e.jsxs)(i.p,{children:[\"The files are real. Your tools cannot see them because they live in \",(0,e.jsx)(i.strong,{children:(0,e.jsx)(i.code,{children:\"/private/var/root\"})}),\" \\u2014 the home directory of the root account \\u2014 and every one of those tools is running as you.\"]}),`\n`,(0,e.jsxs)(i.p,{children:[\"On the Macs where this bites hardest, the bulk of it is one thing: log files written by a system daemon called \",(0,e.jsx)(i.code,{children:\"rtcreportingd\"}),\", in quantities that reach \",(0,e.jsx)(i.strong,{children:\"tens of gigabytes\"}),\". Michael Tsai documented a case on 21 August 2026 where \",(0,e.jsx)(i.code,{children:\"/private/var/root/Library/Logs\"}),\" alone was consuming \",(0,e.jsx)(i.strong,{children:\"74 GB\"}),\" on an M4 MacBook Air, and where the folder climbed back to 27 GB within a single day of being cleared.\"]}),`\n`,(0,e.jsx)(i.p,{children:\"The logs are not the disease. They are what a stuck daemon looks like when nobody is reading the thermometer. This article covers how to find the space, how to reclaim it without the classic mistake that wastes the whole exercise, and how to find the process that is actually generating it.\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.img,{alt:\"macOS storage analysis showing hidden space usage\",src:\"/images/blog/mac-disk-full-hidden-root-logs-rtcreportingd-fileproviderd-fix-2026/hero.webp\",width:\"1024\",height:\"541\"})}),`\n`,(0,e.jsx)(i.h2,{id:\"key-takeaways\",children:\"Key Takeaways\"}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsxs)(i.strong,{children:[(0,e.jsx)(i.code,{children:\"/private/var/root\"}),\" is invisible to anything running as your user.\"]}),\" We confirmed on macOS 26.5.2 that \",(0,e.jsx)(i.code,{children:\"ls /private/var/root\"}),\" returns \",(0,e.jsx)(i.code,{children:\"Permission denied\"}),\". Storage analysers, Finder and Disk Utility's usage figures all miss what is inside it.\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsxs)(i.strong,{children:[(0,e.jsx)(i.code,{children:\"rtcreportingd\"}),\" is a real Apple system daemon that runs as root.\"]}),\" We verified its launchd job declares \",(0,e.jsx)(i.code,{children:\"UserName => root\"}),\", which is exactly why its logs land in root's home directory rather than yours.\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Reported sizes reach tens of gigabytes, and regrow fast.\"}),\" 74 GB in a documented case, back to 27 GB within a day of deletion, because the underlying cause was still running.\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"The classic mistake wastes the whole job.\"}),\" Deleting files with a GUI tool running under \",(0,e.jsx)(i.code,{children:\"sudo\"}),\" moves them to \",(0,e.jsx)(i.em,{children:\"root's\"}),\" invisible Trash. Space is not reclaimed. You have to delete immediately, or empty root's Trash.\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Look for a stuck sync client.\"}),\" In the documented case \",(0,e.jsx)(i.code,{children:\"rtcreportingd\"}),\" and \",(0,e.jsx)(i.code,{children:\"fileproviderd\"}),\" were each pinned near 100% CPU, and quitting Dropbox stopped both. \",(0,e.jsx)(i.code,{children:\"fileproviderd\"}),\" is the macOS process that hosts cloud-storage File Provider extensions.\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsxs)(i.strong,{children:[\"Do not go deleting things in \",(0,e.jsx)(i.code,{children:\"/private/var/root\"}),\" at random.\"]}),\" Logs and caches are safe to remove. Other things there are not, and this article is specific about which is which.\"]}),`\n`]}),`\n`,(0,e.jsx)(i.h2,{id:\"why-your-storage-tools-cannot-see-it\",children:\"Why Your Storage Tools Cannot See It\"}),`\n`,(0,e.jsx)(i.p,{children:\"Before the fix, the mechanism \\u2014 because understanding it is what stops you chasing the wrong thing next time.\"}),`\n`,(0,e.jsx)(i.h3,{id:\"root-has-a-home-directory-and-daemons-use-it\",children:\"Root Has a Home Directory, and Daemons Use It\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"On macOS the root account's home directory is \",(0,e.jsx)(i.code,{children:\"/private/var/root\"}),\". Most people assume it is essentially empty and only touched when you run Terminal from macOS Recovery. That has not been true for years. System daemons that run as root and want to store state, caches or logs write them there, in the same \",(0,e.jsx)(i.code,{children:\"Library\"}),\" layout your own home directory uses:\"]}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"/private/var/root/Library/Logs\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"/private/var/root/Library/Caches\"})})]})})}),`\n`,(0,e.jsx)(i.p,{children:\"You can confirm the directory is off limits to you in one command. On a Mac where Terminal does not have elevated privileges:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsx)(i.code,{children:(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"ls\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /private/var/root\"})]})})})}),`\n`,(0,e.jsx)(i.p,{children:\"We ran exactly this on macOS 26.5.2 (build 25F84) and got:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsx)(i.code,{children:(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"ls: /private/var/root: Permission denied\"})})})})}),`\n`,(0,e.jsx)(i.p,{children:\"That is a plain Unix permission denial \\u2014 root's home is mode-restricted to root. It is not a TCC privacy protection and it is not something Full Disk Access fixes. A storage analyser you launched from the Dock is running as you, so it walks the filesystem as you, and everything under that directory is a hole in its map.\"}),`\n`,(0,e.jsx)(i.h3,{id:\"this-is-why-the-numbers-disagree\",children:\"This Is Why the Numbers Disagree\"}),`\n`,(0,e.jsxs)(i.p,{children:[`The symptom people describe is \"my storage tool's totals do not add up\", and this is the reason. In the documented case, OmniDiskSweeper's folder totals came to roughly `,(0,e.jsx)(i.strong,{children:\"90 GB less\"}),\" than macOS reported as used.\"]}),`\n`,(0,e.jsxs)(i.p,{children:[\"It is worth separating this from the \",(0,e.jsx)(i.em,{children:\"other\"}),\" reasons Mac free-space numbers disagree, because there are several and only one of them is this bug.\"]}),`\n`,(0,e.jsx)(i.p,{children:\"Howard Oakley laid out the general arithmetic on 21 August 2026, and the numbers from his own Mac mini make the point:\"}),`\n`,(0,e.jsxs)(i.table,{children:[(0,e.jsx)(i.thead,{children:(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.th,{children:\"Source\"}),(0,e.jsx)(i.th,{children:\"Reported as used on the same volume\"})]})}),(0,e.jsxs)(i.tbody,{children:[(0,e.jsxs)(i.tr,{children:[(0,e.jsxs)(i.td,{children:[(0,e.jsx)(i.code,{children:\"diskutil apfs list\"}),\" container difference\"]}),(0,e.jsx)(i.td,{children:\"837.101 GB\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Sum of per-volume Capacity Consumed\"}),(0,e.jsx)(i.td,{children:\"837.027 GB\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Finder's Get Info on the volume\"}),(0,e.jsx)(i.td,{children:\"826.67 GB\"})]}),(0,e.jsxs)(i.tr,{children:[(0,e.jsx)(i.td,{children:\"Disk Utility\"}),(0,e.jsx)(i.td,{children:\"814.03 GB\"})]})]})]}),`\n`,(0,e.jsxs)(i.p,{children:[\"Four tools, four numbers, a spread of about 23 GB, and \",(0,e.jsx)(i.strong,{children:\"nothing wrong\"}),\". The differences come from container-versus-volume accounting, purgeable space, and APFS special-file behaviour:\"]}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Container versus volume.\"}),' An APFS container holds several volumes that share free space. \"Free space on Macintosh HD\" and \"free space in the container\" are different questions with different answers.']}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Purgeable space.\"}),` macOS marks some content as removable-on-demand \\u2014 caches, some snapshots, some downloaded content. Disk Utility's own Help book says \"you can't manually remove the files that are designated purgeable, but macOS removes them as space is required.\" Oakley measured 47.04 GB purgeable on his Data volume.`]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Special files.\"}),\" APFS clone files share storage until they diverge; sparse files store only their non-null data; some system files are compressed; dataless files hold their data in the cloud and materialise on demand. Free space accounting uses what is on disk \",(0,e.jsx)(i.em,{children:\"now\"}),\".\"]}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:\"None of that produces a persistent, growing, unexplained 90 GB. If your gap is small and stable, it is normal accounting. If it is large and grows while the Mac sits idle, something is writing files you cannot see.\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"For the more common storage confusions \\u2014 System Data that will not shrink, snapshots that will not release \\u2014 we cover those separately in \",(0,e.jsx)(i.a,{href:\"/blog/macos-tahoe-system-data-storage-huge-wont-shrink-fix-2026\",children:\"System Data storage huge on Mac\"}),\" and the \",(0,e.jsx)(i.a,{href:\"/blog/macos-tahoe-storage-management-optimization-guide-2025\",children:\"macOS storage management guide\"}),\". Check those first. This article is about the case where those explanations do not fit.\"]}),`\n`,(0,e.jsx)(i.h2,{id:\"what-rtcreportingd-actually-is\",children:\"What rtcreportingd Actually Is\"}),`\n`,(0,e.jsx)(i.p,{children:\"Let us be honest about the limits here, because the internet is about to fill up with confident explanations of a daemon Apple has never documented.\"}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"What we verified directly\"}),\", on macOS 26.5.2 (build 25F84):\"]}),`\n`,(0,e.jsxs)(i.p,{children:[\"The executable exists at \",(0,e.jsx)(i.code,{children:\"/usr/libexec/rtcreportingd\"}),\" and is about 1.45 MB. Its launchd job is at \",(0,e.jsx)(i.code,{children:\"/System/Library/LaunchDaemons/com.apple.rtcreportingd.plist\"}),\", and reads:\"]}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"{\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:' \"EnablePressuredExit\" => true'})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:' \"EnableTransactions\" => true'})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:' \"Label\" => \"com.apple.rtcreportingd\"'})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:' \"MachServices\" => {'})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:' \"com.apple.rtcreportingd\" => true'})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\" }\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:' \"ProgramArguments\" => ['})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:' 0 => \"/usr/libexec/rtcreportingd\"'})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\" ]\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:' \"UserName\" => \"root\"'})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"}\"})})]})})}),`\n`,(0,e.jsx)(i.p,{children:\"Check it on your own Mac \\u2014 the plist is world-readable:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsx)(i.code,{children:(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"plutil\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -p\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /System/Library/LaunchDaemons/com.apple.rtcreportingd.plist\"})]})})})}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsxs)(i.strong,{children:[(0,e.jsx)(i.code,{children:\"UserName => root\"}),\" is the whole explanation for where the logs go.\"]}),\" A daemon running as root that writes to \",(0,e.jsx)(i.code,{children:\"~/Library/Logs\"}),\" writes to \",(0,e.jsx)(i.code,{children:\"/private/var/root/Library/Logs\"}),\". There is nothing exotic about it.\"]}),`\n`,(0,e.jsxs)(i.p,{children:[\"The binary is written in Swift, and its internal class names are visible with \",(0,e.jsx)(i.code,{children:\"strings\"}),\". They include \",(0,e.jsx)(i.code,{children:\"BackendHTTP\"}),\", \",(0,e.jsx)(i.code,{children:\"TransparencyLog\"}),\", \",(0,e.jsx)(i.code,{children:\"StorebagCache\"}),\", \",(0,e.jsx)(i.code,{children:\"StorebagCoordinator\"}),\", \",(0,e.jsx)(i.code,{children:\"SessionCoordinator\"}),\", \",(0,e.jsx)(i.code,{children:\"XPCActivity\"}),\" and \\u2014 note this one \\u2014 \",(0,e.jsx)(i.code,{children:\"CacheCleanupActivity\"}),\". Its Mach service names include \",(0,e.jsx)(i.code,{children:\"com.apple.rtcreporting\"}),\", \",(0,e.jsx)(i.code,{children:\"com.apple.rtcreporting.pathmonitor\"}),\" and \",(0,e.jsx)(i.code,{children:\"com.apple.rtcreportingd.storebag\"}),\".\"]}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"What we are not going to tell you\"}),' is what \"RTC\" stands for or precisely what the daemon reports on. Apple does not document it, and we are not going to invent an expansion of an acronym and present it as fact. What the class names support is a modest description: it is a reporting or telemetry service that talks to an Apple backend over HTTP, caches state locally, monitors network path availability, and has a scheduled activity for cleaning up its own cache.']}),`\n`,(0,e.jsxs)(i.p,{children:[\"That last detail is the interesting one. \",(0,e.jsx)(i.strong,{children:\"The daemon has cleanup logic.\"}),' When its logs grow to tens of gigabytes, the reasonable reading is not \"Apple forgot to rotate logs\" but \"something is generating events faster than the daemon can process and clean up after them\". Which points at whatever is generating the events.']}),`\n`,(0,e.jsx)(i.p,{children:\"To be clear about the boundary: that is an inference from class names, not a statement about Apple's implementation. Treat it as a hypothesis that happens to fit the observed behaviour.\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.img,{alt:\"Terminal showing disk usage analysis on macOS\",src:\"/images/blog/mac-disk-full-hidden-root-logs-rtcreportingd-fileproviderd-fix-2026/content-1.webp\",width:\"1024\",height:\"572\"})}),`\n`,(0,e.jsx)(i.h2,{id:\"finding-the-space\",children:\"Finding the Space\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"You need \",(0,e.jsx)(i.code,{children:\"sudo\"}),\" for all of this, and you should read each command before running it.\"]}),`\n`,(0,e.jsx)(i.h3,{id:\"1-confirm-the-gap-exists\",children:\"1. Confirm the Gap Exists\"}),`\n`,(0,e.jsx)(i.p,{children:\"First, what macOS thinks is used:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsx)(i.code,{children:(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"df\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -h\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /System/Volumes/Data\"})]})})})}),`\n`,(0,e.jsx)(i.p,{children:\"On a modern Mac you get two lines, because the system volume is a sealed read-only snapshot and your data lives on a separate volume in the same container. On our test Mac:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"Filesystem Size Used Avail Capacity Mounted on\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"/dev/disk3s1s1 926Gi 12Gi 331Gi 4% /\"})}),`\n`,(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{children:\"/dev/disk3s5 926Gi 568Gi 331Gi 64% /System/Volumes/Data\"})})]})})}),`\n`,(0,e.jsxs)(i.p,{children:[\"Note that both report the same \",(0,e.jsx)(i.code,{children:\"Size\"}),\" and \",(0,e.jsx)(i.code,{children:\"Avail\"}),\" \\u2014 that is the shared container free space, not a per-volume quota. This is the container-versus-volume distinction from earlier, made concrete.\"]}),`\n`,(0,e.jsx)(i.p,{children:\"Then check snapshots, so you can rule them out:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsx)(i.code,{children:(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"diskutil\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" apfs\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" listSnapshots\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /System/Volumes/Data\"})]})})})}),`\n`,(0,e.jsx)(i.p,{children:\"And the container view:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsx)(i.code,{children:(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"diskutil\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" apfs\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" list\"})]})})})}),`\n`,(0,e.jsx)(i.p,{children:\"If snapshots are minimal and the container's Capacity In Use is far above what your storage analyser found, you have an invisible-files problem.\"}),`\n`,(0,e.jsx)(i.h3,{id:\"2-measure-roots-home-directory\",children:\"2. Measure Root's Home Directory\"}),`\n`,(0,e.jsx)(i.p,{children:\"This is the command that finds it:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsx)(i.code,{children:(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"sudo\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" du\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -h\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -d\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" 2\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /private/var/root/\"})]})})})}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.code,{children:\"-d 2\"}),\" limits the depth to two levels, which is enough to see whether \",(0,e.jsx)(i.code,{children:\"Library/Logs\"}),\" or \",(0,e.jsx)(i.code,{children:\"Library/Caches\"}),\" is the culprit without waiting for a full traversal. Expect it to take a minute or two on a machine with a large offender.\"]}),`\n`,(0,e.jsx)(i.p,{children:\"For a sorted view of the worst offenders one level deeper:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsx)(i.code,{children:(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"sudo\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" du\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -h\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -d\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" 3\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /private/var/root/Library\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" sort\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -h\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" tail\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -20\"})]})})})}),`\n`,(0,e.jsxs)(i.p,{children:[\"On a healthy Mac these totals are small \\u2014 megabytes, not gigabytes. If \",(0,e.jsx)(i.code,{children:\"/private/var/root/Library/Logs\"}),' comes back with a number that has \"G\" after it and more than one digit in front, that is your missing space.']}),`\n`,(0,e.jsx)(i.h3,{id:\"3-see-what-is-inside\",children:\"3. See What Is Inside\"}),`\n`,(0,e.jsx)(i.p,{children:\"Before deleting anything, look:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsxs)(i.code,{children:[(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"sudo\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" ls\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -la\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /private/var/root/Library/Logs\"})]}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"sudo\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" du\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -h\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -d\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" 1\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /private/var/root/Library/Logs\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" sort\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -h\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" tail\"})]})]})})}),`\n`,(0,e.jsx)(i.p,{children:'In the documented case the contents were \"almost entirely from RTCReporting\". If yours is dominated by something else, that changes what you should do \\u2014 the diagnostic approach in this article still applies, but the culprit will be a different subsystem.'}),`\n`,(0,e.jsx)(i.h3,{id:\"4-a-gui-alternative\",children:\"4. A GUI Alternative\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"If you would rather see this in a window, OmniDiskSweeper is free and is what surfaced the problem in the original report. The important part is that \",(0,e.jsx)(i.strong,{children:\"you must relaunch it with elevated privileges\"}),\" for it to see root's home directory. Launched normally it will show you the same incomplete picture as everything else.\"]}),`\n`,(0,e.jsxs)(i.p,{children:[\"Our \",(0,e.jsx)(i.a,{href:\"/blog/mac-storage-analyzer-tools-guide-2025\",children:\"storage analyser roundup\"}),\" covers the options, but be aware that the same limitation applies to all of them: if the tool is not running as root, this space is invisible to it.\"]}),`\n`,(0,e.jsx)(i.h2,{id:\"reclaiming-it--and-the-mistake-that-wastes-the-whole-job\",children:\"Reclaiming It \\u2014 and the Mistake That Wastes the Whole Job\"}),`\n`,(0,e.jsx)(i.p,{children:\"Here is the trap, and it is a good one.\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"If you delete these files with a GUI tool that is running under \",(0,e.jsx)(i.code,{children:\"sudo\"}),\", the tool does what it always does: it moves them to the Trash. But because the process is running as root, that is \",(0,e.jsx)(i.strong,{children:\"root's Trash\"}),\", at \",(0,e.jsx)(i.code,{children:\"/private/var/root/.Trash\"}),\", which does not appear in your Dock and which you will never think to empty. The files are still on disk. Your free space does not change. You conclude the deletion did not work.\"]}),`\n`,(0,e.jsxs)(i.p,{children:[\"In OmniDiskSweeper specifically, hold \",(0,e.jsx)(i.strong,{children:\"Option\"}),\" to turn Delete into \",(0,e.jsx)(i.strong,{children:\"Delete Immediately\"}),\".\"]}),`\n`,(0,e.jsx)(i.p,{children:\"From Terminal, delete the log contents directly:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsx)(i.code,{children:(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"sudo\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" rm\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -rf\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /private/var/root/Library/Logs/\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\"*\"})]})})})}),`\n`,(0,e.jsxs)(i.p,{children:[\"Read that command before you run it. It removes the \",(0,e.jsx)(i.em,{children:\"contents\"}),\" of root's Logs directory and nothing else. Do not shorten the path. Do not add a space before the slash.\"]}),`\n`,(0,e.jsx)(i.p,{children:\"Then check whether anything is sitting in root's Trash from a previous attempt:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsx)(i.code,{children:(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"sudo\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" du\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -sh\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /private/var/root/.Trash\"})]})})})}),`\n`,(0,e.jsx)(i.p,{children:\"And if there is:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsx)(i.code,{children:(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"sudo\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" rm\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -rf\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /private/var/root/.Trash/\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\"*\"})]})})})}),`\n`,(0,e.jsx)(i.p,{children:\"Caches in root's home are also generally safe to clear \\u2014 they are, by definition, regenerable:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsx)(i.code,{children:(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"sudo\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" du\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -h\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -d\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" 1\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /private/var/root/Library/Caches\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" sort\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -h\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" tail\"})]})})})}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"What not to touch.\"}),\" Do not delete \",(0,e.jsx)(i.code,{children:\"/private/var/root\"}),\" itself. Do not delete \",(0,e.jsx)(i.code,{children:\"/private/var/root/Library\"}),\" wholesale. Do not go removing keychains, preferences or anything you do not recognise. Logs and caches are the safe categories; everything else in there belongs to a system component that put it there for a reason.\"]}),`\n`,(0,e.jsxs)(i.p,{children:[\"Restart afterwards. Then re-check with \",(0,e.jsx)(i.code,{children:\"df -h\"}),\" to confirm the space actually came back.\"]}),`\n`,(0,e.jsx)(i.h2,{id:\"now-find-what-is-causing-it\",children:\"Now Find What Is Causing It\"}),`\n`,(0,e.jsx)(i.p,{children:\"If you stop at deletion, the space comes back and then leaves again. In the documented case it was back to 5 GB within minutes of a restart and 27 GB within a day.\"}),`\n`,(0,e.jsx)(i.h3,{id:\"watch-the-cpu\",children:\"Watch the CPU\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"Open \",(0,e.jsx)(i.strong,{children:\"Activity Monitor\"}),\", sort by \",(0,e.jsx)(i.strong,{children:\"% CPU\"}),\", and look for two processes:\"]}),`\n`,(0,e.jsxs)(i.ul,{children:[`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:(0,e.jsx)(i.code,{children:\"rtcreportingd\"})}),\" \\u2014 the daemon writing the logs\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:(0,e.jsx)(i.code,{children:\"fileproviderd\"})}),\" \\u2014 the macOS process that hosts cloud-storage File Provider extensions\"]}),`\n`]}),`\n`,(0,e.jsx)(i.p,{children:\"In the documented case both were pinned near 100% CPU continuously, on an idle Mac.\"}),`\n`,(0,e.jsx)(i.p,{children:\"From Terminal:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsx)(i.code,{children:(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"ps\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -Ao\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" pid,pcpu,comm\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" grep\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -E\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" 'rtcreportingd|fileproviderd'\"})]})})})}),`\n`,(0,e.jsxs)(i.p,{children:[\"Both of these processes exist and run on any healthy Mac \\u2014 we confirmed both running on our test machine, which has no storage problem at all. \",(0,e.jsx)(i.strong,{children:\"Their presence is normal. Their sustained CPU use is not.\"}),\" A few percent while a sync is in progress is expected. Sitting at 90\\u2013100% with the Mac untouched is the signal.\"]}),`\n`,(0,e.jsx)(i.h3,{id:\"watch-the-logs-grow\",children:\"Watch the Logs Grow\"}),`\n`,(0,e.jsx)(i.p,{children:\"The most direct confirmation is to measure twice:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsx)(i.code,{children:(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"sudo\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" du\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -sh\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /private/var/root/Library/Logs\"})]})})})}),`\n`,(0,e.jsx)(i.p,{children:\"Wait ten minutes with the Mac idle, and run it again. On a healthy Mac the number does not move meaningfully. If it climbs measurably while you are doing nothing, something is in a loop.\"}),`\n`,(0,e.jsx)(i.h3,{id:\"suspect-cloud-sync-first\",children:\"Suspect Cloud Sync First\"}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.code,{children:\"fileproviderd\"}),\" is the giveaway. It is the system process that hosts File Provider extensions \\u2014 the modern mechanism that Dropbox, OneDrive, Google Drive, Box and iCloud Drive all use to present cloud files in Finder. If it is burning CPU continuously, one of those extensions is stuck.\"]}),`\n`,(0,e.jsxs)(i.p,{children:[\"In the documented case the client was \",(0,e.jsx)(i.strong,{children:\"Dropbox\"}),\", on a Mac where it had been misbehaving for about a year \\u2014 not keeping files offline as configured, and appearing to sync constantly when nothing had changed. Quitting Dropbox stopped both the CPU use and the log growth immediately.\"]}),`\n`,(0,e.jsx)(i.p,{children:\"To test this on your own Mac, quit your sync clients one at a time and watch. Quit the client completely \\u2014 menu bar icon, Quit \\u2014 rather than pausing syncing, because a paused extension may still be loaded.\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsxs)(i.code,{children:[(0,e.jsx)(i.span,{className:\"line\",children:(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6A737D\",\"--shiki-dark\":\"#6A737D\"},children:\"# after quitting a sync client, check whether the load dropped\"})}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"ps\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -Ao\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" pid,pcpu,comm\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" grep\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -E\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" 'rtcreportingd|fileproviderd'\"})]})]})})}),`\n`,(0,e.jsx)(i.p,{children:\"If quitting one client drops both processes to idle, you have found it.\"}),`\n`,(0,e.jsx)(i.h3,{id:\"what-to-do-about-the-sync-client\",children:\"What to Do About the Sync Client\"}),`\n`,(0,e.jsx)(i.p,{children:\"Options, roughly in order of effort:\"}),`\n`,(0,e.jsxs)(i.ol,{children:[`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Update it.\"}),\" File Provider extension bugs are common and frequently fixed. Check for an update before anything else.\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Sign out and back in.\"}),\" This rebuilds the extension's local state and resolves a surprising number of stuck-sync cases.\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Remove and reinstall the client.\"}),\" More disruptive but more thorough.\"]}),`\n`,(0,e.jsxs)(i.li,{children:[(0,e.jsx)(i.strong,{children:\"Move the data elsewhere.\"}),` In the documented case the outcome was migration to iCloud Drive, after Dropbox proved unable to reliably download files for the move \\u2014 the author ended up downloading the folder from Dropbox's web interface instead. iCloud Drive then \"uploaded everything quickly and then settled into a state of no CPU use.\"`]}),`\n`]}),`\n`,(0,e.jsxs)(i.p,{children:[\"That last point is worth flagging honestly: migrating between cloud providers when the source client is broken is genuinely painful, and the web interface may be your most reliable export path. Our \",(0,e.jsx)(i.a,{href:\"/blog/macos-tahoe-icloud-drive-complete-guide-2025\",children:\"iCloud Drive guide\"}),\" covers the destination side, and if iCloud Drive itself is misbehaving, \",(0,e.jsx)(i.a,{href:\"/blog/icloud-drive-auto-download-bug-macos-tahoe-26-4-fix-2026\",children:\"the iCloud Drive auto-download bug\"}),\" is a known separate issue.\"]}),`\n`,(0,e.jsx)(i.p,{children:\"We are not saying Dropbox is uniquely at fault. It is the client in the documented case. Any File Provider extension can get stuck, and the diagnostic is the same whichever one you use.\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsx)(i.img,{alt:\"Activity Monitor showing high CPU processes\",src:\"/images/blog/mac-disk-full-hidden-root-logs-rtcreportingd-fileproviderd-fix-2026/content-2.webp\",width:\"1024\",height:\"572\"})}),`\n`,(0,e.jsx)(i.h2,{id:\"the-other-places-storage-hides-from-you\",children:\"The Other Places Storage Hides From You\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"Root's home directory is the one almost nobody checks, but it is not the only place a user-level tool comes up short. If your gap is not in \",(0,e.jsx)(i.code,{children:\"/private/var/root\"}),\", work through these before concluding the numbers are lying.\"]}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Other daemons' root-owned data.\"}),\" \",(0,e.jsx)(i.code,{children:\"/private/var/root\"}),\" is where root's \",(0,e.jsx)(i.em,{children:\"home\"}),\" lives, but system components also write under \",(0,e.jsx)(i.code,{children:\"/private/var/db\"}),\", \",(0,e.jsx)(i.code,{children:\"/private/var/folders\"}),\" and \",(0,e.jsx)(i.code,{children:\"/Library/Logs\"}),\". Measure them the same way:\"]}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsxs)(i.code,{children:[(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"sudo\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" du\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -h\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -d\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" 1\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /private/var/db\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" sort\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -h\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" tail\"})]}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"sudo\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" du\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -h\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -d\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" 1\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /Library/Logs\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" sort\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -h\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" tail\"})]}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"sudo\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" du\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -sh\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /private/var/folders\"})]})]})})}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.code,{children:\"/private/var/folders\"}),\" holds per-user temporary and cache containers and can legitimately reach several gigabytes. It is managed by macOS and generally should be left alone; a restart clears the volatile parts.\"]}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Local Time Machine snapshots.\"}),\" These are the most-blamed and least-often-guilty cause. Check rather than assume:\"]}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsxs)(i.code,{children:[(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"tmutil\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" listlocalsnapshots\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /\"})]}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"diskutil\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" apfs\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" listSnapshots\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /System/Volumes/Data\"})]})]})})}),`\n`,(0,e.jsxs)(i.p,{children:[\"If snapshots genuinely are the problem, macOS thins them automatically under space pressure, and the deeper cases are covered in our \",(0,e.jsx)(i.a,{href:\"/blog/macos-tahoe-time-machine-complete-troubleshooting-guide-2025\",children:\"Time Machine troubleshooting guide\"}),\".\"]}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Other users' home directories.\"}),\" Obvious once stated, invisible in practice \\u2014 a second account on the Mac with 200 GB of video is not something your storage tool will show you while running as you. \",(0,e.jsx)(i.code,{children:\"sudo du -h -d 1 /Users\"}),\" answers it in one line.\"]}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Files held open by a running process.\"}),\" Space that was deleted but not released, because a process still has the file descriptor. This shows up as a gap that vanishes after a restart:\"]}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsx)(i.code,{children:(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"sudo\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" lsof\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" 2>\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\"/dev/null\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" grep\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -i\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" deleted\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" head\"})]})})})}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Mail's local store, iOS device backups, and Xcode.\"}),\" The three classic large-and-forgotten directories on a developer's or a heavy Mail user's Mac:\"]}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsxs)(i.code,{children:[(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"du\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -sh\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" ~/Library/Mail\"})]}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"du\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -sh\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" ~/Library/Application\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\"\\\\ \"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\"Support/MobileSync/Backup\"})]}),`\n`,(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"du\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -sh\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" ~/Library/Developer/Xcode/{DerivedData,iOS\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\"\\\\ \"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\"DeviceSupport,Archives}\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" 2>\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\"/dev/null\"})]})]})})}),`\n`,(0,e.jsxs)(i.p,{children:[\"These are all readable as your own user, so a storage analyser \",(0,e.jsx)(i.em,{children:\"will\"}),\" find them \\u2014 they just get lost in a long list. Worth checking before you escalate to \",(0,e.jsx)(i.code,{children:\"sudo\"}),\".\"]}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Cloud placeholder files that materialised.\"}),' If you use a \"keep files online only\" setting in any sync client, a bug or a full-text search can quietly download everything. That is the same class of failure as the one in this article and usually shows up as steady growth in the sync folder itself.']}),`\n`,(0,e.jsx)(i.h2,{id:\"how-common-is-this\",children:\"How Common Is This?\"}),`\n`,(0,e.jsx)(i.p,{children:\"Honest answer: we do not know, and neither does anyone else publishing about it.\"}),`\n`,(0,e.jsx)(i.p,{children:\"What exists in the public record is a first-hand account with specific numbers and a specific fix, an Apple Support Community thread about RTCReporting storage, and a Reddit thread from users asking what was taking up their storage. That is enough to establish the problem is real and reproducible, and not enough to say what proportion of Macs are affected.\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"What we \",(0,e.jsx)(i.em,{children:\"can\"}),\" say from our own checking: \",(0,e.jsx)(i.code,{children:\"rtcreportingd\"}),\" runs on a stock Mac with no storage problem, its logs there are unremarkable, and the daemon has cleanup logic that evidently works most of the time. This is a failure mode, not a default behaviour. If your Mac's storage adds up, you have nothing to fix.\"]}),`\n`,(0,e.jsx)(i.p,{children:\"Apple has published no support document about this, has not acknowledged it, and has not shipped a documented fix. If you hit it, filing feedback with Apple is worth the five minutes \\u2014 an unacknowledged issue stays unacknowledged.\"}),`\n`,(0,e.jsx)(i.h2,{id:\"troubleshooting-common-issues\",children:\"Troubleshooting Common Issues\"}),`\n`,(0,e.jsxs)(i.h3,{id:\"sudo-du-is-taking-forever\",children:[(0,e.jsx)(i.code,{children:\"sudo du\"}),\" is taking forever\"]}),`\n`,(0,e.jsxs)(i.p,{children:[\"That is normal on a large or heavily fragmented directory tree. Use \",(0,e.jsx)(i.code,{children:\"-d 1\"}),\" first to find which top-level folder is large, then descend only into that one. Avoid running \",(0,e.jsx)(i.code,{children:\"du\"}),\" across the whole disk when you already know the directory you care about.\"]}),`\n`,(0,e.jsx)(i.h3,{id:\"i-deleted-the-logs-but-free-space-did-not-change\",children:\"I deleted the logs but free space did not change\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"The Trash problem. Check \",(0,e.jsx)(i.code,{children:\"sudo du -sh /private/var/root/.Trash\"}),\" and empty it with \",(0,e.jsx)(i.code,{children:\"sudo rm -rf /private/var/root/.Trash/*\"}),\". This catches almost everyone who used a GUI tool.\"]}),`\n`,(0,e.jsx)(i.p,{children:\"The second possibility is that a process still has the deleted files open, in which case the space is not released until the process exits. Restart the Mac and check again.\"}),`\n`,(0,e.jsx)(i.h3,{id:\"the-space-came-back-within-a-day\",children:\"The space came back within a day\"}),`\n`,(0,e.jsx)(i.p,{children:\"Expected, if you have not found the cause. Deleting the logs treats the symptom. Go to the Activity Monitor step and find what is looping.\"}),`\n`,(0,e.jsxs)(i.h3,{id:\"rtcreportingd-is-using-cpu-but-i-have-no-cloud-sync-clients\",children:[(0,e.jsx)(i.code,{children:\"rtcreportingd\"}),\" is using CPU but I have no cloud sync clients\"]}),`\n`,(0,e.jsx)(i.p,{children:\"Then the trigger is something else. Sort Activity Monitor by CPU and look at what else is busy. Check the unified log for the daemon's own activity:\"}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsx)(i.code,{children:(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"log\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" show\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" --predicate\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:` 'process == \"rtcreportingd\"'`}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" --last\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" 1h\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" --info\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#D73A49\",\"--shiki-dark\":\"#F97583\"},children:\" |\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\" head\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -50\"})]})})})}),`\n`,(0,e.jsx)(i.p,{children:\"Be aware that unified log queries only return what was actually written, and log data ages out \\u2014 a query over a long window can legitimately return nothing.\"}),`\n`,(0,e.jsx)(i.h3,{id:\"disk-utility-first-aid-says-the-disk-is-fine\",children:\"Disk Utility First Aid says the disk is fine\"}),`\n`,(0,e.jsx)(i.p,{children:\"It will. This is not filesystem corruption. First Aid checks metadata consistency; a directory full of large, valid files is perfectly consistent.\"}),`\n`,(0,e.jsx)(i.h3,{id:\"can-i-just-disable-rtcreportingd\",children:\"Can I just disable rtcreportingd?\"}),`\n`,(0,e.jsx)(i.p,{children:\"We would not. It is an Apple system daemon on a Mac with System Integrity Protection, and disabling system launch daemons to work around a symptom tends to produce a second, less obvious problem later. Fix the process that is driving it instead. If the daemon is misbehaving with no identifiable trigger, that is an Apple bug worth reporting rather than one to route around.\"}),`\n`,(0,e.jsxs)(i.h3,{id:\"my-mac-is-running-out-of-space-and-i-need-room-now\",children:[\"My Mac is running out of space and I need room \",(0,e.jsx)(i.em,{children:\"now\"})]}),`\n`,(0,e.jsxs)(i.p,{children:[\"Immediate, safe wins while you diagnose: empty your own Trash, empty root's Trash as above, delete the root Logs contents, and check \",(0,e.jsx)(i.code,{children:\"sudo du -h -d 1 /private/var/root/Library/Caches\"}),\". Between them those often free enough to make the Mac usable again while you find the cause. Our guide to \",(0,e.jsx)(i.a,{href:\"/blog/macos-update-stuck-installation-failed-not-enough-space-mac-fix-2026\",children:\"update failures caused by insufficient space\"}),\" covers what to do if this is blocking a macOS update specifically.\"]}),`\n`,(0,e.jsx)(i.h2,{id:\"faq\",children:\"FAQ\"}),`\n`,(0,e.jsxs)(i.h3,{id:\"what-is-privatevarroot\",children:[\"What is \",(0,e.jsx)(i.code,{children:\"/private/var/root\"}),\"?\"]}),`\n`,(0,e.jsxs)(i.p,{children:[\"It is the home directory of the root account on macOS. It is readable only by root, which is why tools running as your user cannot see inside it. System daemons that run as root store logs, caches and state there, using the same \",(0,e.jsx)(i.code,{children:\"Library\"}),\" structure as your own home folder.\"]}),`\n`,(0,e.jsx)(i.h3,{id:\"why-cant-finder-or-my-storage-app-see-these-files\",children:\"Why can't Finder or my storage app see these files?\"}),`\n`,(0,e.jsx)(i.p,{children:\"Because they run as you, and the directory's Unix permissions exclude your user. This is not a privacy protection that Full Disk Access can lift \\u2014 it is ordinary file permissions. A GUI tool must be relaunched with elevated privileges to walk that directory.\"}),`\n`,(0,e.jsxs)(i.h3,{id:\"what-is-rtcreportingd\",children:[\"What is \",(0,e.jsx)(i.code,{children:\"rtcreportingd\"}),\"?\"]}),`\n`,(0,e.jsxs)(i.p,{children:[\"An Apple system daemon at \",(0,e.jsx)(i.code,{children:\"/usr/libexec/rtcreportingd\"}),\", launched by \",(0,e.jsx)(i.code,{children:\"com.apple.rtcreportingd\"}),\" and running as root. Apple does not document it. Its internal structure indicates a reporting service that communicates with an Apple backend over HTTP and maintains a local cache. It exists on healthy Macs and is not itself a problem.\"]}),`\n`,(0,e.jsx)(i.h3,{id:\"is-it-malware\",children:\"Is it malware?\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"No. It is an Apple binary in \",(0,e.jsx)(i.code,{children:\"/usr/libexec\"}),\", launched by a launch daemon inside the sealed system volume. You can confirm its signature:\"]}),`\n`,(0,e.jsx)(e.Fragment,{children:(0,e.jsx)(i.pre,{className:\"shiki shiki-themes github-light github-dark\",style:{\"--shiki-light\":\"#24292e\",\"--shiki-dark\":\"#e1e4e8\",\"--shiki-light-bg\":\"#fff\",\"--shiki-dark-bg\":\"#24292e\"},tabIndex:\"0\",icon:'',children:(0,e.jsx)(i.code,{children:(0,e.jsxs)(i.span,{className:\"line\",children:[(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#6F42C1\",\"--shiki-dark\":\"#B392F0\"},children:\"codesign\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" -dv\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#005CC5\",\"--shiki-dark\":\"#79B8FF\"},children:\" --verbose=2\"}),(0,e.jsx)(i.span,{style:{\"--shiki-light\":\"#032F62\",\"--shiki-dark\":\"#9ECBFF\"},children:\" /usr/libexec/rtcreportingd\"})]})})})}),`\n`,(0,e.jsx)(i.h3,{id:\"how-much-space-is-normal-for-roots-logs-folder\",children:\"How much space is normal for root's Logs folder?\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"On a healthy Mac, small \\u2014 this is not a folder you should be able to notice. If \",(0,e.jsx)(i.code,{children:\"sudo du -sh /private/var/root/Library/Logs\"}),\" returns anything in double-digit gigabytes, that is the problem. There is no official Apple threshold; the practical test is whether it grows while the Mac is idle.\"]}),`\n`,(0,e.jsx)(i.h3,{id:\"will-a-mac-cleaning-app-fix-this\",children:\"Will a Mac cleaning app fix this?\"}),`\n`,(0,e.jsx)(i.p,{children:\"Almost certainly not, for the same reason your storage analyser missed it: unless the cleaner escalates privileges and specifically walks root's home directory, it cannot see the files. And even a cleaner that removed them would not stop them coming back, because the cause is a looping process rather than accumulated junk.\"}),`\n`,(0,e.jsx)(i.h3,{id:\"does-this-affect-only-certain-macs-or-macos-versions\",children:\"Does this affect only certain Macs or macOS versions?\"}),`\n`,(0,e.jsx)(i.p,{children:\"There is not enough public data to say. The documented case was an M4 MacBook Air. We verified the daemon and the permission behaviour on macOS 26.5.2. Nothing about the mechanism is specific to a chip or a macOS version \\u2014 root has had a home directory for as long as macOS has existed.\"}),`\n`,(0,e.jsx)(i.h3,{id:\"should-i-report-this-to-apple\",children:\"Should I report this to Apple?\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"Yes, if you hit it. Include the output of \",(0,e.jsx)(i.code,{children:\"sudo du -h -d 2 /private/var/root/\"}),\", the CPU figures for \",(0,e.jsx)(i.code,{children:\"rtcreportingd\"}),\" and \",(0,e.jsx)(i.code,{children:\"fileproviderd\"}),\", and which sync client stopping resolved it. Apple has published nothing about this, and specific reports are how that changes.\"]}),`\n`,(0,e.jsx)(i.h2,{id:\"conclusion\",children:\"Conclusion\"}),`\n`,(0,e.jsxs)(i.p,{children:[\"The reason this problem is so frustrating is that every instinct you have about Mac storage is wrong for it. The files are not in a folder you can find. They are not snapshots. They are not System Data in the sense the Storage pane means. Deleting apps does not help, the numbers do not add up, and the one tool that would show you is the one you did not think to run with \",(0,e.jsx)(i.code,{children:\"sudo\"}),\".\"]}),`\n`,(0,e.jsxs)(i.p,{children:[\"Once you know where to look it is a ten-minute job: measure \",(0,e.jsx)(i.code,{children:\"/private/var/root\"}),\" with \",(0,e.jsx)(i.code,{children:\"du\"}),\", delete the logs, empty root's Trash, and then \\u2014 the part that actually matters \\u2014 watch Activity Monitor until you find the process that is filling them back up. Nine times out of ten, given \",(0,e.jsx)(i.code,{children:\"fileproviderd\"}),\" sitting next to \",(0,e.jsx)(i.code,{children:\"rtcreportingd\"}),\" in the CPU list, that is a cloud sync client that has been quietly broken for months.\"]}),`\n`,(0,e.jsx)(i.p,{children:\"And if your Mac's storage numbers disagree by a few gigabytes rather than ninety, relax. That is just APFS being APFS, and Howard Oakley's arithmetic explains all of it.\"}),`\n`,(0,e.jsx)(i.p,{children:(0,e.jsxs)(i.em,{children:[\"Related reading: \",(0,e.jsx)(i.a,{href:\"/blog/macos-tahoe-system-data-storage-huge-wont-shrink-fix-2026\",children:\"System Data storage huge on Mac and won't shrink\"}),\" \\xB7 \",(0,e.jsx)(i.a,{href:\"/blog/macos-tahoe-storage-management-optimization-guide-2025\",children:\"macOS storage management and optimization\"}),\" \\xB7 \",(0,e.jsx)(i.a,{href:\"/blog/mac-storage-analyzer-tools-guide-2025\",children:\"Mac storage analyzer tools compared\"}),\" \\xB7 \",(0,e.jsx)(i.a,{href:\"/blog/macos-tahoe-icloud-drive-complete-guide-2025\",children:\"iCloud Drive complete guide\"}),\" \\xB7 \",(0,e.jsx)(i.a,{href:\"/blog/macos-update-stuck-installation-failed-not-enough-space-mac-fix-2026\",children:\"macOS update stuck: not enough space\"})]})}),`\n`,(0,e.jsxs)(i.p,{children:[(0,e.jsx)(i.strong,{children:\"Sources:\"}),' Michael Tsai, \"Huge RTCReporting Logs and Dropbox\", 21 August 2026 \\xB7 The Eclectic Light Company, \"The arithmetic of free space\", 21 August 2026 \\xB7 Apple Support Community thread 254838127 (RTCReporting) \\xB7 Apple, Disk Utility Help (purgeable space) \\xB7 Local verification on macOS 26.5.2 (build 25F84), 22 August 2026, using ',(0,e.jsx)(i.code,{children:\"ls\"}),\", \",(0,e.jsx)(i.code,{children:\"plutil\"}),\", \",(0,e.jsx)(i.code,{children:\"strings\"}),\", \",(0,e.jsx)(i.code,{children:\"df\"}),\", and \",(0,e.jsx)(i.code,{children:\"ps\"}),\".\"]})]})}function c(s={}){let{wrapper:i}=s.components||{};return i?(0,e.jsx)(i,{...s,children:(0,e.jsx)(d,{...s})}):d(s)}return F(v);})();\n;return Component;","toc":[{"title":"Key Takeaways","url":"#key-takeaways","depth":2},{"title":"Why Your Storage Tools Cannot See It","url":"#why-your-storage-tools-cannot-see-it","depth":2},{"title":"Root Has a Home Directory, and Daemons Use It","url":"#root-has-a-home-directory-and-daemons-use-it","depth":3},{"title":"This Is Why the Numbers Disagree","url":"#this-is-why-the-numbers-disagree","depth":3},{"title":"What rtcreportingd Actually Is","url":"#what-rtcreportingd-actually-is","depth":2},{"title":"Finding the Space","url":"#finding-the-space","depth":2},{"title":"1. Confirm the Gap Exists","url":"#1-confirm-the-gap-exists","depth":3},{"title":"2. Measure Root's Home Directory","url":"#2-measure-roots-home-directory","depth":3},{"title":"3. See What Is Inside","url":"#3-see-what-is-inside","depth":3},{"title":"4. A GUI Alternative","url":"#4-a-gui-alternative","depth":3},{"title":"Reclaiming It — and the Mistake That Wastes the Whole Job","url":"#reclaiming-it--and-the-mistake-that-wastes-the-whole-job","depth":2},{"title":"Now Find What Is Causing It","url":"#now-find-what-is-causing-it","depth":2},{"title":"Watch the CPU","url":"#watch-the-cpu","depth":3},{"title":"Watch the Logs Grow","url":"#watch-the-logs-grow","depth":3},{"title":"Suspect Cloud Sync First","url":"#suspect-cloud-sync-first","depth":3},{"title":"What to Do About the Sync Client","url":"#what-to-do-about-the-sync-client","depth":3},{"title":"The Other Places Storage Hides From You","url":"#the-other-places-storage-hides-from-you","depth":2},{"title":"How Common Is This?","url":"#how-common-is-this","depth":2},{"title":"Troubleshooting Common Issues","url":"#troubleshooting-common-issues","depth":2},{"title":"sudo du is taking forever","url":"#sudo-du-is-taking-forever","depth":3},{"title":"I deleted the logs but free space did not change","url":"#i-deleted-the-logs-but-free-space-did-not-change","depth":3},{"title":"The space came back within a day","url":"#the-space-came-back-within-a-day","depth":3},{"title":"rtcreportingd is using CPU but I have no cloud sync clients","url":"#rtcreportingd-is-using-cpu-but-i-have-no-cloud-sync-clients","depth":3},{"title":"Disk Utility First Aid says the disk is fine","url":"#disk-utility-first-aid-says-the-disk-is-fine","depth":3},{"title":"Can I just disable rtcreportingd?","url":"#can-i-just-disable-rtcreportingd","depth":3},{"title":"My Mac is running out of space and I need room now","url":"#my-mac-is-running-out-of-space-and-i-need-room-now","depth":3},{"title":"FAQ","url":"#faq","depth":2},{"title":"What is /private/var/root?","url":"#what-is-privatevarroot","depth":3},{"title":"Why can't Finder or my storage app see these files?","url":"#why-cant-finder-or-my-storage-app-see-these-files","depth":3},{"title":"What is rtcreportingd?","url":"#what-is-rtcreportingd","depth":3},{"title":"Is it malware?","url":"#is-it-malware","depth":3},{"title":"How much space is normal for root's Logs folder?","url":"#how-much-space-is-normal-for-roots-logs-folder","depth":3},{"title":"Will a Mac cleaning app fix this?","url":"#will-a-mac-cleaning-app-fix-this","depth":3},{"title":"Does this affect only certain Macs or macOS versions?","url":"#does-this-affect-only-certain-macs-or-macos-versions","depth":3},{"title":"Should I report this to Apple?","url":"#should-i-report-this-to-apple","depth":3},{"title":"Conclusion","url":"#conclusion","depth":2}],"estimatedTime":22}