WifiDiagnostics files filling up drive even with logging disabled

Question

Since upgrading to OS X Catalina, I started getting disk full notifications. After some looking, I discovered the cause is ~400 MB files in /private/var/tmp like this:

WiFiDiagnostics_2019-10-23_12.58.55.713_Mac OS X_MacBookPro15,4_19A602.tgz

Option-clicking on the wifi icon in the menu bar shows "Enable Wi-Fi Logging" (indicating it's disabled; if it's enabled, it shows "Disable…").

My findings so far:

• It seems to happen more frequently on certain wifi networks than others.
• It seems to happen more when Wireguard is running, and more when Wireguard is in use for a VPN. (It still happens with Wireguard quit, but not as much, it seems.)
• At one point, it was creating a new file (~400mb) every 5 minutes.
• I've tried enabling and disabling wifi logging, without luck.

I haven't been able to find anything on google. How do I stop the auto-generation of diagnostic logs?

Update: I've updated to 10.15.1, and also did an OS reinstall (not full disk wipe), and am still getting the log files appearing.

Update 2, Resolution? Short version: Somehow the command+option+control+shift+w key combo is triggering this.

Longer version: I did a full disk wipe and reinstall, then kept an eye on when this issue reappeared and installed my normal apps slowly. This file reappeared once I installed Karabiner to make my caps-lock key map to command+control+option+shift, which I use with Alfred App to make application keyboard shortcuts.

One of the shortcuts I made was command+control+option+shift+w to open iTerm. I'd noticed before that hitting this key combination made the screen flash white, but I couldn't find any information (at all, anywhere) nor any existing keyboard shortcuts indicating what that key combination would do. But sure enough, 5 minutes later, I had the log file show up.

My belief at this point is that that particular keyboard shortcut, command+option+control+shift+w, triggers something in OS X (possibly Catalina only; I don't have an older OS to test against) that starts the wifi logging.

I'm super interested to know how/why/where shift+control+option+command+w is actually being mapped. I've tried figuring out the com.apple.symbolichotkeys.plist file but without luck. I also tried that key combo on another Catalina install and it doesn't seem to do the same thing, so perhaps there's another app I have installed that configured that keyboard shortcut. But at this point I don't have the time to re-wipe the computer and set it up again to track it down.

Answer 1

(Answering my own question, since others seem to be having this issue as well.)

The "hyper+w" (command+option+control+shift+w) key combo is triggering the the wifi logging. Note that "hyper+>" also seems to trigger this. I haven't been able to figure out why it's happening, but that's the culprit.

I've used Karabiner Elements to disable those keyboard shortcuts entirely, to prevent accidentally triggering this wifi logging. Here's the relevant section from the karabiner.json file to make those key combos trigger an escape instead of the wifi logging. To add these rules, go to the "Misc" tab, and do the export/import "Open config folder", then edit the karabiner.json to include the following two rules.

"rules": [
    {
        "description": "Disabling command+control+option+shift+w. This triggers wifi logging.",
        "manipulators": [
            {
                "from": {
                    "key_code": "w",
                    "modifiers": {
                        "mandatory": [
                            "command",
                            "control",
                            "option",
                            "shift"
                        ]
                    }
                },
                "to": [
                    {
                        "key_code": "escape"
                    }
                ],
                "type": "basic"
            }
        ]
    },
    {
        "description": "Disabling command+control+option+shift+>. This triggers wifi logging also.",
        "manipulators": [
            {
                "from": {
                    "key_code": ">",
                    "modifiers": {
                        "mandatory": [
                            "command",
                            "control",
                            "option",
                            "shift"
                        ]
                    }
                },
                "to": [
                    {
                        "key_code": "escape"
                    }
                ],
                "type": "basic"
            }
        ]
    },
    {
        "description": "Change caps_lock key to command+control+option+shift. (Post escape key when pressed alone)",
        "manipulators": [
            {
                "from": {
                    "key_code": "caps_lock",
                    "modifiers": {
                        "optional": [
                            "any"
                        ]
                    }
                },
                "to": [
                    {
                        "key_code": "left_shift",
                        "modifiers": [
                            "left_command",
                            "left_control",
                            "left_option"
                        ]
                    }
                ],
                "to_if_alone": [
                    {
                        "key_code": "escape"
                    }
                ],
                "type": "basic"
            }
        ]
    }
]

Answer 2

If you don't want to lose the hyper+w shortcut, you can use Karabiner Elements to remap it to an unused key. In this example I map it to F13 in karabiner.json:

{
  "manipulators": [
    {
      "description": "Change hyper+w to F13 (to avoid system binding of hyper-w which creates 500mb wifi diagnostics file in /var/tmp)",
      "from": {
        "key_code": "w",
        "modifiers": {
          "mandatory": [
            "left_shift",
            "left_option",
            "left_control",
            "left_command"
          ]
        }
      },
      "to": [
        {
          "key_code": "f13"
        }
      ],
      "type": "basic"
    }
  ]
},

I intercept F13 in Hammerspoon (~/.hammerspoon/init.lua) to open my web browser:

hs.hotkey.bind({}, "f13", function()
  window = hs.window.find("Vivaldi")
  if window then
    window:raise()
    window:focus()
  end
end)

(Many thanks to brett_f for figuring this out - this was driving me mad! I couldn't figure out how those Wifi diagnostic files were being created!

I don't have enough reputation to comment on his answer, so I'm posting my answer as a slight variation)

Answer 3

This Karabiner-Elements complex modification will enable brett_f's solution for both Meta-W and Meta->.

Edit: I've now published a fix for this to the official repository of KarabinerElements complex_modification rules. It's called Disable WifiDiagnostics shortcuts (Free up Hyper-W) and it uses Michael Graham's solution to remap the keyboard shortcut command+control+option+shift+, to f13 so it can still be used by other applications (I detect it in Alfred).