3

I probably just don't understand how APFS snapshots work, but this seems odd to me:

~ $ mkdir /private/tmp/snap
~ $ pwd
/Users/dmd
~ $ ls foo
ls: foo: No such file or directory
~ $ tmutil localsnapshot /
Created local snapshot with date: 2020-02-28-191657
~ $ tmutil listlocalsnapshots /
Snapshots for volume group containing disk /:
com.apple.TimeMachine.2020-02-28-191657.local
~ $ mount_apfs -s com.apple.TimeMachine.2020-02-28-191657.local / /private/tmp/snap
mount_apfs: snapshot implicitly mounted readonly
~ $ ls /private/tmp/snap/Users/dmd/foo
ls: /private/tmp/snap/Users/dmd/foo: No such file or directory
~ $ touch /Users/dmd/foo
~ $ ls /private/tmp/snap/Users/dmd/foo
/private/tmp/snap/Users/dmd/foo
~ $ ##### WHAT? WHY IS FOO IN THE SNAPSHOT?  WHY DID THE SNAPSHOT CHANGE?
~ $ rm /Users/dmd/foo
~ $ ls /private/tmp/snap/Users/dmd/foo
ls: /private/tmp/snap/Users/dmd/foo: No such file or directory

Note that the file /Users/dmd/foo is being created on the 'real' disk, but when it is created and deleted those changes are also showing up in the mounted snapshot.

Why?

Improve this question
1
  • Which version of macOS do you use?
    – jksoegaard
    Feb 29, 2020 at 21:08

1 Answer 1

Reset to default
4

I think your conclusion is wrong - even if it looks that way superficially, the snapshot is actually not changed.

The thing that tricks you here is your one of the folders in your path is actually a link. If you're running on pre-Catalina macOS version, you probably have /Users as a symbolic link. If you're running on Catalina, /Users is a firmlink.

This means that when you run ls /private/tmp/snap/Users/dmd/foo to check for the file, you're actually not looking at a file inside the snapshot, but rather the system will traverse the link inside the snapshot and onto your ordinary volume for the actual file.

If you're on Catalina and want to redo your commands without the link interferring with you, you will need to instead use the following command to check for existence of the file inside the snapshot:

ls /private/tmp/snap/System/Volumes/Data/Users/dmd/foo
Improve this answer
5
  • Aha! That was it! Except the snapshot needs to be of /System/Volumes/Data, not of / of course. (And, unrelated, it's odd to me that snapshot creation takes upwards of a minute; I thought it was supposed to be instantaneous, like in zfs.)
    – Daniel
    Feb 29, 2020 at 23:35
  • 1
    Why would /Users pre-Catalina be a symlink?
    – Marc Wilson
    Mar 1, 2020 at 17:03
  • 1
    @MarcWilson Perhaps a bit bad worded in the reply... what I meant was that IF you get the results that are in the question, THEN you probably have it as a symlink. I didn't mean that if you have pre-Catalina, then you probably have a symlink. That's not true. But I have seen some people use symlinks to offload large folders to other drives than the boot drive (or have mounted NFS or similar to have it stored on a server), so if the OP wasn't running Catalina, that would be the case. Now we know he's on Catalina, so it's definitely a firmlink.
    – jksoegaard
    Mar 1, 2020 at 18:11
  • @Daniel For reference, it takes about 6 seconds for me to create an initial snapshot of a 480GB volume with 300GB consumed, so I'd extrapolate that you're snapshotting a volume with 3TB of data? 1TB, at least? As for why it takes this long, I believe the space manager needs to mark all of the blocks that are currently in use as being part of a snapshot, and then immediately write all of these changes to disk rather than just holding them in memory. If you don't have 1TB of data, perhaps the volume is substantially defragmented, so that there are many data chunks which need to be marked.
    – Jivan Pal
    Mar 7, 2020 at 11:50
  • @jivan-pal Yep, it's about 2TB.
    – Daniel
    Mar 8, 2020 at 12:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .