I have a strange problem and hope I can find a solution here.

I'm using a VPN to connect a linux server. When I downloaded ~2Gb binary file from the server to an extra data disk, I found the system disk space dropped dramatically. I tried many ways and found that the VPN software outputted the log for any data it transferred. In general, it will take ~30Gb space to transfer 2Gb file.

The strange thing is that I used a crontab task to auto remove the log file every 2 minutes. After that, I cannot find the log file anymore, but the problem still exists :(.

% sudo crontab -l
*/2 * * * * rm -rf /private/var/log/vsgvpn.log

% sudo fs_usage -w 1994 | grep log

18:26:58.430915    WrData[AT1]     D=0x0010e578  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002608 W com.leadsec.ipse.44482
18:26:58.540420    WrData[AT1]     D=0x0010e678  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002613 W com.leadsec.ipse.44482
18:26:58.650065    WrData[AT1]     D=0x0010e778  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002611 W com.leadsec.ipse.44482
18:26:58.759858    WrData[AT1]     D=0x0010e878  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002617 W com.leadsec.ipse.44482
18:26:58.859374    WrData[AT1]     D=0x0010e978  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002619 W com.leadsec.ipse.44482
18:26:58.952178    WrData[AT1]     D=0x0010ea78  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002583 W com.leadsec.ipse.44482
18:26:59.045127    WrData[AT1]     D=0x0010eb78  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002579 W com.leadsec.ipse.44482
18:26:59.138504    WrData[AT1]     D=0x0010ec78  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002581 W com.leadsec.ipse.44482
18:26:59.229411    WrData[AT1]     D=0x0010ed78  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002577 W com.leadsec.ipse.44482
18:26:59.323566    WrData[AT1]     D=0x0010ee78  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002581 W com.leadsec.ipse.44482
18:26:59.415255    WrData[AT1]     D=0x0010ef78  B=0xef000  /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002479 W com.leadsec.ipse.44482
18:26:59.415531    WrData[AT1]     D=0x0010f067  B=0x11000  /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.000201 W com.leadsec.ipse.44482
18:26:59.529387    WrData[AT1]     D=0x0010f078  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002575 W com.leadsec.ipse.44482
18:26:59.639340    WrData[AT1]     D=0x0010f178  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002078 W com.leadsec.ipse.44482
18:26:59.750946    WrData[AT1]     D=0x0010f278  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002620 W com.leadsec.ipse.44482
18:26:59.859998    WrData[AT1]     D=0x0010f378  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002575 W com.leadsec.ipse.44482
18:26:59.969905    WrData[AT1]     D=0x0010f478  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002615 W com.leadsec.ipse.44482
18:27:00.084635    WrData[AT1]     D=0x0010f578  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002574 W com.leadsec.ipse.44482
18:27:00.209302    WrData[AT1]     D=0x0010f678  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002070 W com.leadsec.ipse.44482
18:27:00.323418    WrData[AT1]     D=0x0010f778  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002064 W com.leadsec.ipse.44482
18:27:00.435673    WrData[AT1]     D=0x0010f878  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002582 W com.leadsec.ipse.44482
18:27:00.533213    WrData[AT1]     D=0x0010f978  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002627 W com.leadsec.ipse.44482
18:27:00.634702    WrData[AT1]     D=0x0010fa78  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002581 W com.leadsec.ipse.44482
18:27:00.733164    WrData[AT1]     D=0x0010fb78  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002629 W com.leadsec.ipse.44482
18:27:00.834127    WrData[AT1]     D=0x0010fc78  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002621 W com.leadsec.ipse.44482
18:27:00.929496    WrData[AT1]     D=0x0010fd78  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002616 W com.leadsec.ipse.44482
18:27:01.024020    WrData[AT1]     D=0x0010fe78  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002619 W com.leadsec.ipse.44482
18:27:01.123571    WrData[AT1]     D=0x0010ff78  B=0xef000  /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002449 W com.leadsec.ipse.44482
18:27:01.123699    WrData[AT1]     D=0x00110276  B=0x11000  /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002500 W com.leadsec.ipse.44482
18:27:01.238057    WrData[AT1]     D=0x00110287  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002581 W com.leadsec.ipse.44482
18:27:01.352766    WrData[AT1]     D=0x00110387  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002614 W com.leadsec.ipse.44482
18:27:01.464467    WrData[AT1]     D=0x00110487  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002613 W com.leadsec.ipse.44482
18:27:01.577524    WrData[AT1]     D=0x00110587  B=0x100000 /dev/disk3s1  /private/var/log/vsgvpn.log                                                                                                                         0.002607 W com.lea

I cannot find the VPN outputs the log to another file or problem due to Time Machine (has been disabled).

Any help will be appreciated.



1 Answer 1


The contents of a file on the file system is not necessarily immediately removed when you issue the rm command. The name of the itself is removed from the file system - i.e. you wouldn't see it in a directory listing.

However, if a program (such as your VPN software) has the file opened when you delete it, the operating system will keep the file on disk until the program closes the file.

With long-running software such as a VPN program, this means the developer of the VPN service usually provides you with a way of signalling to the program that you have removed (or rotated) the log file. If this is not done, you might have to resort to closing the VPN program and starting it up again.

  • Thanks for you answer. I also tested just clean the file by echo "anything" > the.log, however, it still not works. It's strange about where the MacOS put the content into. I also cannot find any commands to access/refresh the cached space. Aug 17, 2021 at 11:51
  • 1
    That command you have there does not "clean" the file. Instead it will create a new file. This behavior you're seeing might seem strange, but it is very common for operating systems to work like this - it's not only something that happens on macOS. It is the same on for example Linux or FreeBSD, and I think on Windows aswell.
    – jksoegaard
    Aug 17, 2021 at 12:05
  • Thanks for your illustration. The sad thing is that I still could not find a workaround :( I can only reset the software/restart the computer to free the space. Thanks again ~ Aug 17, 2021 at 12:16
  • 1
    Well, restarting the VPN software must be quite a lot easier than rebooting the computer. You haven't written what kind of VPN software you're using - if you did that, it could be that someone knows how to tell the software to rotate the log file. Is it perhaps the Cisco VSG software, you're using?
    – jksoegaard
    Aug 17, 2021 at 12:21
  • The amazing thing is that after restarting, I found the second approach works. The log file is updated now, and it will be erased with > pipe. Thank you jksoegaard for the nice discussion. I also wrote an email to the software company, hope it will repond with a more suitable solution :). Aug 17, 2021 at 12:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .