The other day I reported on my issues with a faulty SD card reader. A couple of support forum users had success in having the logic board replaced so I made an appointment with an Apple Genius. My assigned Genius, Taylor, was great to work with. He was very friendly and although he had never seen this particular issue before, he completed the troubleshooting without fail. Even though it was the morning of Christmas Eve, and I’m sure they had a long day ahead of them, he was patient with me while we discussed the problem and came up with a repair schedule that worked for me. This post isn’t about how great they are so let me get into the problem.
During the troubleshooting, Taylor plugged my laptop into their network and booted an OS X image from their NetBoot server. He tested the SD card reader with his SD card so that he was able to reproduce the problem with a known, good environment. This only took a few minutes and when he was finished, he shutdown the laptop.
This morning I noticed that my CrashPlan backup was running which is rare as it normally finishes everything during the night. I looked at what CrashPlan was uploading and was surprised to see it was pushing up a 16GB sleepimage file. Normally the backup of the hibernation/sleep image file is skipped by CrashPlan per their global exclusion rules. I discovered that it was uploading the file located on my secondary hard drive at /Volumes/HDD/.com.apple.NetBootX/sleepimage. This is odd for a few reasons.
My laptop’s power manager settings, which are saved in NVRAM, is configured to save the sleepimage file on the SSD at /private/var/vm/
It is also configured to only create the sleep image when actually sleeping. During the troubleshooting, the laptop was never put to sleep but only a normal boot up and down. I guess it is possible that their boot image would override the laptop’s PM settings but they are back to my settings now. Perhaps this is a required mode when using a network booted system.
My primary drive (OS, Applications, User folder), in the main drive bay, is an SSD. It has plenty of space left. I don’t know why their boot image decided to use the secondary HDD for the sleepimage file instead.
There are a couple of items to note here that might make it difficult for some users.
Since the .com.apple.NetBootX directory starts with a period, it is hidden in the Finder, so you can’t just drag it to the trash.
The directory, and all files inside, are owned and only readable/writable by the root user.
Due to these items, most users will never notice the directory. Depending on how full your drive is, you might not even notice that you have lost the space. In my case, I don’t have much free space left so an additional 16GBs would be noticed soon enough. The size of the sleepimage file will be the same as how much RAM you have installed in your machine. If you only have 4GB of RAM, but a 1TB hard drive, you probably won’t even notice or care about the lost space.
If you have ever been to the Apple Genius Bar, and they network booted your computer, you might want to check for the existence of the NetBootX directory.
- Open up the Terminal application (located in /Applications/Utilities folder)
- Get a full directory listing of the top level of your hard drive, with the command
ls -al /
If you have a secondary drive, check it too with
ls -al /Volumes/[2nd drive name]/
The listing output will look similar to this.
$ ls -al / drwxr-xr-x 33 root wheel 1190 Dec 26 13:20 ./ drwxr-xr-x 33 root wheel 1190 Dec 26 13:20 ../ d--x--x--x 8 root wheel 272 Aug 25 13:04 .DocumentRevisions-V100/ drwx------ 5 user staff 170 Aug 23 16:05 .Spotlight-V100/ d-wx-wx-wt 3 user staff 102 Dec 26 16:25 .Trashes/ drwx------ 5 root wheel 170 Dec 24 11:24 .com.apple.NetBootX/ drwx------ 69 user staff 2346 Dec 26 12:37 .fseventsd/ drwxr-xr-x@ 2 root wheel 68 Jun 20 2012 .vol/ drwxrwxr-x+ 139 root admin 4726 Dec 25 12:57 Applications/ drwxr-xr-x+ 68 root wheel 2312 Nov 7 22:36 Library/ drwxr-xr-x+ 4 root wheel 136 Jul 26 01:48 System/ drwxr-xr-x 7 root admin 238 Aug 20 14:54 Users/ drwxrwxrwt@ 6 root admin 204 Dec 26 15:24 Volumes/ drwxr-xr-x@ 39 root wheel 1326 Sep 19 15:41 bin/ dr-xr-xr-x 3 root wheel 4709 Dec 25 10:52 dev/ lrwxr-xr-x@ 1 root wheel 11 Aug 23 19:39 etc@ -> private/etc -rw-r--r--@ 1 root wheel 8192160 Aug 25 01:49 mach_kernel drwxr-xr-x@ 6 root wheel 204 Jul 26 01:57 private/ drwxr-xr-x@ 62 root wheel 2108 Sep 19 15:41 sbin/ lrwxr-xr-x@ 1 root wheel 11 Aug 23 19:39 tmp@ -> private/tmp drwxr-xr-x@ 13 root wheel 442 Oct 2 22:01 usr/ lrwxr-xr-x@ 1 root wheel 11 Aug 23 19:39 var@ -> private/var
If you are curious to see the size of the files, list the directory with
$ ls -al /.com.apple.NetBootX drwxr-xr-x@ 5 root wheel 170 Dec 24 11:24 ./ drwxr-x--x 30 user staff 1088 Dec 26 13:10 ../ -rw-r--r--@ 1 root staff 216169984 Dec 24 11:31 shadowfile -rw-r--r--@ 1 root staff 17179869184 Dec 24 11:24 sleepimage -rw-r--r--@ 1 root wheel 67108864 Dec 24 11:24 swapfile0
The size of the other files are only a few hundred megabytes, which is minor compared to the sleep image.
- If you do have the .com.apple.NetBootX directory, you can remove it with the following command. WARNING: Running “sudo rm” with the wrong arguments could delete all your files. Be very careful with this command. Make sure there is NOT a space between the / and .com….
sudo /bin/rm -ri /.com.apple.NetBootX
If it is on your secondary drive, the command will be
sudo /bin/rm -ri /Volumes/[2nd drive name]/.com.apple.NetBootX
You should now be clean of the Genius’ files and the drive space will be available again. If you ever take your system in again, don’t forget to check for the NetBootX directory when you get it back.