Explanation for some Big Sur upgrade problems

Shamino · November 5, 2021, 3:32pm

As I understand it, the /var/folders directory (which is really a symlink to /private/var/folders) is a set of per-user storage locations for app data, caches and temporary files. The directory names appear to be some kind of hash value, but they correspond to distinct users, including a variety of private system users (all within the zz directory).

For example, on my Mac (replacing user names with placeholder names):

> ls -l /var/folders
total 0
drwxr-xr-x@  3 root  wheel    96 Oct 18  2020 c6
drwxr-xr-x@  3 root  wheel    96 Oct 18  2020 dd
drwxr-xr-x@  3 root  wheel    96 Oct 18  2020 ww
drwxr-xr-x@  3 root  wheel    96 Oct 18  2020 yx
drwxr-xr-x@  3 root  wheel    96 Oct 18  2020 zv
drwxr-xr-x@ 35 root  wheel  1120 Sep 27 18:30 zz

> ls -l /var/folders/*
/var/folders/c6:
total 0
drwxr-xr-x@ 7 user1  staff  224 Sep 27 18:30 fvrtg96j0jx10s3778p4kgjw000101

/var/folders/dd:
total 0
drwxr-xr-x@ 6 user2  staff  192 Sep 27 18:32 54bxs1g12td3y4md40lk2xjh0000gs

/var/folders/ww:
total 0
drwxr-xr-x@ 6 admin  staff  192 Sep 27 18:43 p_tsnbcs3dj_3cq6zbdrmm880000gt

/var/folders/yx:
total 0
drwxr-xr-x@ 6 macports  macports  192 Sep 27 18:39 m3d21nm91wnd4c0k2yjk57200000gn

/var/folders/zv:
total 0
drwxr-xr-x@ 6 user3  staff  192 Sep 27 18:32 92_sf7yj6sbfsqc66wthwjhh000102

/var/folders/zz:
total 0
drwxr-xr-x@ 7 root                    wheel                   224 Sep 27 18:30 zyxvpxvq6csfxvn_n0000000000000
drwxr-xr-x@ 5 _lp                     _lp                     160 Jan 17  2021 zyxvpxvq6csfxvn_n000003800000t
drwxr-xr-x@ 5 _appleevents            _appleevents            160 Sep 25  2020 zyxvpxvq6csfxvn_n000006w00001q
drwxr-xr-x@ 5 _mdnsresponder          _mdnsresponder          160 Sep 25  2020 zyxvpxvq6csfxvn_n0000084000021
drwxr-xr-x@ 5 _windowserver           _windowserver           160 Sep 25  2020 zyxvpxvq6csfxvn_n00000b000002r
drwxr-xr-x@ 6 _spotlight              _spotlight              192 Sep 27 18:31 zyxvpxvq6csfxvn_n00000b400002s
drwxr-xr-x@ 5 _securityagent          _securityagent          160 Oct 18  2020 zyxvpxvq6csfxvn_n00000bh00002w
drwxr-xr-x@ 5 _atsserver              _atsserver              160 Sep 25  2020 zyxvpxvq6csfxvn_n00000c4000031
...

Every one of those per-user directories has the same next-level directories:

> ls -l /var/folders/c6/fvrtg96j0jx10s3778p4kgjw000101/
total 0
drwxr-xr-x@  21 user1  staff    672 Sep 27 18:40 0
drwx------@ 304 user1  staff   9728 Nov  1 17:26 C
drwxr-xr-x    2 user1  staff     64 Sep 27 18:30 Cleanup At Startup
drwx------@ 448 user1  staff  14336 Nov  5 10:36 T
drwxr-xr-x    2 user1  staff     64 Sep 27 18:30 X

I don’t know everything about these directories, but here’s what I do know:

0 is the “Darwin User Directory”. The system configuration variable DARWIN_USER_DIR always contains the directory for the current user:

> getconf DARWIN_USER_DIR
/var/folders/c6/fvrtg96j0jx10s3778p4kgjw000101/0/

It appears to contain system files. There are directories named after system apps, frameworks and services. Some are not accessible. Many are binary files (including SQLite databases), while some are plist/XML data files.

> ls -l /var/folders/c6/fvrtg96j0jx10s3778p4kgjw000101/0
ls: com.apple.LaunchServices.dv: Operation not permitted
ls: com.apple.SharedWebCredentials: Operation not permitted
ls: com.apple.exchangesync: Operation not permitted
ls: com.apple.lockoutagent: Operation not permitted
ls: com.apple.nsurlsessiond: Operation not permitted
ls: dmd: Operation not permitted
total 0
drwxr-xr-x  2 user1  staff   64 Sep 27 18:31 com.apple.AppSSOAgent
drwxr-xr-x@ 3 user1  staff   96 Oct 19  2020 com.apple.Safari
drwxr-xr-x@ 3 user1  staff   96 Oct 18  2020 com.apple.ScreenTimeAgent
drwxr-x---  2 user1  staff   64 Oct 18  2020 com.apple.Spotlight
drwxr-xr-x  2 user1  staff   64 Oct 18  2020 com.apple.bird
drwxr-xr-x  3 user1  staff   96 Sep 27 18:41 com.apple.corespeechd
drwxr-xr-x  2 user1  staff   64 Sep 27 18:30 com.apple.dmd
drwx------  3 user1  staff   96 Oct 18  2020 com.apple.dock.launchpad
drwxr-xr-x  2 user1  staff   64 Oct 18  2020 com.apple.icloud.searchpartyd
drwx------  4 user1  staff  128 Oct 18  2020 com.apple.notificationcenter
drwx------  3 user1  staff   96 Nov  5 09:27 com.apple.pluginkit
drwxr-xr-x  3 user1  staff   96 Oct 18  2020 com.apple.progressd
drwxr-xr-x@ 3 user1  staff   96 Oct 18  2020 com.apple.routined

C is the “Darwin User Cache Directory”. The system configuration variable DARWIN_USER_CACHE_DIR always contains the directory for the current user:

> getconf DARWIN_USER_CACHE_DIR
/var/folders/c6/fvrtg96j0jx10s3778p4kgjw000101/C/

It contains cache files. In there, you will see directories named after apps and system services, each one containing cache data for the app.

> ls -l /var/folders/c6/fvrtg96j0jx10s3778p4kgjw000101/C
ls: com.apple.QuickLook.thumbnailcache: Operation not permitted
ls: com.apple.WebKit.GPU.Sandbox: Operation not permitted
ls: com.apple.WebKit.Networking.Sandbox: Operation not permitted
ls: com.apple.WebKit.WebContent.Sandbox: Operation not permitted
total 2368
drwx------     2 user1  staff       64 Sep 27 18:40 ${DaemonNameOrIdentifierHere}/
drwx------     2 user1  staff       64 Oct 18  2020 AudioComponentRegistrar/
drwxr-xr-x     3 user1  staff       96 Dec 10  2020 com.DigiDNA.iMazing2Mac/
drwx------@    4 user1  staff      128 Nov 23  2020 com.TryBest.Paint/
drwxr-xr-x     3 user1  staff       96 Feb  9  2021 com.adobe.ARMDC/
drwxr-xr-x     3 user1  staff       96 Oct 15 17:17 com.adobe.AdobeRdrCEFHelperGPU/
drwxr-xr-x     4 user1  staff      128 Sep 27 18:43 com.adobe.Elements Auto Creations 2021/
drwxr-xr-x     3 user1  staff       96 Oct 23  2020 com.adobe.Elements2021/
drwxr-xr-x     3 user1  staff       96 Oct 23  2020 com.adobe.ElementsOrganizer2021/
...

T is the “Darwin User Temporary Directory”. The system configuration variable DARWIN_USER_TEMP_DIR and the environment variable TMPDIR always contain the directory for the current user:
```
> getconf DARWIN_USER_TEMP_DIR
/var/folders/c6/fvrtg96j0jx10s3778p4kgjw000101/T/

> echo $TMPDIR
/var/folders/c6/fvrtg96j0jx10s3778p4kgjw000101/T/
```
It contains temporary files, again on a per-app basis. I’m not clear about how temporary files differ from cache files. I think cache files are expected to persist over time, while temporary files can be considered cruft after the app that created them quits.
Cleanup At Startup is typically empty. As I understand it, macOS wipes the contents after each reboot. I think it is meant for temporary files generated by system installers. On my system, the directory is empty and was last modified on the date I upgraded from Catalina to Big Sur.
X is empty and hasn’t been modified since the date I upgraded from Catalina to Big Sur. I have no clue what it is supposed to be used for.

In general, I think you can safely delete everything under /var/folders. You can definitely delete the contents of the C and T directories. I would recommend rebooting afterward, in case a running app is using one of the files, but every app should be able to recreate its caches and temporary files the next time it runs.