Kernel killing Time Machine backup due to low swap

TidBITS Talk
1

Time Machine has stopped working on my iMac running Mojave. The symptom is that it will be in “Preparing Backup…” for a long time, then the backup just quits with no errors shown.

I can see in the logs that what’s happening is the kernel is killing backupd because it is using too much memory:

21-10-16 14:06:23.436 kernel low swap: killing largest compressed process with pid 1366 (backupd) and size 260 MB
(com.apple.backupd[1366]): Service exited due to SIGKILL | sent by kernel_task[0]

iStat menus shows that each time it attempts a backup, the swap memory grows to just short of 50 GB, then backupd gets killed.

I’m thinking that when Time Machine is comparing the last backup to the current state of the iMac, there’s too many changes found.

Or, maybe there’s something wrong in the Spotlight database – SuperDuper was getting stuck yesterday trying to clone those folders in /private, before I updated it to the 3.5 beta which ignores the Spotlight metadata.

The question is, how to get past this and get Time Machine working again?

Microsoft Office for Mac 16.54
2

The Spotlight problem wasn’t with the Spotlight database, it was accumulated empty folders in /private/var/…/com.apple.metadata.mdworking, due to mds crashing. There were over a million empty folders. I don’t think that was what broke Time Machine.

I was finally able to complete a Time Machine backup by deleting Microsoft OneNote and PowerPoint. That got it just barely under the memory limit, but it was enough for the backup to complete.

I don’t know what it was about this Microsoft Office update that pushed the memory up so high.

3

How do I access the logs? Thanks.

Since I installed macOS 11.6.1 on my MBA M1, Time Machine has repeatedly quit without finishing its backup, although it seems to get a bit further each time. (It’s currently at 5.80 GB of 6.03 GB. Three or four attempts ago, it was at 4.something GB of about 5.9 GB before it stopped.) But Time Machine does seem to be backing up more and more slowly each time it runs. (And it just quit.)

This started immediately after I installed macOS 11.6.1; my last completed backup was just before the installation. I assume Time Machine is trying to copy the changed System folder. But why? If Time Machine did finish its backup, could I use it to restore the System folder? I thought that the System folder was a copy of a sealed volume, and so a backup would be useless anyway. It seems like I could exclude the System folder from the Time Machine backup and avoid the problem at no cost. Comment?

4

The logs are viewed with the Console app. I don’t remember if the messages were in the device log or in the system.log.

If you suspect the memory problem, you can see it happen with the memory tab in Activity Monitor. Keep an eye on Memory Used, Swap Used, and the Memory used by the backupd process. If they keep going up until suddenly backupd quits, then you may have the problem.

But I kind of assumed it was a Mojave issue.

I will note that I did try excluding Applications from Time Machine, but that didn’t help. I don’t know why not.

5

Thanks.

Getting off-topic a bit, my only device is the MacBook Air, and there are no messages. Under Reports, the system.log says “Unable to read the file”. Should I be concerned?

In Log Reports, I have four wifi reports with the same date-time in the date column, and all four seem to cover the same time interval. Does this mean anything?

Also in Log Reports, I can apparently sort by date, except that after doing so, the the files are not in date order. They are also not in File Name order nor Kind order. In other words, the Log Reports are not in any order corresponding to the three columns presented in the interface. Huh?

Back to the topic of Time Machine, I could not find any log that seemed to apply to backing up, and the error log in particular only had entries related to the printer.

The Memory tab leads me to believe that I do not have a memory problem. The Memory Pressure is a level green area that takes up perhaps a fifth of the available area, and the sum of the Memory Used and the Cached Files was less than the Physical Memory (it is now slightly more) and Swap Used is and was 0 bytes.

Thanks for pointing me to Console. I’m not sure what the Mac’s problem is, but it continues.

In my experience, Time Machine often (maybe 40% of the time) will, at the end of a backup, stop reporting progress and just say something like, “Backup up: 6.75 GB” (which is what it says right now), and at least the last four attempts by Time Machine to complete a backup have gone directly to this line. For what it’s worth, the number of GB has been creeping up while Time Machine is running. (It was just under 6 GB last night.) The last backup is consistently reported as Oct 27, which is why I say that the backups are failing to complete.

I welcome suggestions, especially “Don’t worry about it.”

6

The last version of macOS with a usable Console was OS X 10.11 El Capitan. 10.12 Sierra switched to the “unified log”, where the relevant log messages are buried in a torrent of incomprehensible messages.

For Time Machine, in theory you can craft a Console query that will filter for the Time Machine log messages. In practice it doesn’t work.

Howard Oakley at The Eclectic Light Company has been fighting the unified log battle for years, and has several free utilities that can show Time Machine logs, including Consolation 3, Ulbow, and The Time Machine Mechanic, but I think the best one for this purpose is Mints.

To use Mints:

  1. Click the Time Machine button.
  2. Set the period, e.g. -2 hours. Note that this is relative to timestamp in the next field, so you you want to re-run Mints again, you will need to click the Now button.
  3. Click Get log.
  4. De-select DAS and CTS unless the problem is related to Time Machine not running when it should. Start with Other de-selected.

Note that it is normal for Time Machine to display some errors, such as “failed to remove attribute”.

Regarding your questions…
Are you running as a non-administrator? If so, maybe that’s why you don’t have permission to view the System log.

For the interface questions, on Mojave I don’t have any columns in Reports logs. But the reports are simply files in the logs directories, and Console is just displaying them. Maybe displaying them in columns depends on the logs having a particular format that Console can parse.

1 Like
7

When Console was changed in Sierra I extracted an older version from my Mountain Lion installer (using Pacifist) – so I have both the modern Console and the older Console v10.11. Console v10.11 runs on my Sierra, High Sierra, and Mojave boot drives.

If you still have an older macOS installer you might want to try this and see if you can find the relevant Time Machine entries using the older version.

8

Thanks, @mschmitt, for the step-by-step instructions for Mints. I had visited the Eclectic Light site, but was overwhelmed. (It’s a great site, but I’ve lost most of the knowledge that would make it a great, usable site for me.)

Yes. Most of the time, I’m in a user account. If I remember (not a sure thing; memory is the second thing to go), I’ll check Console when I login as administrator.

Thanks for all your help after I essentially hijacked your thread. I keyed on the question that ended your first post: “how to get past this and get Time Machine working again?”