Friday, February 4, 2011

Sleepimage:
How To Remove Gigabytes
Of Unwanted Fat

--
Mac OS X 10.5 & 10.6 brought with them a new feature called the 'sleepimage' file. You can find it here:

/private/var/vm/

You can get there in the Finder by using the Go menu: Go to Folder: Then type in the above path.

Inside this folder is all your vm or Virtual Memory. It includes all your 'swapfile's, which you should at this point leave be, and your 'sleepimage' file. The sleepimage is as large as the amount of RAM you have installed on your Mac. In my case, using my MacBook, it is 3 Gigabytes in size. What if I could removed that file 'forever' and have 3 GB more of freed space on my boot volume? For app addicts like me, that means a lot more room and a lot lower chance of banging my free space for virtual memory to zero, which in turn forces a reboot to free up the VM, which is annoying.

Before I tell you how to perform the undocumented tricks, let's find out what the sleepimage file is for, because you might well want to keep it! I'm quoting here from Apple's online PDF manual "Mac OS X, Security Configuration For Version 10.5 Leopard, Second Edition."
When your computer goes into hibernation, it writes the content of RAM to the /var/vm/sleepimage file. The sleepimage file contains the contents of RAM unencrypted, similar to a swap file.
The document then goes on to tell you how to turn on "Use secure virtual memory" in order to encrypt what is saved into the sleepimage file. And that's all Apple says about the sleepimage file.

Thanks to information provided by Jeremy King over at the MacRumors Forums (Apple Hardware : Notebooks : MacBook Pro : Sleep Image???) I learned one way to empty the sleepimage file by turning off Hibernation Mode. It requires using the CLI via the Terminal. If you are not yet well versed at using the Terminal, please do your homework first. I'm not going to explain the meaning of these commands.

Hibernation Mode Settings:

Disable
sudo pmset -a hibernatemode 0

Enable
sudo pmset -a hibernatemode 3

Always Use
sudo pmset -a hibernatemode 1

If you disable Hibernation Mode then reboot, you should find that your sleepimage file is empty.

But there is another method that may be helpful for the CLI averse, which includes me. You must follow my method exactly or die. I've never had trouble with it, ever. However, I've heard hearsay reports that someone or other did something sort of like this and blew their system, resulting in the inability to boot into Mac OS X. This sounds like BS to me. But never underestimate the 'wetware' factor. Having said that, I provide no guarantee of anything at all if you follow my method. Just know that it works perfectly for my purposes. Here goes!

1) Go into the Finder Preferences, under the Finder menu, and check ON "Show all filename extensions". You may have already done this. I have it on all the time.

2) Open TextEdit and create at new document.

3) Save the document file with the name 'sleepimage'. I like to save to my Desktop. Note that TextEdit will put an extension, such as ".rtf", on the end of the file.

4) Go to this saved file and REMOVE the .Extension from the end of the file name. For example, ".rtf"

5) Verify in the resulting finder box that you do indeed want to "Remove" the file extension.

6) Go into the 'vm' folder using the path I provided above.

7) Click on the 'sleepimage' file inside the vm folder and send it to the Trash. You will have to provide both your Administrator ID and Password in the resulting Finder window in order to do this.

8) Drag into the vm folder your 'sleepimage' text file. You will again have to 'Authenticate' this action by providing your Administrator ID and Password.

9) Click once on your new 'sleepimage' file and Get Info for it, IOW Command-i.

10) Check ON 'Locked' in the sleepimage Get Info window. The purpose here is to prevent Mac OS X from changing or removing this file. You are the boss-of-it.

11) Empty the Trash to remove the obese old 'sleepimage' file.

You're done.

Instantly you have back ALL the disk space that was eaten up by the sleepimage file. And it won't come back. Well, probably not. There are always the random ghosts, cosmic rays, or karmic fates that make computing strange at times. I have had the sleepimage return from the dead on one occasion and I have no idea why. I put my MacBook to sleep one night and it woke up with a live sleepimage file back again. Thus the term 'Ghost in the machine'. So I killed it off  again, replaced the sleepimage file, and was back in business.

LOGIC:

I'm a quirky gizmologist who enjoys breaking things, playing with them, then putting the back together again. I'm a trained hacker and geek. If you are not, then I'd suggest taking the more logical approach,  using the CLI method for turning OFF Hibernation Mode in order to clear your sleepimage file. It's short and simple and follows proper protocols. My method is a hack. If you want to play around and are confident you know what you are doing, try my hack for fun.



Share and Enjoy,
:-Derek
--

4 comments:

Peder said...

How does this work under OS X Lion?

:-Derek said...

"peder said...
How does this work under OS X Lion?"

I wish I could tell you. Due to family medical stuff I've put off installing Lion for a few weeks. I can't imagine Apple has moved location of the 'vm' folder containing the sleep image file. But that's all I can hazard to guess at the moment. I have not yet seen a Lion specific article on the subject.

:-Derek

ferruccio said...

I just tried the CLI version on Lion. I had to also manually remove the sleepimage file, but it seems to be working.

C17GEY said...

Works exactly the same in Lion. I agree with ferruccio as I did both CLI and the manual way... but it all works exactly as described in the post above.

It would be handy if Apple gave the same option Windows does and allow users to turn off hibernation and then delete hiberfile.sys which does (in Windows) exactly what the post suggests here for Mac.

Thanks very much to Derek for the informative post though, it's AWESOME!!