Stop cache from building up

First of all, you're running a modern Mac with a 256 GB hard drive. Those are only suitable for some kind of single-app kiosk configuration. Maybe a card catalog computer in a library, or a directory listing in an office building. Someone who does nothing but look at LOLcat videos all days needs at least a 500 GB drive. You're using Xcode. You need a new computer - end of story.

Assuming you don't like that advice, which I would expect, what else could you do?

Double-check what's going on with those configuration profiles. I've never seen anything with just "com.apple." listed twice. Configuration profiles are a real challenge. They are normally only used by large enterprise users. Sometimes Apple uses them for odd things too, like ScreenTime at one point. But there are so many variations that it's impossible for me to debug them or even know what they should look like. I include them in an EtreCheck report to let people know that a computer has certain low-level customizations. Those two "com.apple." entries could be leftover junk data perhaps. I just don't know.

You've installed MacKeeper and then didn't correctly uninstall it. That's left the key, low-level system extension component running out of control. Of all the "clean up" apps, none has a worse reputation than MacKeeper. But ironically, the one thing MacKeeper does do well is uninstall itself. Perhaps you used some "app zapper" to try to remove it? Luckily, as of macOS Sequoia and Tahoe, you can now remove these orphan system extensions. Go to System Settings > Login Items & Extensions and scroll down to Extensions. Find the MacKeeper extension and click the tiny "..." button. You'll get a pop-up menu where you can remove the extension and then restart. This alone could easily fix the problem you've been experiencing.

Something else is unusual with Grammarly. It's showing up with a "/Users/***/" path. Normally, these apps install into your home directory and EtreCheck redacts those to show something like "~/Library/". You can see that many times in your report. But there's also a fallback in case something really funky is going on and it's showing some other account's home directory. Your report is displaying the fallback. That's really bad. That means that there's been some unholy cross-pollination between user accounts at some point in the past. Whatever caused this could also easily cause the icon services problem.

Your nominal I/O usage is at 393.98 MB/s. That's crazy high.

It seems related to your unusual CPU usage too. All those values are way too high. And there's update_dyld_sim_shared_cache, which is related to the simulator component in Xcode. This is something else which is barely two degrees of separation away from your icon services problem.

In order to recover this computer, you'll definitely need to erase the hard drive and reinstall the operating system. I recommend that you don't try to restore anything. Just setup a new account. Maybe you could use the iCloud trick.

However, this machine is never going to run Xcode. If you're not careful, Xcode can bring a 1 TB drive to its knees in a matter of minutes. I'm surprised you could even install Xcode in the first place, let alone run it. On my 1 TB machine, the Xcode and its internal data take up about 95 GB. And quite frankly I'm surprised it's that low.

Zedairder wrote:

I don’t really remember how I deleted MacKeeper, but I can reinstall it to try to uninstall correctly.

That's not necessary, and wouldn't be possible anyway. A couple of years ago, it was extremely difficult to remove these orphan system extensions. They're literally baked into the operating system at this point. Apple's made it easier now, but only Apple software can remove them.

Grammarly was installed by the App Store, so I would assume that it should be in the right place.

The orphan Grammarly component was not installed via the Mac App Store. It's using file locations that aren't allowed by Mac App Store apps.

I don’t really understand the cross contamination account thing, though.

I don't either. There are only a few ways to make that happen. It could have been an accident. Or it could have been some kind of serious attempt at a custom configuration. It's not unusual to see people who tried to save money and buy these 256 GB machines, thinking they can just swap out the hard drive, setup an external boot drive, or move their home directory to an external. Any of those are always going to be painful. Your computer doesn't actually look like it's been hacked up to that degree. But I still can't explain it.

When I used Xcode it was always slow and I thought it was my problem in the first place. I’ve wanted to become an app developer for a while now so it’s pretty sad that it doesn’t work well. I’ll probably end up deleting it, hopefully I can find a guide that will clear up everything properly.

That alone is going to be a challenge. You can delete most of it by deleting the Xcode app and the "Developer" folders in the /Library and ~/Library folders. If you had installed it from the Mac App Store, it may forever show up as wanting to update.

I don’t notice high cpu usage regularly so I don’t know what that was about.

I don't either. It's definitely part of Xcode, but I don't know why it's doing that.

A while back I experienced a similar problem with Xcode. It ate through 300 GB in a few minutes. I had to perform a very inadvisable hack to stop it. Later, after Apple fixed the bug, I was able to undo my hack with no ill effects.

But in your case, perhaps something similar was happening. Perhaps this was unrelated to the icon services problem. But once you deleted the icon service cache, Xcode tried to jump in and fill it with its own simulator caches. This is not an operating system that's gentle on hard drives.

I ran etrecheck twice and the first time I didn’t get the performance notices. If I did do a reinstall, which issues do you think it would fix? I was thinking about it and I assume it fixes things in the Library directory, where I would say most of my problems lie in… Maybe just a reinstall could fix my cache problem, I’m not too worried about the Grammarly and performance stuff.

The operating system itself is installed on a cryptographically sealed volume and accessed via a read-only snapshot. Reinstallation of just the operating system is almost always a complete no-op event. Nothing will change. The problem is in the configuration layer. It's still managed by the operating system and owned by root, but it isn't part of the data that would be reinstalled.

I'm not all that worried about anything that shows up on your EtreCheck report. All it ever does is provide hints about what might be causing some underlying problem. Sometimes it gets lucky, but not this time. It shows some unusual configurations, like the Grammarly file, the profiles, and Xcode's unruly behaviour. It definitely shows that low-level MacKeeper file that's still active, and literally changes the behaviour of your operating system.

You can definitely take this in stages. Remove that system extension. Clear out all of Xcode. Remove the other antivirus while you're at it. Restart. Do the safe mode boot again. Then see how it behaves. If the problem continues, then you'll have to take more extreme measures.

The one with the most entries and any outrageous sizes would be the prime suspects assuming that folder is being filled as you run that command. The largest file size for me is a bit less than 300K.

You will need to decide & figure out which one of the multiple items it is. That is the first part, then once you figure out the app/process involved, then you have to figure out why it is running amok.

I highly recommend you start quitting each open app to see if that helps you identify the rogue one, but keep in mind the issue could be caused by a background process instead which may be running all the time even when its app is closed. I would suggest disconnect all external media as well to either identify the culprit and to minimize the number of apps/processes so you may be able to pick out which one is going crazy (or are more than one going crazy?).

FYI, I don't have "systemimg" items listed on my system, but that may just be due to the types of apps I'm using. I would imaged that "systemimg" process is likely "systemimage" or something similar, but you can confirm by looking up the ProcessID 57517 (easiest way look for it in Activity Monitor, but you will need to manually look for the PID since the search feature doesn't search for the PID).

You may want to run the third party app EtreCheck and post the complete report here so we can examine it for possible clues.

How to use the Add Text Feature When Posting an EtreCheck Report - Apple Community

Seems an add-on cleaner app may have triggered a corruption. That would match the observed reports and behaviours.

Given reported problems here and with whatever tweaks or other changes, I’d get a backup, wipe and reinstall, and restore (migrate) files and documents and preferences, and maybe apps.

I’d skip migrating the add-on anti-malware apps and the add-on cleaner apps, and I’d approach the add-on “coffee shop” VPN apps with great caution.

My thought was that a safe boot then a normal reboot would prevent it from occurring. That cache is storage of system icons, it shouldn’t be getting that large.

You might consider reinstalling macOS (pretty painless though I wouldn’t do it without a fresh system backup).

How to reinstall macOS - Apple Support

Zedairder wrote:

I don’t have a device to back it up with.

This is extremely scary if you have any important data on your internal SSD!

People should always have frequent and regular backups of their computer and all external media (including the cloud) which contains important & unique data. There are a lot more new ways to permanently lose access to the data stored on the internal SSD of the recent Macs due to all of the hardware, software, and security changes.

As for trying to identify what may be causing the problem, you can try running the following command which will list the App/Process (or Command) for what is opening a file in that folder (the list may be long, but if the cause for filling that folder is not active at the time this is run, then you won't get your answer & if it is active, then this command may never stop until you manually abort the command by using Control + C):

sudo  lsof  +d  /Library/Caches/com.apple.iconservices.store

You should stretch out the Terminal window so that the lines don't wrap around in order to see the first column containing the app/process name. This variation will just list the app/process (aka Command) that is associated with opening the files within that folder.....may make it easier to parse it:

sudo  lsof  +d  /Library/Caches/com.apple.iconservices.store  |  awk  '{print  $1}'

FYI, The use of "sudo" here is the proper way to access locations which require root level access.

Be extremely careful when using any command that has been given root level privileges. There are no safety nets when using the Terminal command line, plus some commands have no easy way to reverse the effect except by restoring from a backup made prior to issuing the command. Even people with decades of command line experience can make a catastrophic mistake from a simple typographical error. People should also never blindly use any commands they find online since many of those commands may have been intended only for that user's very specific setup & circumstances. It is best to understand the command line & the commands that are being used. And you should make sure to have a good backup before using any Terminal commands.

See if the problem is present when you boot in safe mode, which disables 3rd party extensions and performs some system cleanup.

Start up your Mac in safe mode - Apple Support

Zedairder wrote:

I forgot to add that if even I can’t access it without root, how would a third-party program access it?

That's the problem in a nutshell. The root user should only ever be used in the Terminal and only for a handful of very specific operations. Most users should never even need that.

When you enable the root user, you run all apps as root. These apps were never designed to be run as the root user. Nobody has any idea how they'll behave or how they'll change the system. This is not just a problem with 3rd party software. Apple apps would likely do even more damage when running as root.

If they can I’m concerned for the security of my Mac.

That is a valid concern when enabling the root user. But it's not "that kind" of security. As long as you haven't purposefully disabled and/or bypassed Apple security, then you don't have to worry about malware. But general system security is still a problem. It's quite normal for system services and apps to re-use code and share libraries. In some cases, this code was written decades ago - long before modern security practices. In normal operation, this is not a concern because normal apps run with normal security settings, until they don't.

It's not a malware concern. The worst thing that could happen would be some low-level cache directory growing out of control.

Again. It is NOT the root user’s fault. I don’t have any other “hacks” whatever that’s supposed to mean.

Well you didn't realize, and still refuse to accept, that enabling the root user is a big, dangerous hack.

I’m not really a technical user of my Mac and I don’t try to modify other things…

Seems like you're doing pretty advanced modification in that area so far.

If you’re suggesting an app is doing it, I have barely any applications on my Mac which I can also list in case anyone wants to check if they’re malware.

Again, this has nothing to do with malware. Something's going wrong. This cache directory should not have 100 GB of data in it. But nobody knows how these low-level, internal Apple processes work. When they break, the cause is invariably some 3rd party app that hacks up the system somehow. Maybe the app was written 15 years ago and you're the first person to run it in a decade. There's no way for us to know. These kinds of apps aren't something that you run every day. You install them years ago. Maybe you noticed something. Maybe you didn't. Maybe it was three computers back and it got migrated. But then something else on the system changed. Maybe something changed in Tahoe. Maybe you logged in as the root user and blessed the hack with super-user privileges, enabling it to finally have enough access to run for the first time in 15 years. Again, there's no way to speculate on what might or might not have happened. All we know is that this isn't normally a problem for most people.

These kinds of hacks are extremely popular. For you to say that you've never applied one makes you literally one in a million. The fact that you've enabled the root user is a strong indication that you've already done that. Even if you only did it to fix this problem, it's a strong indicator that it wasn't your first go around. I get it. Lots of people do this. If they didn't this whole forum wouldn't exist. These kinds of hacks are what keeps the forum lights on. But sometimes, it's hard to diagnose and fix.

I’ve already mentioned that I don’t have a device to back it up with and I also don’t have nearly enough iCloud storage for a backup (what makes you think I have iCloud+??)

Cloud storage isn't a backup. It's just a convenient hack for this particular problem. It's a way to reset your computer and recover most of your settings with relatively little effort. And yeah, it might cost some money. You can always disable it once you've resolved the problem.

Zedairder wrote:

Woah there chill out

I can't! I'm freaking out here!!!! I'm freaking out!!!!!!!

<sigh>

It’s under Library/Caches/com.apple.iconservices.store. You can’t find it WITHOUT root user

There's the root user and then there's the root user. If you want to go poking around in the Terminal, then you should use "sudo" to temporary become the root user, only in the Terminal environment. But if you try to enable the actual root user and login as that user, you can scramble your system for good. That's bad news. The operating system wasn't designed for that.

I found out about it by enabling the root user because I couldn’t find what was taking up so much storage on my normal admin account. It’s completely fine to delete, just as Phil said in the link I posted. It rebuilds itself without even requiring a restart.

I never said it wasn't find to delete. That isn't the problem. I thought it was the rebuilding that was the problem. Why is yours taking 100s of GB and mine takes 3 GB? That's the problem. I don't need to delete mine.

Zedairder wrote:

You literally just restated my problem here. I have enough intelligence to know that it’s not normal for the cache to be taking 100s of GB. Your response didn’t help me solve the problem.

That's because you got off on a tangent arguing about the root user. If you've gone to the trouble to enable the root user, then I'm absolutely confident that this, or some similar internet-induced hack is what caused this problem. How am I supposed to know what you did? Did you make a list of all the system hacks that you've applied? If not, then you'll probably need to erase the hard drive and reinstall the operating system.

When you restore from backup, you'll need to be careful. You should be able to restore your user accounts and user files. Just don't restore any apps, software, system settings, or "other files". You'll need to manually reinstall any 3rd party software you want to use. Be particularly careful with anything that claims to do anything with system hacking or icons.

Unfortunately, there is a possibility that even with those precautions, your restore will also restore the problem. But it's worth trying in hopes that you get lucky.

If you don't get lucky, then try iCloud. Turn on all iCloud settings. Wait for everything to sync. Then erase your hard drive, reinstall the operating system, create a new account and login to your existing iCloud account. You should get back most everything. Hopefully you don't have any mail stored "On my Mac".

Zedairder wrote:

Use your words 🫩✌️

Appropriate language would run counter to this site's Terms of Use.

Erase the Mac. Yes it is that bad.

etresoft wrote:

In order to recover this computer, you'll definitely need to erase the hard drive and reinstall the operating system. I recommend that you don't try to restore anything. Just setup a new account.

👍

That is the only practicable solution.

Erase the Mac.

Rule 1 of Macs is don't install junk.

Erase the Mac.

Never, ever enable the root user. It could cause all kinds of funky problems, like undeletable cache data that grows forever.

What is the exact path to this particular data? So that we can check the size on our systems?

If your data is growing out of control, you'll need to find out why. Deleting the data isn't the correct approach as it would just come back. You have to find and correct the root cause.

Zedairder wrote:

Did you just steal my question

I have no idea what you're talking about.

[Edited by Moderator]

Perhaps you made your point more clear in this part. I'll chalk that up to Standard Internet Behaviour and let you resolve the problem on your own.

etresoft wrote:

[Edited by Moderator]

Perhaps you made your point more clear in this part. I'll chalk that up to Standard Internet Behaviour and let you resolve the problem on your own.

Nope. The Hosts just made the giant picture a more sensible size.