Crashplan eating up TimeMachine backups

I recently upgraded to El Capitan and while checking the system logs I noticed lots of errors about not being able to delete old backups (thin backups), such as:

2016-01-10 05:22:48,193 com.apple.backupd[5904]: Starting post-backup thinning
2016-01-10 05:22:49,319 com.apple.backupd[5904]: Error: Error Domain=NSOSStatusErrorDomain Code=-36 "ioErr: I/O error (bummers)" deleting backup: /Volumes/Time Machine Backups/Backups.backupdb/fünke/2016-01-01-213437
...

and


2016-01-10 05:22:45,791 com.apple.mtmd[208]: Failed to remove /.MobileBackups.trash, error: Error Domain=NSCocoaErrorDomain Code=513 "“.MobileBackups.trash” couldn’t be removed because you don’t have permission to access it." UserInfo={NSFilePath=/.MobileBackups.trash, NSUserStringVariant=(
Remove
), NSUnderlyingError=0x7f9f02c3baf0 {Error Domain=NSPOSIXErrorDomain Code=1 "Operation not permitted"}}
2016-01-10 05:22:45,792 com.apple.mtmd[208]: Failed to delete /.MobileBackups.trash, error: Error Domain=NSCocoaErrorDomain Code=513 "“.MobileBackups.trash” couldn’t be removed because you don’t have permission to access it." UserInfo={NSFilePath=/.MobileBackups.trash, NSUserStringVariant=(
Remove
), NSUnderlyingError=0x7f9f02c3baf0 {Error Domain=NSPOSIXErrorDomain Code=1 "Operation not permitted"}}

These seemed a bit disconcerting: TimeMachine was having issues thinning old backups on my TimeCapsule, and worse yet, TimeMachine couldn’t thin the MobileBackups on my MacBook Pro, meaning my already size-challenged SSD was being filled up by backups that would never be deleted. After lots and lots of googling, I finally found this post which has fixed the problem!

It seems when you install CrashPlan, it sets file system attributes that do not allow itself to get deleted. So with a bit of command-line wizardry, we can fix this problem. We need to remove the attributes from all instances of CrashPlan.app in all backed-up locations.

Fix the MobileBackups:

  1. sudo su root to change to the root user (be careful!)
  2. find /.MobileBackups -type d -iname crashplan.app to look for all backed-up instances of CrashPlan.app
  3. For each found instance, do this: /System/Library/Extensions/TMSafetyNet.kext/Contents/Helpers/bypass chflags noschg,nouchg path/to/CrashPlan.app replace path/to/CrashPlan.app to the path found in #2
  4. exit to exit from the root account

Do the same for MobileBackups.trash:

  1. sudo su root to change to the root user (be careful!)
  2. find /.MobileBackups.trash -type d -iname crashplan.app to look for all backed-up instances of CrashPlan.app
  3. For each found instance, do this: /System/Library/Extensions/TMSafetyNet.kext/Contents/Helpers/bypass chflags noschg,nouchg path/to/CrashPlan.app replace path/to/CrashPlan.app to the path found in #2
  4. exit to exit from the root account

Now, mount the TimeMachine backup disk and sparsebundle, and fix the attributes on all the backups there:

  1. sudo su root to change to the root user (be careful!)
  2. cd /Volumes/Time\ Machine\ Backups/Backups.backupdb/{machine name}/
  3. Since I had so many backups, I wrote a quick one-liner script: for dir in `ls`; do /System/Library/Extensions/TMSafetyNet.kext/Contents/Helpers/bypass chflags noschg,nouchg "${dir}/Macintosh HD/Applications/CrashPlan.app"; done
  4. exit to exit from the root account

And finally, add /Applications/CrashPlan.app to the excluded list for TimeMachine backups so that it is not backed up again.

Done!

After I did the above, I triggered a new TimeMachine backup, checked the logs, no more errors! And I checked my hard drive: I had now gained 18GB of space! TimeMachine was finally able to delete/trim the old unused Mobile Backups! 🙂

Update 2016-02-03: changed the find script to case-insensitive -iname crashplan.app.

6 comments
  1. Thanks, that small shell script was the perfect thing to clean up the TimeMachine backup volume. I picked up a 100GB once all the thinning was done.

    1. glad it helped! 🙂

  2. I’m having this problem, and I worked through the steps above. When I tried fixing MobileBackups and MobileBackups.trash, the find command didn’t return anything, so nothing changed as a result. I still receive the failed to remove and failed to delete messages. However, the fix for Backups.backupdb seems to be working, because each time Time Machine runs, it thins 5 of the old backups that it previously complained about. Eventually, it should at least catch up on that part of the problem.

    Any suggestion for investigating the MobileBackups and MobileBackups.trash issue?

    1. Hmm… interesting. It could be that there are other files/folders with the schg and/or uchg attributes set on them in /.MobileBackups or /.MobileBackups.trash. You could try doing a search for them, like
      sudo find /.MobileBackups -flags uchg
      or
      sudo find /.MobileBackups -flags schg
      and then subsequently set the nouchg or noschg flags on any files/folders found by those commands.

      1. Very strange, I found this entry:
        /.MobileBackups.trash/Computer/2015-11-05-092357/Volume/Applications/CrashPlan.app
        … by searching with sudo find /.MobileBackups.trash -flags schg. I changed the flags and now, at least for a manual Time Machine backup, I don’t see the error anymore. I wonder why the original finds didn’t see that instance?

        1. I notice I’m inconsistent in my description above, I write -name Crashplan.app but it is actually CrashPlan.app (capital P), so using the case-insensitive find with name -iname crashplan.app might be more inclusive (just in case).

Leave a Reply

Your email address will not be published. Required fields are marked *