Understanding and managing Time Machine snapshots

Finding out how much free space there is on an APFS disk is notoriously difficult. Depending on where you look, its size comes and goes, and it’s not uncommon to see it apparently change by tens or even the odd hundred GB in the space of a few minutes, without the user doing anything. One important factor is the presence of snapshots: although they officially occupy “available storage”, their size does affect some of the figures you will see for free space.

Few users make snapshots themselves. The most common creator is Time Machine, which has made them routinely on all APFS volumes which it backs up since the file system’s introduction in High Sierra. At that time, Time Machine used snapshots to work out what files it needed to back up, using a procedure known as a snapshot diff, which works out what has changed between two snapshots made an hour apart. Although the current version of Time Machine in Monterey can still use that technique, it normally chooses to use an older method in which it examines a database of changes made in the file system, known as FSEvents.

Simple backup

The simplest way that Time Machine (TMA) now works in Monterey is when it backs up to a single APFS backup store every hour without interruption, which is shown in the following diagram.

tmbackupapfsbigsur

The first snapshot phase in TMA involves connecting to the mountpoint and machine store in the backup storage, deleting expired snapshots from the volumes being backed up, making a fresh snapshot which it terms the stable snapshot on each volume being backed up, and mounting that and the previous or reference snapshot.

Next, in the event collection phase, TMA has to work out what on each volume needs to be backed up. It normally does this in TMA by collecting events from FSEvents, as at present it doesn’t back up the System volume, or any of the hidden volumes in the boot set. The event cache is then saved as the .eventdb file.

In the sizing phase, using the event cache, TMA estimates the disk space required to perform the backup. If there’s insufficient space available in the backup store, that should generate an error informing the user of the problem.

If there is sufficient free space, TMA then proceeds to the copying phase, when it copies items from the source to the .inprogress folder on the backup store which provides the data for the backup. In larger backups, this is the most time-consuming step, and is normally accompanied by periodic progress reports in the log.

Once copying is complete, the backup is matched against that expected by comparing the stable and reference snapshots. If there’s any discrepancy here, this should be recorded in the log. Snapshots are then unmounted and rotated ready for the next backup, and the more recent of the two is saved to the backup volume, where it’s used to form the snapshot which is the backup proper.

The final backup maintenance phase peforms housekeeping on backups in the backup storage, deleting them on the basis of age or, where necessary, to free up space for future backups. Once that is done, the backup is declared completed.

At the end of each backup, there’s a fresh snapshot of each volume which has been backed up stored on that volume, and a backup stored on the backup store. As I’ve explained, although those backups appear to be synthesised from a form of copied snapshot, they aren’t the same as regular snapshots.

Complex backups

This becomes more complex when your Mac isn’t normally connected to the backup store. When TMA runs each hour, it still makes the snapshot(s), but can’t make the backups. Normally, those snapshots are automatically deleted once they’re more than 24 hours old, but if TMA still hasn’t been able to make a backup to the backup store, the oldest of those (made at the time of the last backup) is retained.

As that’s already over 24 hours old, it will grow steadily larger, as it retains deleted and changed file data from the more distant past. After a few days, that oldest snapshot may have grown to tens of GB in size, and it will normally only be removed once your Mac completes its next backup to your Mac’s backup store.

Multiple backup stores add a further layer of complexity and potential for growth in snapshot size. TMA keeps a record of the last backup to each backup store it’s configured to use. As an example, someone with a MacBook Pro backs up to storage in the office, and when at home. If their Mac performs an office backup on the first of the month, but they don’t return to the office for the rest of that month, TMA will retain the snapshot made for that backup until it makes its next backup to the office storage a month later. By that time, the snapshot could have exceeded 100 GB in size.

Housekeeping

Because snapshots are considered expendable, TMA should automatically delete them if that volume starts to get low on free space. You can also delete them yourself using Disk Utility or any other app which gives you access to snapshots. Another way to delete all TMA snapshots is to turn automatic backups off and leave your Mac for a few minutes, during which it should delete all the TMA snapshots which it made in the past (although TMA won’t delete snapshots made by another utility like Carbon Copy Cloner). Turning automatic backups back on again will then enable TMA to continue to back up normally.

Summary

To summarise Time Machine’s behaviours with snapshots:

  • TMA automatically makes a snapshot of every volume that it backs up, every hour, and deletes those snapshots once they’re over 24 hours old.
  • While you can limit what TMA actually backs up, snapshots retain everything on each volume, including items which are in TMA’s list of exceptions.
  • Where you have large files which change a great deal but don’t need to be backed up as frequently, don’t simply exclude them from TMA backups, but put them on a separate volume which isn’t backed up at all, so doesn’t have snapshots taken.
  • If your Mac only connects intermittently to its backup store, snapshots will continue to grow over time until it can next complete a backup. That will make it appear, in some metrics, as if free space is falling.
  • If your Mac connects to two or more backup stores, it will try to retain snapshots for the last backup made to each store. Those can become exceedingly large if it’s many days or weeks before it can back up to one (or more) of those stores.
  • TMA should automatically delete snapshots whenever completely free space becomes low. However, you may prefer to control this yourself by deleting snapshots when preparing to upgrade or update macOS or install exceptionally large apps such as Xcode.
  • If a macOS update or upgrade, or Xcode install, fails because of insufficient free space, don’t hesitate to delete TMA snapshots.
  • When specifying Macs intended to be used with intermittent access to backup stores, or to back up to multiple stores, allow ample free space on their internal SSD to accommodate snapshots.
  • Snapshots aren’t backups, but can get you by temporarily when your Mac can’t be backed up. Any disk failure, including some relatively small errors, can make snapshots unusable.

I’m very grateful to Michele and NSSynapse for help in compiling this information.