APFS decreases space randomly
In my experience, there are two major culprits for this unexplained disk usage:
- Time machine
- Swap
One possibility is time machine. If you open Disk Utility, you may see a section labelled "Other Volumes", these are likely to be time machine backups. If you do see this, then you can open a command shell and enter:
df -h
On my machine, I get output similar to:
Filesystem Size Used Avail Capacity iused ifree %iused Mounted on
/dev/disk1s1 465Gi 442Gi 18Gi 97% 5512606 9223372036849263201 0% /
devfs 196Ki 196Ki 0Bi 100% 678 0 100% /dev
/dev/disk1s4 465Gi 5.0Gi 18Gi 23% 5 9223372036854775802 0% /private/var/vm
map -hosts 0Bi 0Bi 0Bi 100% 0 0 100% /net
map auto_home 0Bi 0Bi 0Bi 100% 0 0 100% /home
map -fstab 0Bi 0Bi 0Bi 100% 0 0 100% /Network/Servers
com.apple.TimeMachine.2017-10-19-174031@/dev/disk1s1 465Gi 428Gi 18Gi 97% 5078237 9223372036849697570 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Smakolyk/2017-10-19-174031/Smakolyk
com.apple.TimeMachine.2017-10-19-072101@/dev/disk1s1 465Gi 423Gi 18Gi 97% 3858374 9223372036850917433 0% /Volumes/com.apple.TimeMachine.localsnapshots/Backups.backupdb/Smakolyk/2017-10-19-072101/Smakolyk
Here you can see that I have local two time machine backups, and these will be using space. Apple have more information about local time machine backups.
You can disable local snapshots with:
sudo tmutil disablelocal
This should turn off the feature and free up the space. You can turn it back on with
sudo tmutil enablelocal
The second option is swap, this you can most easily see in /var/vm:
$ ls -lh /var/vm
total 10485760
-rw------T 1 root wheel 1.0G 9 Oct 08:30 sleepimage
-rw------- 1 root wheel 1.0G 18 Oct 14:00 swapfile0
-rw------- 1 root wheel 1.0G 18 Oct 15:09 swapfile1
-rw------- 1 root wheel 1.0G 19 Oct 21:25 swapfile2
-rw------- 1 root wheel 1.0G 19 Oct 09:11 swapfile4
As you can see, I have 4GB in swap on my machine, and this is also taking up space on the disk.