Automatic vs Full measurement

Automatic vs Full measurement

The app has two ways to measure. The header of System Data, Largest Folders, History and Recommendations has an Automatic | Manual switch (⌘← and ⌘→). Manual shows the latest Full Measurement.

Side by side

	Automatic	Full Measurement (Manual)
When it runs	Continuously, while the app is open	Once, when you ask (⌘R)
Command	sdtally --auto	sdtally --json
Password	None	Administrator password, or none with Passwordless Root
How it stays current	One full pass, then re-reads only the folders FSEvents reports as changed	A snapshot in time
Unit kept in memory	Total per folder, never file by file	Every file
Largest files list	No (largest_files is null)	Yes: files of 100 MB or more, up to 30
Protected folders	Not opened without root	Opened, as root
Large extended attributes	Not measured (the report is incomplete for that term)	Measured
Other sources (volumes, snapshots, purgeable, open-but-deleted files, Trash, Settings log)	Read before the pass and again every 10 minutes	Read during the measurement
"Growing now"	Yes: what grew in the last 5 minutes and the last hour	No
History	One sample per hour of the largest folders, kept 90 days	Each measurement saved as a file in Medicoes/
Can be stopped	Yes	With Passwordless Root, yes (Stop, ⌘.). With the password, no

Automatic

sdtally --auto does one full pass over the Data volume (the same folder reading as the full measurement, without xattrs), then listens to FSEvents and re-reads only the folders that changed. If macOS reports that events were lost, it redoes the full pass.

It writes one compact JSON line per change: right after the pass, then on every change of 10 MB or more in allocated size, at most once a minute for smaller changes, and on every re-read of the other sources. The app reads these lines and keeps the last one in ~/Library/Application Support/SDTally/auto.json, so the next launch opens with numbers while the new pass runs.

Measured on one Apple Silicon Mac with about 460,000 folders: the first pass took about 40 seconds; afterwards memory stayed around 150 to 190 MB and a change was seen in about a second. Folders that are slow to re-read (caches with tens of thousands of files) get a time budget, so their numbers can lag.

Automatic with root

Settings > Advanced lets you choose Without Root or With Root for Automatic. With Root needs Passwordless Root.

With Root, Automatic reads the whole disk as root all the time, without a password. It opens system folders and other users' folders, lists open-but-deleted files of all processes, and its totals match the Full Measurement. The Automatic | Manual switch disappears because Automatic already measures everything.

The app explains the risks before you turn it on:

• A root process keeps running while the app is open. SDTally only reads sizes, never contents, and deletes nothing, but a mistake in a root process has a wider reach.
• Anyone using this login session sees the sizes of other users' folders.
• Each pass uses more CPU and battery.

Its own recommendations: use it only on your own Mac with an account that is only yours, prefer Automatic without root on battery, and use the Full Measurement for occasional checks.

Full Measurement

sdtally --json walks the Data volume file by file and takes a few minutes. It measures everything listed in Understanding System Data, including large xattrs and the largest files. With root and Full Disk Access it opens nearly every folder, so the unexplained remainder is smallest.

Start it from Measurement > Measure with Administrator Password… (⌘R), or Measure as Administrator when Passwordless Root is active. With Passwordless Root installed you can still choose Measure with Password, Without Passwordless Root….

Each result is saved to ~/Library/Application Support/SDTally/Medicoes/ as the raw JSON that sdtally printed. That folder keeps up to 100 measurements or 50 MB, always keeping the newest. These files are what sdtally --last, sdtally --history and the MCP server read.

The quick reading

Separate from both modes, the app runs sdtally --quick --json periodically with no scan and no password. It reads only what changes all the time: the Settings screen, used and free space, purgeable space, containers and swap, passing --parts to read only what is due and --since so only new log lines are read. One point per hour is saved to pontos.jsonl for the History chart (kept 400 days).

The app also keeps sdtally --quick --json --watch running, which follows the Storage pane's log and reports each new Settings screen as soon as macOS writes it.

Because the System Data number only exists while the Storage pane has been opened recently, the app can open System Settings out of sight to refresh it. Settings > Automatic Refresh controls each interval:

Setting	Default
Free Space, Usage, and Swap	1 s
What macOS Frees on Its Own, with the App Open	10 s
What macOS Frees on Its Own, in the Background	60 s
Open System Settings Hidden, with the App Open	10 min
Open System Settings Hidden, in the Background	Off (opening the pane costs CPU and memory)

Which one should I use?

• Day to day: Automatic without root. No password, live, cheap.
• To get the most complete answer, or to see the largest files: a Full Measurement with root and Full Disk Access.
• To share a result: run a Full Measurement and use File > Export JSON or Export PDF with "Replace Personal Names" on.