/private/var/db/uuidtext/dsc directory huge size
Sure - the fsusage tool can show all filesystem operations live and you can sort on that path to determine what is doing the writing and back into the details.

sudo fs_usage -w | grep uuidtext


As you mention, the system can self fix by restart and updates. I’d guess OnyX didn’t help, but we’ll need to wait to get it to recur to know for sure.

Also, that directory is where the unified logs are stored, so you could also just inspect your normal logs in console app - if you have a high volume of logs, then your growth is normal and you’d uninstall / fix / suppress whatever is generating all the volume in the logging system.

log stream --info --debug


Also, most people are stunned and shocked to see how many thousands of info and debug messages get logged each and every second on a perfectly healthy mac, so don’t worry if you feel the volume is high without comparing to other computers. Maybe getting stats would be a better indicator:

me@dev ~&gt; log stats --overview
== archive =============================================================
size:               461,012,272 bytes
                    1,141,374,160 bytes (uncompressed)
start:              Fri Jul 19 06:37:25 2019
end:                Sun Aug 18 17:56:08 2019
statedump:          725

events:             [       total        log      trace   signpost       loss ]
                    [  26,036,074 18,105,986         26    234,083          5 ]

activity:           [      create transition     action ]
                    [   7,694,844          0         10 ]

log messages:       [     default       info      debug      error      fault ]
                    [  17,799,660    219,169    105,002    215,663        601 ]

ttl:                [        1day      3days      7days     14days     30days ]
                    [           0     11,021     10,620     94,679     68,285 ]

processes:          
          [        events (%total),  decomp. bytes (%total),                           image UUID, image ]
          [     4,728,900 ( 18.2%),    137,984,377 ( 12.1%), 6848C8B5-B410-3D5E-B1F5-6A289006E83F, Activity Monitor ]
          [       800,052 (  3.1%),    100,277,357 (  8.8%), 9C895392-8753-316E-80F0-802610ED6A2C, AssetCache ]
          [     6,498,211 ( 25.0%),     90,979,241 (  8.0%), 26E8D205-980A-3139-B41A-BA2D40EE6294, diskarbitrationd ]
          [        12,103 (  0.0%),     82,909,480 (  7.3%), DF2BBC3F-1663-395D-BEA3-85172E5D5654, sandboxd ]
          [         9,827 (  0.0%),     79,484,156 (  7.0%), 03F25350-02B7-34AD-AF61-5001FCD85D39, sandboxd ]

senders:            
          [        events (%total),  decomp. bytes (%total),                           image UUID, image ]
          [     6,498,207 ( 25.0%),     90,979,122 (  8.0%), 26E8D205-980A-3139-B41A-BA2D40EE6294, diskarbitrationd ]
          [       682,424 (  2.6%),     86,726,296 (  7.6%), 74A0A926-957A-3803-9837-CF24592E46D3, libboringssl.dylib ]
          [       145,587 (  0.6%),     82,984,590 (  7.3%), 6993BD8C-C535-3AD7-B511-94EABF989658, GPUWrangler ]
          [        12,027 (  0.0%),     82,908,562 (  7.3%), DF2BBC3F-1663-395D-BEA3-85172E5D5654, sandboxd ]
          [         9,567 (  0.0%),     79,480,144 (  7.0%), 03F25350-02B7-34AD-AF61-5001FCD85D39, sandboxd ]


So 26 million events logged on a computer over a month and it was powered off for 2 weeks this month and lightly used the other couple weeks. On a busy computer I’d see this volume every week and not worry.