Swapfile and sleepimage file creation?
Probably one (or more) process on your system was running wild.

Use your Mac as usual. From time to time check the folder /var/vm and if you run across a lot of swap files open Terminal.app and enter:

ps xa | awk '{print $1}' | xargs -n 1 sudo vmmap | grep -A3 'Summary' &gt; /Users/YourUserName/Desktop/vmmap_summary.txt


Depending on the number of running processes this will take about 30-60 seconds. Your account has to be able to run sudo (=usually an admin account).

This creates a text file called vmmap_summary.txt on your desktop which contains some memory and swap information of all running processes sorted by PID. Some will fail because their process id is already gone.

Example (truncated to the first four PIDs):

==== Summary for process 1
ReadOnly portion of Libraries: Total=51.8M resident=12.9M(25%) swapped_out_or_unallocated=38.9M(75%)
Writable regions: Total=92.9M written=808K(1%) resident=2112K(2%) swapped_out=0K(0%) unallocated=90.8M(98%)

==== Summary for process 21  
ReadOnly portion of Libraries: Total=77.0M resident=30.9M(40%) swapped_out_or_unallocated=46.1M(60%)  
Writable regions: Total=88.5M written=1116K(1%) resident=5144K(6%) swapped_out=0K(0%) unallocated=83.4M(94%)

==== Summary for process 22
ReadOnly portion of Libraries: Total=150.1M resident=60.1M(40%) swapped_out_or_unallocated=90.0M(60%)
Writable regions: Total=93.2M written=1460K(2%) resident=5440K(6%) swapped_out=0K(0%) unallocated=87.8M(94%)

==== Summary for process 23
ReadOnly portion of Libraries: Total=77.2M resident=31.3M(41%) swapped_out_or_unallocated=45.9M(59%)
Writable regions: Total=96.9M written=1412K(1%) resident=2036K(2%) swapped_out=0K(0%) unallocated=94.9M(98%)


Check for any bad behaving process (swapped_out>>>0k).

To get the process name of a misbehaving PID and some more information enter:

ps aux | awk '$2 == PID  { print $0 }'


Example output for a process with the ID 21 — ps aux | awk '$2 == 21  { print $0 }' — would be:  

root              21   0,0  0,0  2507740   6552   ??  Ss   10:03am   0:01.48 /usr/libexec/kextd


Now hunt down what may be wrong with the app or daemon.