sysdiagnose archives: the diagnostic bundles that stay in /var/tmp after support is done

When Apple Support, a developer or a Feedback Assistant report asks for a sysdiagnose, macOS collects logs, system state and diagnostics into a compressed archive. Each archive is often hundreds of megabytes. They are written to /private/var/tmp, a hidden folder, and they stay there after the report is sent.

Find them

ls -lh /private/var/tmp/ | grep -i sysdiagnose
sudo du -sh /private/var/tmp

Each is named with the date it was taken, such as sysdiagnose_2026.09.12_10-31-22...tar.gz. If you have reported several problems, or a keyboard shortcut triggered them by accident, there can be many.

Is it safe to delete them?

Yes, once you have sent what was asked for. They are copies of diagnostic information, and nothing on the Mac reads them back. Keep the most recent one if a support case is still open.

open /private/var/tmp     # then move old sysdiagnose files to the Trash

Why they appear unasked

A sysdiagnose can be started with a keyboard combination (Shift, Control, Option, Command and the full stop key, pressed together). The screen flashes and an archive appears a few minutes later. Pressing it by accident is more common than you would think.

Other diagnostic files

Crash reports and app logs live elsewhere and are usually much smaller. See app logs, system logs and the private/var folders.