Sometime this winter, I noticed sysdiagnose would randomly max out my CPU and generate WiFiDiagnostics logs in /private/var/tmp/. This happened the most on my work computer, resulting in over 70GB of log files before I discovered them and cleaned them out. Both my work and home computers are connected to ethernet, so with no logical reason for this to happen, I resigned myself to living in log hell and worked on ways to automatically remove them.
Last month, I finally got frustrated enough to search for a proper solution. After toying around with search terms, I ran across a StackOverflow post with my answer:
It looks like cmd+ctrl+option+shift+w triggers a WiFi Diagnostics session.
Ah ha! So a keyboard shortcut introduced in macOS Catalina was the culprit.
I use an application called Karabiner Elements to remap my Caps Lock key to a hyperkey (Control+Option+Command+Shift), and I use the hyperkey to quickly swap between applications. Hyperkey+W was set to my email client, which I open several times a day during work. Every time I opened my email, I was unwittingly generating hundreds of megabytes of WiFi Diagnostic logs. I’m slightly disappointed I didn’t notice the pattern.1
I spent some time searching for a way to disable the diagnostics shortcut, but I never found one. I eventually gave in and changed my email shortcut to something else.2