Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #242389

Re: what is flooding /var/tmp?

Show all headers | View raw

On Wed, 24 Nov 2021 22:59:06 -0500
Greg Wooledge <greg@wooledge.org> wrote:

> On Thu, Nov 25, 2021 at 04:23:23AM +0100, sp007@caiway.net wrote:
> > Hello,
> > 
> > My /var/tmp directory gets flooded by big files named:
> > 
> > sort01ei1t
> > sort01Eq7u
> > sort01sLAs
> > ...
> > sortzZZtvv
> > 
> > 
> > the files are approx. 13 Gb each.
> > In 24 hours > 6000 are written.
> 
> > How can I find out which program is writing these files?
> 
> They're almost certainly temporary files created by sort(1).
> 
> "strings /usr/bin/sort | grep sortX" pretty much confirms this.  The
> program contains the string /sortXXXXXX which is a template that
> could be used by mktemp(3) or a similar routine for temp file name
> generation, and it matches the length of your filenames.
> 
> So, you're looking for a shell script or a shell command that uses
> sort, and has a VERY large input.
> 
> Since the files appear on a regular basis, you're probably looking for
> something triggered by cron, or a systemd timer.
> 
> If you can figure out when the files start appearing, you can narrow
> down the start time of the job.  If it's the same start time every
> day, that could help you identify which job it is, in case there are
> lots. Then again, most systems don't have a huge number of cron jobs,
> so it shouldn't be hard to look at all of them.
> 
> If it's a different time every day, then you might be looking for
> systemd timers.  They're weird and I don't really understand them
> yet, so if you have to tackle one of them, good luck.
> 

Thanks for your imput
[erhaps ot will find a clue

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

what is flooding /var/tmp? "sp007@caiway.net" <sp007@caiway.net> - 2021-11-25 04:40 +0100
  Re: what is flooding /var/tmp? Greg Wooledge <greg@wooledge.org> - 2021-11-25 05:00 +0100
    Re: what is flooding /var/tmp? "sp007@caiway.net" <sp007@caiway.net> - 2021-11-25 10:00 +0100
      Re: what is flooding /var/tmp? "sp007@caiway.net" <sp007@caiway.net> - 2021-11-26 01:40 +0100
  Re: what is flooding /var/tmp? Cindy Sue Causey <butterflybytes@gmail.com> - 2021-11-25 05:10 +0100
  Re: what is flooding /var/tmp? "sp007@caiway.net" <sp007@caiway.net> - 2021-11-25 20:40 +0100
  Re: what is flooding /var/tmp? Marc Auslander <marcausl@gmail.com> - 2021-11-25 22:50 +0100
    Re: what is flooding /var/tmp? Tim Woodall <debianuser@woodall.me.uk> - 2021-11-25 23:10 +0100

csiph-web