Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #242384

Re: what is flooding /var/tmp?

Show all headers | View raw

On Thu, Nov 25, 2021 at 04:23:23AM +0100, sp007@caiway.net wrote:
> Hello,
> 
> My /var/tmp directory gets flooded by big files named:
> 
> sort01ei1t
> sort01Eq7u
> sort01sLAs
> ...
> sortzZZtvv
> 
> 
> the files are approx. 13 Gb each.
> In 24 hours > 6000 are written.

> How can I find out which program is writing these files?

They're almost certainly temporary files created by sort(1).

"strings /usr/bin/sort | grep sortX" pretty much confirms this.  The
program contains the string /sortXXXXXX which is a template that
could be used by mktemp(3) or a similar routine for temp file name
generation, and it matches the length of your filenames.

So, you're looking for a shell script or a shell command that uses sort,
and has a VERY large input.

Since the files appear on a regular basis, you're probably looking for
something triggered by cron, or a systemd timer.

If you can figure out when the files start appearing, you can narrow
down the start time of the job.  If it's the same start time every day,
that could help you identify which job it is, in case there are lots.
Then again, most systems don't have a huge number of cron jobs, so it
shouldn't be hard to look at all of them.

If it's a different time every day, then you might be looking for systemd
timers.  They're weird and I don't really understand them yet, so if you
have to tackle one of them, good luck.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

what is flooding /var/tmp? "sp007@caiway.net" <sp007@caiway.net> - 2021-11-25 04:40 +0100
  Re: what is flooding /var/tmp? Greg Wooledge <greg@wooledge.org> - 2021-11-25 05:00 +0100
    Re: what is flooding /var/tmp? "sp007@caiway.net" <sp007@caiway.net> - 2021-11-25 10:00 +0100
      Re: what is flooding /var/tmp? "sp007@caiway.net" <sp007@caiway.net> - 2021-11-26 01:40 +0100
  Re: what is flooding /var/tmp? Cindy Sue Causey <butterflybytes@gmail.com> - 2021-11-25 05:10 +0100
  Re: what is flooding /var/tmp? "sp007@caiway.net" <sp007@caiway.net> - 2021-11-25 20:40 +0100
  Re: what is flooding /var/tmp? Marc Auslander <marcausl@gmail.com> - 2021-11-25 22:50 +0100
    Re: what is flooding /var/tmp? Tim Woodall <debianuser@woodall.me.uk> - 2021-11-25 23:10 +0100

csiph-web