Re: what is flooding /var/tmp?

From	Tim Woodall <debianuser@woodall.me.uk>
Newsgroups	linux.debian.user
Subject	Re: what is flooding /var/tmp?
Date	2021-11-25 23:10 +0100
Message-ID	<Dnv6i-2Lt-9@gated-at.bofh.it> (permalink)
References	<DndM5-Gs-1@gated-at.bofh.it> <DnuMV-2pB-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Thu, 25 Nov 2021, Marc Auslander wrote:

> On 11/24/2021 10:40 PM, sp007@caiway.net wrote:
>> Hello,
>> 
>> My /var/tmp directory gets flooded by big files named:
>> 
>> sort01ei1t
>> sort01Eq7u
>> sort01sLAs
>> ...
>> sortzZZtvv
>> 
>> 
>> the files are approx. 13 Gb each.
>> In 24 hours > 6000 are written.
>> 
>> My big partition is filled by it until the system freezes.
>> 
>> The files are plain text files, containing sshfs paths:
>> 
>> /mnt/nas/sshfs/proc/self/task/413551/root/proc/self/task/413551/root/proc/self/task/413551/root/proc/self/task/413551/root/proc/
>> .........
>> 
>> nas and desktop are running debian 11 daily updated.
>> 
>> How can I find out which program is writing these files?
>> 
>> Thanks!
>> 
> You might look at file creation time and look in /var/log/syslog to see what 
> CRON job is running when they are created.
>
But >6000 in 24hrs suggests one every 10s which doesn't sound like cron.
Sounds more like something stuck in a loop and aborting/retrying.

To the OP, have you checked ps for any jobs that have been running for
unexpectedly long?

Is a reboot a possibility (or already tried)?

The content of the files looks odd too, something is following links on
a remote /proc. Is the file one huge line or many lines (of max path
length whatever that is, I'm not sure - 4k?)

Do you even need to export/mount the proc filesystem like this - is
there some way you can stop that happening?

I don't use it but locate, or some tool like that, might be trying to
build an index of /proc - which I'd assume would be avoided on a local
/proc but might need some config magic for a remote one.

If nothing else, is it possible to bind mount an empty directory over
/mnt/nas/sshfs/proc and see if that helps?

>

Back to linux.debian.user | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

what is flooding /var/tmp? "sp007@caiway.net" <sp007@caiway.net> - 2021-11-25 04:40 +0100
  Re: what is flooding /var/tmp? Greg Wooledge <greg@wooledge.org> - 2021-11-25 05:00 +0100
    Re: what is flooding /var/tmp? "sp007@caiway.net" <sp007@caiway.net> - 2021-11-25 10:00 +0100
      Re: what is flooding /var/tmp? "sp007@caiway.net" <sp007@caiway.net> - 2021-11-26 01:40 +0100
  Re: what is flooding /var/tmp? Cindy Sue Causey <butterflybytes@gmail.com> - 2021-11-25 05:10 +0100
  Re: what is flooding /var/tmp? "sp007@caiway.net" <sp007@caiway.net> - 2021-11-25 20:40 +0100
  Re: what is flooding /var/tmp? Marc Auslander <marcausl@gmail.com> - 2021-11-25 22:50 +0100
    Re: what is flooding /var/tmp? Tim Woodall <debianuser@woodall.me.uk> - 2021-11-25 23:10 +0100

csiph-web