Stock F14 only deletes /tmp
files once a day and only if they are more than 10days old via /etc/cron.daily/tmpwatch
.
You could use the auditing subsystem. Suppose the files are in the dir /tmp/help
. In /etc/audit/audit.rules
add
-a exit,always -F path=/tmp/help
Then restart auditd with /etc/rc.d/init.d/auditd restart
. Here is what is logged in /var/log/audit/audit.log
when I execute rm /tmp/help/heregoes
:
type=SYSCALL msg=audit(1299113860.183:47): arch=c000003e syscall=263 success=yes exit=0 a0=ffffffffffffff9c a1=133a0c0 a2=0 a3=1 items=2 ppid=21286 pid=21328 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts361 ses=1 comm="rm" exe="/bin/rm" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=CWD msg=audit(1299113860.183:47): cwd="/root"
type=PATH msg=audit(1299113860.183:47): item=0 name="/tmp/help/" inode=398818 dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0
type=PATH msg=audit(1299113860.183:47): item=1 name="/tmp/help/heregoes" inode=398819 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0
The first (rather long) line shows the executable, pid, and ppid, which may help.