I notice a lot of empty files in /tmp with names similar to "/tmp/tmp.tMIHx17730". I run audit rule and I found out that mktemp is creating it which is not too helpful.
How do I find out which script calls mktemp to create these files? Can I capture parent process id/command line with auditd?
Update: I believe I have the parent process id (ppid=17729), but the script quickly quits and I can't find the script. Can I setup auditd to get parent process command line as well?
Update 2: Here is how I setup auditd to show whatwrites to tmp:
auditctl -w /tmp -k tmpfiles
ausearch -k tmpfiles|grep "tmp."
Then I pick a file and I do
ausearch -k tmpfiles -f /tmp/tmp.tMIHx17730
This shows me process which created the file and parent process pid. I need to set up some kind of process starting listener to catch what's the most recent process with that pid