3

I have two RHEL 6.10 servers where /tmp is constantly being filled up with thousands of files with the following names

-rw-rw-r--. 1 root    root        0 Feb 22 17:30 fileoQ1gE0
-rw-rw-r--. 1 root    root        0 Feb 22 17:31 fileTFa0e7
-rw-rw-r--. 1 root    root        0 Feb 22 17:32 fileSxEdEa
-rw-rw-r--. 1 root    root        0 Feb 22 17:33 filegoLf6g
-rw-rw-r--. 1 root    root        0 Feb 22 17:34 filebj3CJv
-rw-rw-r--. 1 root    root        0 Feb 22 17:35 fileEVJerA
-rw-rw-r--. 1 root    root        0 Feb 22 17:36 file5X9G3G
-rw-rw-r--. 1 root    root        0 Feb 22 17:37 fileScyBJY
-rw-rw-r--. 1 root    root        0 Feb 22 17:38 filePCq3K0
-rw-rw-r--. 1 root    root        0 Feb 22 17:39 filePnBcVp
-rw-rw-r--. 1 root    root        0 Feb 22 17:40 fileTbupIR
-rw-rw-r--. 1 root    root        0 Feb 22 17:41 file4jmFGS
-rw-rw-r--. 1 root    root        0 Feb 22 17:42 fileBP8HL0
-rw-rw-r--. 1 root    root        0 Feb 22 17:43 fileb605If
-rw-rw-r--. 1 root    root        0 Feb 22 17:44 file8Rubgm
-rw-rw-r--. 1 root    root        0 Feb 22 17:45 file7UJEJr
-rw-rw-r--. 1 root    root        0 Feb 22 17:46 filethKoZv
-rw-rw-r--. 1 root    root        0 Feb 22 17:47 fileJEVJpL
-rw-rw-r--. 1 root    root        0 Feb 22 17:48 filebeLOuP
-rw-rw-r--. 1 root    root        0 Feb 22 17:49 fileN1VVJU
-rw-rw-r--. 1 root    root        0 Feb 22 17:50 fileHO9fll
-rw-rw-r--. 1 root    root        0 Feb 22 17:51 filejEj1Rq
-rw-rw-r--. 1 root    root        0 Feb 22 17:52 fileMPnCWJ

Root's crontab doesn't have anything so, is there any way to know what process is creating files here? Even though they're 0 bytes it is bothering me since I just don't know why they're created.

  • Looks like one is created each minute. Knowing the times with a bit more accuracy could provide some indication of whether it is likely to be a cron job. You can see the full timestamp with ls --full-time /tmp. I'd also take a look in /var/log/cron to know if any cron job is being run every minute. – kasperd Feb 23 at 16:30
6

Enable auditd and write some rules watching write-type permissions to this directory.

-w /tmp -p w -k tmp

How to monitor permission, ownership or any other change to a particular directory or file

RHEL 6 Security Guide > Chapter 7. System Auditing

  • This helped me to pinpoint the issue and ausearch returns the following, yet I'm unable to understand why that process is creating files: id=0 fsgid=0 tty=(none) ses=87305 comm="osspi_fwtmp" exe="/var/opt/OV/bin/instrumentation/osspi_fwtmp" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="tmp" _ type=PATH msg=audit(1551283056.129:18464144): item=1 name="/tmp/fileHjArsp" inode=2735 dev=fd:04 mode=0100664 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0 nametype=CREATE – Rodrigo Feb 27 at 16:00
  • The briefest of searches suggests this is OpenView. Why it doesn't clean up after itself is a question for this products support channels, and digging through its source code where available. Common uses of mkstemp style temporary files are to spool output going somewhere else, or to check that the temp dir is writable. – John Mahowald Mar 7 at 15:08
0

Maybe a quick lsof|grep /tmp/file spits out a PID the files belong to?

  • 4
    I suppose it doesn't hurt to try this. But you may need to be very lucky to catch it while the file is still open. – kasperd Feb 23 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.