Re: what is flooding /var/tmp?
On Thu, Nov 25, 2021 at 04:23:23AM +0100, sp007@caiway.net wrote:
> Hello,
>
> My /var/tmp directory gets flooded by big files named:
>
> sort01ei1t
> sort01Eq7u
> sort01sLAs
> ...
> sortzZZtvv
>
>
> the files are approx. 13 Gb each.
> In 24 hours > 6000 are written.
> How can I find out which program is writing these files?
They're almost certainly temporary files created by sort(1).
"strings /usr/bin/sort | grep sortX" pretty much confirms this. The
program contains the string /sortXXXXXX which is a template that
could be used by mktemp(3) or a similar routine for temp file name
generation, and it matches the length of your filenames.
So, you're looking for a shell script or a shell command that uses sort,
and has a VERY large input.
Since the files appear on a regular basis, you're probably looking for
something triggered by cron, or a systemd timer.
If you can figure out when the files start appearing, you can narrow
down the start time of the job. If it's the same start time every day,
that could help you identify which job it is, in case there are lots.
Then again, most systems don't have a huge number of cron jobs, so it
shouldn't be hard to look at all of them.
If it's a different time every day, then you might be looking for systemd
timers. They're weird and I don't really understand them yet, so if you
have to tackle one of them, good luck.
Reply to: