Re: what is flooding /var/tmp?
On Wed, 24 Nov 2021 22:59:06 -0500
Greg Wooledge <greg@wooledge.org> wrote:
> On Thu, Nov 25, 2021 at 04:23:23AM +0100, sp007@caiway.net wrote:
> > Hello,
> >
> > My /var/tmp directory gets flooded by big files named:
> >
> > sort01ei1t
> > sort01Eq7u
> > sort01sLAs
> > ...
> > sortzZZtvv
> >
> >
> > the files are approx. 13 Gb each.
> > In 24 hours > 6000 are written.
>
> > How can I find out which program is writing these files?
>
> They're almost certainly temporary files created by sort(1).
>
> "strings /usr/bin/sort | grep sortX" pretty much confirms this. The
> program contains the string /sortXXXXXX which is a template that
> could be used by mktemp(3) or a similar routine for temp file name
> generation, and it matches the length of your filenames.
>
> So, you're looking for a shell script or a shell command that uses
> sort, and has a VERY large input.
>
> Since the files appear on a regular basis, you're probably looking for
> something triggered by cron, or a systemd timer.
>
> If you can figure out when the files start appearing, you can narrow
> down the start time of the job. If it's the same start time every
> day, that could help you identify which job it is, in case there are
> lots. Then again, most systems don't have a huge number of cron jobs,
> so it shouldn't be hard to look at all of them.
>
> If it's a different time every day, then you might be looking for
> systemd timers. They're weird and I don't really understand them
> yet, so if you have to tackle one of them, good luck.
>
Thanks for your imput
[erhaps ot will find a clue
Reply to: