What is removing files from /tmp?

[John Horne]

On Wed, 2012-05-02 at 19:47 -0700, Dean S. Messing wrote:
> I'm running F15.  Files are mysteriously being removed from /tmp after a
> number of days of not being touched.  I am familiar with
> /etc/cron.daily/tmpwatch and, in fact, modify it to inhibit removal of
> files from /tmp.  In the past this has worked. Under F15 it has not.
> 
> Two or three weeks ago I deleted it from /etc/cron.daily but older files
> _still_ get removed from /tmp. I've rebooted at least once.  I'm not
> sure if it happens at bootup or while the system is running, but
> something is still removing files from /tmp.
> 
> Does anyone know of another mechanism for this?
> 
Take a look in /var/spool/cron to see if some user crontab (like root)
is running tmpwatch or deleting the files. Also perhaps a check
of /etc/rc.local to see if something is causing this.

> I'm not sure if it happens at bootup or while the system is running
>
I would say add a file to /tmp, leave it a while, check it is still
present then reboot. After bootup see if it is still there.

If the problem isn't rebooting, then perhaps setup a cron job to monitor
the files' existence (say check every few minutes) and email you when it
has gone. It may give you more of an idea of when things are being
deleted. You can also check /var/log/cron to see if some cron job is
running causing the deletion at the time.




John.

-- 
John Horne, Plymouth University, UK
Tel: +44 (0)1752 587287    Fax: +44 (0)1752 587001