who cleared /tmp?

[Neal Becker]

I realize that in general, keeping files in /tmp is rather dangerous. 
However, it seems that readhat/linux has generally left such files alone.

It seems a number of valuable files I placed in /tmp got removed.  I'm
wondering what caused this?  I don't see anything obvious in /etc/crond.d,
nor is /etc/sysinit (system had been rebooted a couple of times).  Any
hint?

[Paul Howarth]

Neal Becker wrote:
> I realize that in general, keeping files in /tmp is rather dangerous. 
> However, it seems that readhat/linux has generally left such files alone.
>
> It seems a number of valuable files I placed in /tmp got removed.  I'm
> wondering what caused this?  I don't see anything obvious in /etc/crond.d,
> nor is /etc/sysinit (system had been rebooted a couple of times).  Any
> hint?

See:

man tmpwatch
/etc/cron.daily/tmpwatch

Paul.

[Andy Green]

Neal Becker wrote:
> I realize that in general, keeping files in /tmp is rather dangerous. 
> However, it seems that readhat/linux has generally left such files alone.
>
> It seems a number of valuable files I placed in /tmp got removed.  I'm
> wondering what caused this?  I don't see anything obvious in /etc/crond.d,
> nor is /etc/sysinit (system had been rebooted a couple of times).  Any
> hint?

Hm some things re nuked in /etc/rc.sysinit initscript

rm -f /var/lib/rpm/__db* &> /dev/null

(guess that answers if that is the rpm database :-) )

Doing a filesystem relabel for selinux might do it too.

If you had bad luck, did your files match these?  Because these are
nuked also in rc.sysinit

rm -f /tmp/.X*-lock /tmp/.lock.* /tmp/.gdm_socket /tmp/.s.PGSQL.*
rm -rf /tmp/.X*-unix /tmp/.ICE-unix /tmp/.font-unix /tmp/hsperfdata_* \
       /tmp/kde-* /tmp/ksocket-* /tmp/mc-* /tmp/mcop-* /tmp/orbit-*  \
       /tmp/scrollkeeper-*  /tmp/ssh-*

-Andy

[SternData]

Neal Becker wrote:
> I realize that in general, keeping files in /tmp is rather dangerous. 
> However, it seems that readhat/linux has generally left such files alone.
>
> It seems a number of valuable files I placed in /tmp got removed.  I'm
> wondering what caused this?  I don't see anything obvious in /etc/crond.d,
> nor is /etc/sysinit (system had been rebooted a couple of times).  Any
> hint?

/etc/cron.daily/tmpwatch

By default, it looks at the *last access time*. If you hadn't accessed 
the files recently, there were deleted by this script.