What is removing files from /tmp?

[David Quigley]

On 05/03/2012 02:35, deanm at sharplabs.com wrote:
> On Thu, 03 May 2012 at 15:40:40, Tim wrote:
>> While I can't answer to why old files might be disappearing, other 
>> than
>> to check more than just *daily* CRON entries (hourly, weekly, 
>> specific
>> hours of the day), I'll suggest one thing:  If you want to keep /tmp
>> contents through a reboot, make sure that /tmp isn't mounted as 
>> tmpfs.
>
> Thanks.  Checked those.  weekly is empty.  hourly contains the 
> anacron
> trigger file and  "mcelog.cron" which contains only comments.
>
> Not sure what you mean by specific hours of the day.  I don't know 
> how
> to tell when a file is removed from /tmp/, if that's what you mean.
>
> /tmp is not mounted at all on my system.  It is a merely an ordinary
> subdir of /.
>
> Thanks for the suggestions.
> Keep 'em coming.
>
> Dean


If you don't mind waiting you could put an audit watch on that 
directory and look for things unlinking files in the directory. Once you 
notice a file missing you can look through the audit logs for the 
syscall that did it and identify the offending process.

Dave