Wednesday, November 19, 2014

linux - Random empty files called "file*" are created on /tmp



I have two RHEL 6.10 servers where /tmp is constantly being filled up with thousands of files with the following names




-rw-rw-r--. 1 root    root        0 Feb 22 17:30 fileoQ1gE0
-rw-rw-r--. 1 root root 0 Feb 22 17:31 fileTFa0e7
-rw-rw-r--. 1 root root 0 Feb 22 17:32 fileSxEdEa
-rw-rw-r--. 1 root root 0 Feb 22 17:33 filegoLf6g
-rw-rw-r--. 1 root root 0 Feb 22 17:34 filebj3CJv
-rw-rw-r--. 1 root root 0 Feb 22 17:35 fileEVJerA
-rw-rw-r--. 1 root root 0 Feb 22 17:36 file5X9G3G
-rw-rw-r--. 1 root root 0 Feb 22 17:37 fileScyBJY
-rw-rw-r--. 1 root root 0 Feb 22 17:38 filePCq3K0
-rw-rw-r--. 1 root root 0 Feb 22 17:39 filePnBcVp

-rw-rw-r--. 1 root root 0 Feb 22 17:40 fileTbupIR
-rw-rw-r--. 1 root root 0 Feb 22 17:41 file4jmFGS
-rw-rw-r--. 1 root root 0 Feb 22 17:42 fileBP8HL0
-rw-rw-r--. 1 root root 0 Feb 22 17:43 fileb605If
-rw-rw-r--. 1 root root 0 Feb 22 17:44 file8Rubgm
-rw-rw-r--. 1 root root 0 Feb 22 17:45 file7UJEJr
-rw-rw-r--. 1 root root 0 Feb 22 17:46 filethKoZv
-rw-rw-r--. 1 root root 0 Feb 22 17:47 fileJEVJpL
-rw-rw-r--. 1 root root 0 Feb 22 17:48 filebeLOuP
-rw-rw-r--. 1 root root 0 Feb 22 17:49 fileN1VVJU

-rw-rw-r--. 1 root root 0 Feb 22 17:50 fileHO9fll
-rw-rw-r--. 1 root root 0 Feb 22 17:51 filejEj1Rq
-rw-rw-r--. 1 root root 0 Feb 22 17:52 fileMPnCWJ


Root's crontab doesn't have anything so, is there any way to know what process is creating files here? Even though they're 0 bytes it is bothering me since I just don't know why they're created.


Answer



Enable auditd and write some rules watching write-type permissions to this directory.



-w /tmp -p w -k tmp



How to monitor permission, ownership or any other change to a particular directory or file



RHEL 6 Security Guide > Chapter 7. System Auditing


No comments:

Post a Comment

linux - How to SSH to ec2 instance in VPC private subnet via NAT server

I have created a VPC in aws with a public subnet and a private subnet. The private subnet does not have direct access to external network. S...