On Wed, 24 Nov 2021 22:59:06 -0500 Greg Wooledge <g...@wooledge.org> wrote:
> On Thu, Nov 25, 2021 at 04:23:23AM +0100, sp...@caiway.net wrote: > > Hello, > > > > My /var/tmp directory gets flooded by big files named: > > > > sort01ei1t > > sort01Eq7u > > sort01sLAs > > ... > > sortzZZtvv > > > > > > the files are approx. 13 Gb each. > > In 24 hours > 6000 are written. > > > How can I find out which program is writing these files? > > They're almost certainly temporary files created by sort(1). > > "strings /usr/bin/sort | grep sortX" pretty much confirms this. The > program contains the string /sortXXXXXX which is a template that > could be used by mktemp(3) or a similar routine for temp file name > generation, and it matches the length of your filenames. > > So, you're looking for a shell script or a shell command that uses > sort, and has a VERY large input. > > Since the files appear on a regular basis, you're probably looking for > something triggered by cron, or a systemd timer. > > If you can figure out when the files start appearing, you can narrow > down the start time of the job. If it's the same start time every > day, that could help you identify which job it is, in case there are > lots. Then again, most systems don't have a huge number of cron jobs, > so it shouldn't be hard to look at all of them. > > If it's a different time every day, then you might be looking for > systemd timers. They're weird and I don't really understand them > yet, so if you have to tackle one of them, good luck. > Thanks for your imput [erhaps ot will find a clue
