FedoraForum.org - Fedora Support Forums and Community
Results 1 to 8 of 8
  1. #1
    Join Date
    Nov 2008
    Posts
    342

    unknown tmp file appears and disappears

    In my ramdisk directory, I noticed a tmp file - I don't know where it came from. I did an "ls -l" - got the full mtime - the size was 4 bytes. Wondering where it came from, I did a bash "history" (which I have time-stamped), in the 3 open terminal tabs - nothing matched the mtime. I looked in the journal - no messages around that time. I went back to list the access time on the tmp file, and it was gone - I did nothing to remove it.

    I guess what is going here is some system process is a little sloppy in where it is putting tmp files.

    Anyone know what happened here?

  2. #2
    Join Date
    Oct 2011
    Posts
    1,629

    Re: unknown tmp file appears and disappears

    Next time it happens try to use `lsof` to see what process is using it.

  3. #3
    Join Date
    Nov 2008
    Posts
    342

    Re: unknown tmp file appears and disappears

    Thanks - "lsof" is what I should have done, and will do if it happens again.

  4. #4
    Join Date
    Nov 2008
    Posts
    342

    Re: unknown tmp file appears and disappears

    I tried to stick an audit on my ramfs, with no luck. Then I changed the ramfs to a tmpfs, and still no luck.
    By no luck, I mean when I touch a file in that directory and then do an ausearch on my key, I don't get any results.

    Anyone know the trick I'm missing to audit a ramfs / tmpfs?

    However, when the audit is on the ramfs or tmpfs, I get lots of audit messages in the journal, which contain "SECCOMP" and firefox. By "lots" I mean thousands pile up in a couple of minutes. Firefox has no business looking at that directory as far as I know.

  5. #5
    Join Date
    Nov 2008
    Posts
    342

    Re: unknown tmp file appears and disappears

    My bad. The reason the tmp file "mysteriously" disappeared, is because I exited from a cli process in another terminal tab, which deleted the file when it exited. The reason the timestamps didn't match up was because the process overwrote that file many times - so the mtime changed many times.

    Marking this thread SOLVED, even though that still leaves the questions about ramfs and tmpfs and audit, and why setting that audit causes the firefox messages in the journal - perhaps fodder for one or two bug reports.

  6. #6
    Join Date
    Nov 2008
    Posts
    342

    Re: unknown tmp file appears and disappears

    Re the problems with tmpfs audits and firefox:
    My bad again: in my audit rules I used "path=" instead of "dir=". When that correction is made, auditing tmpfs works fine, and there are no strange firefox audit messages.

    Why specifying "path=" in an audit rule on a tmpfs should cause a flood of audit messages re firefox, I leave to the specialists to ponder, if they are so inclined.

  7. #7
    Join Date
    Feb 2005
    Location
    London, UK
    Posts
    561

    Re: unknown tmp file appears and disappears

    Quote Originally Posted by dswaner
    The reason the timestamps didn't match up was because the process overwrote that file many times - so the mtime changed many times.
    For future reference, assuming the inode info isn't changing then ctime (rather than mtime) might show you the creation date. You might be able to see the files real "birth time" using stat depending on your configuration as well.

  8. #8
    Join Date
    Nov 2008
    Posts
    342

    Re: unknown tmp file appears and disappears

    Yes, ctime would be the most useful in this situation. For my setup, stat doesn't work. What does work is:
    Code:
    sudo debugfs -R "stat ...file..." /dev/...
    though it's a little inconvenient. (Ref. https://forums.fedoraforum.org/archi.../t-303162.html)

    CORRECTION:
    I should have said "crtime" (create time, aka birth time) not "ctime" (change attribute time) above. Even though ctime may be the same as the birth time, with the debugfs trick, I can find the real crtime.
    Last edited by dswaner; 25th September 2017 at 06:11 PM. Reason: Correction

Similar Threads

  1. unknown file signature
    By billcu in forum EOL (End Of Life) Versions
    Replies: 0
    Last Post: 27th September 2014, 02:51 AM
  2. Replies: 1
    Last Post: 7th November 2007, 05:30 PM
  3. FC5 Nautilus file permissions unknown
    By grimsbyguy in forum Using Fedora
    Replies: 0
    Last Post: 24th March 2006, 03:51 PM
  4. HOWTO Unknown file type
    By ducl in forum Using Fedora
    Replies: 6
    Last Post: 14th September 2004, 05:37 AM

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •