On Thu, Nov 25, 2021 at 04:23:23AM +0100, sp...@caiway.net wrote: > Hello, > > My /var/tmp directory gets flooded by big files named: > > sort01ei1t > sort01Eq7u > sort01sLAs > ... > sortzZZtvv > > > the files are approx. 13 Gb each. > In 24 hours > 6000 are written.
> How can I find out which program is writing these files? They're almost certainly temporary files created by sort(1). "strings /usr/bin/sort | grep sortX" pretty much confirms this. The program contains the string /sortXXXXXX which is a template that could be used by mktemp(3) or a similar routine for temp file name generation, and it matches the length of your filenames. So, you're looking for a shell script or a shell command that uses sort, and has a VERY large input. Since the files appear on a regular basis, you're probably looking for something triggered by cron, or a systemd timer. If you can figure out when the files start appearing, you can narrow down the start time of the job. If it's the same start time every day, that could help you identify which job it is, in case there are lots. Then again, most systems don't have a huge number of cron jobs, so it shouldn't be hard to look at all of them. If it's a different time every day, then you might be looking for systemd timers. They're weird and I don't really understand them yet, so if you have to tackle one of them, good luck.