What is creating /var/tmp/sort* files?

Question

Sometimes on my Linux Debian server I found a bunch of sort* files (sort0ylf0b, sort8KXDHC, sortCoMKVq) of more than 30MB each. Who create those files in /var/tmp?

I try to google but nothing.

Any ideas? Thanks.

Answer 1

I'm not sure what would cause that. If the files are still open, you can see what process has them open by using the 'lsof' (which stands for "list open files") utility:

lsof /var/tmp/sort*

If any of those files are currently open, you'll see some output that looks something like this (except that I ran lsof on /tmp/*):

COMMAND   PID    USER   FD   TYPE             DEVICE SIZE/OFF    NODE NAME
xmms2d  28523 jonhall    3u  unix 0xffff880025052100      0t0 2272384 /tmp/xmms-ipc-jonhall
xmms2d  28523 jonhall   11u  unix 0xffff880194d7de00      0t0 2272401 /tmp/xmms-ipc-jonhall

The only piece of information you really care about in the output is the PID. Try this:

ps 28523  # Replace the number with the PID from your own output, obviously

And you should see the culprit:

  PID TTY      STAT   TIME COMMAND
28523 ?        SLl   11:30 /usr/bin/xmms2d --status-fd=4

In my case, xmms2d is what has the files open.

This all depends on lsof giving you some useful output, though. If it doesn't, try running the same lsof command several times. If these temp files are 30mb in size, it will take a little bit of time (perhaps a couple seconds?) to write them, so if you can "catch it in the act", lsof should tell you what you need to know. Of course, this all depends on how frequently these files are being written as well.

Good luck!

Answer 2

These files were likely created due to a periodic run of updatedb (for the locate command). I actually discovered the same issue in cygwin, where /var/tmp was over 5GB of old files dating back several years ago. (in my system, updatedb is a script that calls mktemp which uses whatever $TMPDIR is currently set to; updatedb sets this to /var/tmp)

The /var/tmp dir traditionally isn't deleted upon reboot, while /tmp would be; likewise, /var/tmp is usually a larger partition backed by disk, whereas /tmp might just be memory (causing updatedb to fail or run out of space (memory) if it were used.) These assumptions may not hold true for your system; in the case of "fixing" updatedb, you may be able (depending on the platform) update /etc/updatedb.conf to write to /tmp instead of /var/tmp. (Or run a cron job that periodically cleans old /var/tmp/sort* files.)

For reference, see this debian bug (closed as "not a bug", since it's a configuration change).

Answer 3

Who is the owner of those files? Sometimes that can give you a hint.

In general those files are generated if sort has to comb through a massive file. It uses those files as temporary files during sorting some massive data.