topic Re: /var/tmp files in Operating System - HP-UX

/var/tmp files

Andy McDade — Wed, 27 Oct 2004 08:37:10 GMT

We have over 800 files in /var/tmp on our box all called "puffin.xxxx" i.e. puffin.2949.
The hostname of this 11i PA-RISC box is "Puffin".
Another appears evry fe minutes, and all the files are exactly 2097152 in size and I can't get rid of them:
rm: puffin.2949 not removed. Device busy
If I try to null them I get this error:
sh[2]: puffin.2949: Cannot create the specified file.

fuser and lsof don't seem to shed any light on the matter, although I'm not too sure on the syntax I should be using for lsof.

Any help appreciated.

Re: /var/tmp files

Cheryl Griffin — Wed, 27 Oct 2004 08:50:03 GMT

What is the output from:
# what /var/tmp/puffin.2949
# file /var/tmp/puffin.2949

Re: /var/tmp files

Andy McDade — Wed, 27 Oct 2004 09:03:14 GMT

# what /var/tmp/puffin.2949
/var/tmp/puffin.2949:

# file /var/tmp/puffin.2949
/var/tmp/puffin.2949: commands text

Re: /var/tmp files

BOUZALMAD Youssef — Wed, 27 Oct 2004 09:09:37 GMT

Have you tried fuser -u puffin.xxxx ?

What type of file is it ?! Socket, Pipe, File ?!

You may find which process works on them...

Re: /var/tmp files

Cheryl Griffin — Wed, 27 Oct 2004 09:09:59 GMT

# cat /var/tmp/puffin.2949 |more
or
# strings /var/tmp/puffin.2949 |more

Re: /var/tmp files

BOUZALMAD Youssef — Wed, 27 Oct 2004 09:11:53 GMT

Maybe fuser -cu /var/tmp can hrlp you if /var/tmp is a mount point.

Re: /var/tmp files

Andy McDade — Wed, 27 Oct 2004 09:20:50 GMT

/var/tmp is not a mointpoint.
the files are just full of nothing (cat -v shows completely "^@")
fuser shows nothing, lsof shows nothing, the files types are shown in my previous post.

Re: /var/tmp files

Prashant Zanwar_4 — Wed, 27 Oct 2004 09:37:08 GMT

you can check for

ps -aef | grep -i puffin

and also

ps -aef | grep -i 2949

grep -i puffin /etc/init.d/*

just try to trace the processes from where the service is starting, and check with application guys if they know something about it..

Hope it helps
Thanks
Prashant

Re: /var/tmp files

Robert-Jan Goossens — Wed, 27 Oct 2004 09:42:01 GMT

Could these be created by a cron command ?

Could you check the timestamps on the files and compare them with your cron entryâ s.

Best regards,
Robert-

Re: /var/tmp files

BOUZALMAD Youssef — Wed, 27 Oct 2004 09:49:17 GMT

You should rather use strings than cat.

fuser puffin.xxx 2>/dev/null should give you at least one process number.

Anyway, fuser /var/tmp should works even if it is not a moutnt point !

Re: /var/tmp files

Andy McDade — Wed, 27 Oct 2004 09:53:41 GMT

honestly, "fuser puffin.xxxx" gives no output.

Re: /var/tmp files

Cheryl Griffin — Wed, 27 Oct 2004 09:56:13 GMT

What is the output of:
# swapinfo -tam

Re: /var/tmp files

Andy McDade — Wed, 27 Oct 2004 09:59:20 GMT

swapinfo -tam
Mb Mb Mb PCT START/ Mb
TYPE AVAIL USED FREE USED LIMIT RESERVE PRI NAME
dev 4096 0 4096 0% 0 - 1 /dev/vg00/lvol2
localfs 1790 0 1790 0% none 0 1 /var/tmp
reserve - 5725 -5725
total 5886 5725 161 97% - 0 -

Ahhh! Is swap using /var/tmp in some way? Can I switch it off?

Re: /var/tmp files

Cheryl Griffin — Wed, 27 Oct 2004 10:01:03 GMT

Take it out of /etc/fstab and you'll have to reboot.

Re: /var/tmp files

Cheryl Griffin — Wed, 27 Oct 2004 10:02:12 GMT

And you need to blame someone ;^) or smack somebody around for doing this.

Re: /var/tmp files

Andy McDade — Wed, 27 Oct 2004 10:08:38 GMT

Hmm. I looked the /etc/fstab and there is no entry for swap, this is fstab:

/dev/vg00/lvol3 / vxfs delaylog 0 1
/dev/vg00/lvol1 /stand hfs defaults 0 1
/dev/vg00/lvol4 /home vxfs delaylog 0 2
/dev/vg00/lvol5 /opt vxfs delaylog 0 2
/dev/vg00/lvol7 /tmp vxfs delaylog 0 2
/dev/vg00/lvol8 /usr vxfs delaylog 0 2
/dev/vg00/lvol9 /var vxfs delaylog 0 2
/dev/vg00/lvol6 /opt/perf vxfs delaylog 0 2
/dev/vg00/lvol10 /var/adm/crash vxfs delaylog 0 2
/dev/vg00/lvol11 /var/adm/sw vxfs delaylog 0 2
/dev/vg00/lvol12 /var/opt/dce vxfs delaylog 0 2
/dev/vg00/lvol13 /opt/emc vxfs delaylog 0 2
/dev/vg01/lvol1 /var/opt/encina/local vxfs delaylog 0 2
/dev/vg01/lvol5 /appcode vxfs delaylog 0 2
/dev/vg01/lvol2 /var/mqm vxfs delaylog 0 2
/dev/vg01/lvol3 /opt/mqm vxfs delaylog 0 2
/dev/vg01/lvol6 /users vxfs delaylog 0 2
/dev/vg01/lvol7 /var/mqm/log vxfs delaylog 0 2
/dev/vg01/lvol8 /var/spool/lp vxfs delaylog 0 2
/dev/vg01/lvol12 /admin vxfs delaylog 0 2
/dev/vg01/inf1 /informix731FD7X2 vxfs log 0 2
#/dev/vg00/swap ... swap defaults 0 0
#/dev/vg01/swap ... swap defaults 0 0

Re: /var/tmp files

BOUZALMAD Youssef — Wed, 27 Oct 2004 10:13:58 GMT

Maybe you can try via SAM

@Cheryl : Congratulations !

Re: /var/tmp files

Cheryl Griffin — Wed, 27 Oct 2004 10:15:45 GMT

When were the swap entries commented out?
When was the last time your system was rebooted?

Re: /var/tmp files

Cheryl Griffin — Wed, 27 Oct 2004 12:25:22 GMT

Any update on this?

It's possible the entries were commented out and the system was not rebooted, therefore it's still in use.

Look at the date of the /etc/fstab, although this date could be changed at anytime and compare it to:
# uptime

Re: /var/tmp files

Mark Greene_1 — Wed, 27 Oct 2004 13:06:07 GMT

Have you tried fuser /var/tmp i.e. fuser on just the directory? Given what swapinfo reports, you may just get the pid for swapper but worth a check.

mark