AAAaNNNNN files in /tmp

[Sean OB_1]

I'm seeing many files starting with AAAa in /tmp on my hpux systems.

root@openview:/tmp-> ls AA*
AAAa02524 AAAa13793 AAAa20824 AAAa22342 AAAa22912 AAAa23466 AAAb19985 AAAb26976
AAAa04562 AAAa19640 AAAa21326 AAAa22365 AAAa23006 AAAa23529 AAAb21075 AAAc17391
AAAa06346 AAAa19879 AAAa21484 AAAa22418 AAAa23221 AAAa23864 AAAb21832 AAAc21775
AAAa07928 AAAa19981 AAAa21939 AAAa22528 AAAa23406 AAAb12355 AAAb23933
AAAa09584 AAAa20086 AAAa22178 AAAa22845 AAAa23443 AAAb19577 AAAb24068

Most of the files are empty, but the ones that aren't are showing:

root@openview:/tmp-> cat AA*
LOGIN dtremote 148.8.79.3:0 06/23/04 14:17:56
LOGIN pts/0 dhcp-70-23.matc. 06/29/04 07:10:49
LOGIN dtremote 148.8.79.3:0 06/23/04 15:42:49
LOGIN pts/4 dhcp-13-199.matc 06/22/04 09:56:26


Does anyone have any idea where these would be coming from?

TIA and points for all responses.

Sean

[David Child_1]

Sean,

You might be able to try running a little script regularly that runs an 'fuser' and then parses the PID/PPID and then 'ps' on those to see if you can track down the culprit.

David

[Steven E. Protter]

I think I've seen other posts where this happens on NFS or CIFS servers. Temporary files of some sort.

Are you running either of those software products?

From the looks of the data, looks like login files for CDE or terminal sessions. They should go away when the login is terminated.

SEP

[Naveej.K.A]

Hi Sean,

Owner/group of these files??
How long a file is existing???

What are the critical application running on this server? like mail (+antivirus), webserver or anything specific....

That should give a much better picture

with best wishes
Naveej

[Bill Hassell]

These are temp files, very likely created with Xwindow logins and while they are usually removed when properly logging out, most likely users are crashing their connections and leaving these files behind. You can remove them in a cron job (a lot easier than trying to get users to logout properly). I'd remove anything older than a week. Even if the session is still running, removing the file will not be a problem. The physical data will remain intact after the file is removed until the process terminates.

[Sean OB_1]

Sorry folks, been away from this client for a while. I'll get some more info the next time I'm on site and post more.

The files exist indefinitely and accumulate rapidly. On the more heavily used servers it's not unusual for several hundred a day to be created.

The servers run the gamute from basic web servers, to oracle servers to app servers. All seem to get it.

I can add that they seem to have started *around* the time that I deployed the OVO OSSPI to the unix machines. I can't say that it happened exactly then, but at around the same time these began to appear.

Bill, it's unlikely that these are x-windows related as there are no x-windows apps on any of the servers other than Openview, and I'm pretty much the only one that fires that up. However it seems like they correspond to login's to the box of any sort (telnet, ssh, xwindows).

[Naveej.K.A]

hi Sean,

Your comments on the owner/group of these files, please

Naveej

[wip]

Hi Guy,

I have seen these kind of files generated for NDM software jobs.Probably you may check wiuth your NDM folks whether they have changed their working driectory to /tmp

may be my 2 cents

regards
wip

[Cheryl Griffin]

You could also configure clean_tmps to have the files removed when the system reboots.

# cat /etc/rc.config.d/clean_tmps
#!/sbin/sh
# @(#)B.11.11_LR
# List and/or clear temporary files
#
# LIST_TEMPS: Set to 1 to produce a listing of temporary files at startup.
#
# CLEAR_TMP: Set to 1 to remove all files from /tmp at startup.
#
LIST_TEMPS=1
CLEAR_TMP=1

[Sean OB_1]

Najeev,

I'll get that to you the next time I'm at the client.

Sean

[Sean OB_1]

ll AAA*
-rw-r--r-- 1 root sys 60 Jul 12 12:48 AAAa21694
-rw-r--r-- 1 root sys 56 Jul 12 12:50 AAAa22075
-rw-r--r-- 1 root sys 53 Jul 4 15:28 AAAa29562
-rw-r--r-- 1 root sys 51 Jun 30 13:10 AAAa29586
-rw-r--r-- 1 root sys 53 Jun 28 00:36 AAAa29645
-rw-r--r-- 1 root sys 53 Jul 4 15:29 AAAa29715
-rw-r--r-- 1 root sys 55 Jul 11 03:07 AAAb23564

[Sean OB_1]

Anyone else see this after installing the HPUX OSSPI in OVO?

[Tim Sanko]

We see this on our CIFS server. If you aren't running LDAP or CIFS I haven't seen it. (If I haven't got my bifocals I won't see anything anyway...

Tim

[Sean OB_1]

Turns out this is caused by the OSSPI and I'm working on a resolution.