files in /var/tmp

[Malcolm McKenzie]

I have a number of files in /var/tmp prefixed rdsk, e.g. rdskZXUa14745.

Does anyone know what causes these?

[T G Manikandan]

Hello,

Is a temporary directory for users as like /tmp.

Here are my crontab lines to remove anything over a week old in /tmp and
/var/tmp:

30 20 * * * /usr/bin/touch /tmp; /usr/bin/find /tmp -mtime +7 -exec rm -rf
{} \;
31 20 * * * /usr/bin/touch /var/tmp; /usr/bin/find /var/tmp -mtime +7 -exec
rm -rf {} \;

It is important to /usr/bin/touch the directory so only the stuff under it
gets deleted. You can add -type f to limit the seach to files only.

like find /var/tmp -type f -mtime +7 -exec rm {} \;

[Malcolm McKenzie]

Thanks for the response but I wish to know why and by what these files are created.

[Eugen Cocalea]

Hi,

have you tried to edit them to see what they contain? what does 'file /var/tmp/rdsk' give?

I believe they are temporary files made by a fsck that was ended before it should (so it didn't arrive to erasing them).

E.

[Malcolm McKenzie]

They are character special files and are empty if vi'd.

[Deepak Extross]

Maybe an 'ls -l' on these files will give you a clue to the owner and creation time of these files.
Typically, if a process exits unexpectedly (crashes), it leaves behind the temp files here. Any old files in this directory may be safely deleted.

[Piotr Zajaczkowski]

Hello Malcolm.

/var/tmp directory is default system destination for temp files.
You can do
# echo $TMPDIR
if not set, then system will use defaults which is /var/tmp, /usr/tmp etc.

You can change it by setting up and exporting TMPDIR parameter in your enviroment or leave it as it is.

Those files you've mentioned, it think that could go from SAM or any other application which could scan your HW or has raw access to disks. It depends.
You can remove them (cron is the best option), but please do remember about HP recomendation (do backup first, just in case).

Please look at the date of last modification, if longer than 2 month no need to worry - remove them.

There is no simple way of telling who used that file. You have to do file on each file and have look indide.

Good Luck,

Piotr

[Eugen Cocalea]

Hi,

Can you do a 'ls -la /dev/rdsk' and a 'ls -la /var/tmp|grep rdsk' and post the answer here, please?

E.

[T G Manikandan]

Hello,
/*
The /tmp directory is private. Since many sites will delete
files from /tmp at boot time, files that must be preserved
should not be placed in the /tmp directory. Application working
files should go in /var/tmp or /var/opt/. Files
generated by the OS that must be preserved across reboots should
go into the /var/tmp directory */

you can use 'fuser' or 'lsof' utilities before
justifying the removal.


Thanks

[Eugen Cocalea]

Hi again,

Well, I think that the files were made by SAM or another tool that you used for scanning the hardware for new devices. From the dates of the files, it seems that you added on the same day (Aug 5) at least a disk to the system. You either canceled the scanning operation at some point or SAM forgot to erase those files. It's the best I can presume, but maybe someone else know exactly what those files are.

I believe you can safely remove them (well, I know, everybody else says that) because I don't think that somebody or something uses them. Anyway, do a 'lsof' on one or each of them to see if they are in use, if not, go ahead removing.

E.

[Piotr Zajaczkowski]

Hello Malcolm,

I would recommend:

1. cd /var/tmp;fuser -u ./*
2. check active processes if exists (doubtfull)
if yes skip the rest steps and post output of fuser -u ./* from /var/tmp
3. fbackup -f /dev/rmt.... -i /var/tmp
4. check if you can read ie. list of indexes from your backup
5. rm all rdsk files from /var/tmp

Have a nice fun

Piotr

[Malcolm McKenzie]

I have found out that some work took place on the disks on the system on the date that these files were created. Thanks to all who responded.