/tmp files created

[Jeffrey W. Stewart]

Why are files being created in the /tmp directory on the hp3070 tester? Presently using HP-UX hp3070b B.10.20 A 9000/778 2001955376.
The files are all the same size with the word, NONE in the file. Here is what I see, excuse the word wrap.


-rw-rw-r-- 1 operator hp3070 5 Aug 4 15:51 10674a
-rw-rw-r-- 1 operator hp3070 5 Aug 4 16:18 11503a
-rw-rw-r-- 1 operator hp3070 5 Aug 4 16:19 11698a
-rw-rw-r-- 1 operator hp3070 5 Jul 30 15:29 12346a
-rw-rw-r-- 1 operator hp3070 5 Jul 28 16:15 15257a
-rw-rw-r-- 1 operator hp3070 5 Jul 28 19:50 17285a
-rw-rw-r-- 1 operator hp3070 5 Jul 29 22:24 1786a
-rw-rw-r-- 1 operator hp3070 5 Jul 31 08:42 19773a
-rw-rw-r-- 1 operator hp3070 5 Jul 31 09:53 20487a
-rw-rw-r-- 1 operator hp3070 5 Jul 31 10:45 21165a
-rw-rw-r-- 1 operator hp3070 5 Aug 1 12:03 211a
-rw-rw-r-- 1 operator hp3070 5 Jul 31 11:46 21921a
-rw-rw-r-- 1 operator hp3070 5 Jul 31 13:28 23577a
-rw-rw-r-- 1 operator hp3070 5 Jul 29 07:51 23695a
-rw-rw-r-- 1 operator hp3070 5 Jul 29 08:18 24040a
-rw-rw-r-- 1 operator hp3070 5 Jul 29 09:20 24631a
-rw-rw-r-- 1 operator hp3070 5 Jul 31 15:23 24705a
-rw-rw-r-- 1 operator hp3070 5 Jul 31 15:50 24972a
-rw-rw-r-- 1 operator hp3070 5 Jul 31 18:49 25885a
-rw-rw-r-- 1 operator hp3070 5 Jul 29 12:02 26050a
-rw-rw-r-- 1 operator hp3070 5 Jul 29 17:52 29983a
-rw-rw-r-- 1 operator hp3070 5 Aug 3 22:55 3169a
-rw-rw-r-- 1 operator hp3070 5 Jul 30 01:03 3216a
-rw-rw-r-- 1 operator hp3070 5 Jul 29 18:34 624a

[Steven E. Protter]

I can say with almost absolute certainty that this is not the OS doing this.

You have an application or script doing this and you've got plenty of clues to track it down.

find / -exec grep -l 'NONE' {} \;

That will find you scripts with NONE in them.

modify the / to a more logical, less cpu consuming search.

SEP

[Kevin O'Donovan]

Yup, I agree its an application rather than the OS.

Note the owner and group of the file, operator and hp3070, you could do a ps -ef and grep for operator to see what processes are being run by the user 'operator', this will at least narrow it down a bit if not give you the culprit.

Its difficult to see from the output whether there is a particular pattern to when the files are created, i.e. is it an application run as a cron job. Doesn't appear to be from what I can see but...

You could also see what processes are currently using the /tmp directory using the fuser command, you need to be root to use it but if the command has a file or two open in /tmp all the time you could catch it there. Chances are it just dumps the file in /tmp and closes it straight away in case you prob won't get it that way but its another option to check.

Hard to guess beyond that, but the user 'operator' is a non standard user, i.e. not created at install time on HPUX, so it should help to track it down. Do you know why this user was created, what for? Why would someone login to this account, to use a particular application?

hope that helps,
Kevin.

[Kevin O'Donovan]

Hmmm should be a little more explicit, if you'll pardon the term!

* to check what processes are running as this operator user
ps -fu operator (ps -ef |grep operator would work too)

* check for recurring by sorting the output by date using the sort command. Dunno how to do this offhand, man should help.

* fuser on the tmp directory is just
fuser /tmp

Kevin.

[Robert-Jan Goossens_1]

Add on to Kevin's answer, I would use lsof it mutch more easier to use, if you do not have lsof download and install it from,

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/lsof-4.67/

Robert-Jan.

[Jeffrey W. Stewart]

Thanks for your quick replies. I will assign points.

I logged off all users and found the following in the /tmp when the operator logged on.

-rw-rw-r-- 1 operator hp3070 70 Aug 5 12:02 X.out.operator@hp3070b:0
-rw-rw-r-- 1 operator hp3070 5 Aug 5 12:02 25169a

The 25169a has the word NONE. The other file has
/home/operator/.x11start Tue Aug 5 12:02:23 EDT 2003 (process 25010)
I am trying to see what processes are run by the operator and wonder if these files are part of the Translogd daemon that logs test data.
output of ps -fu operator
operator 25194 25181 0 12:03:37 ttyp3 0:00 sh -c basic "test monitor | testhead is 1
| msi '/hp3070/boa
operator 25197 25196 0 12:03:38 ttyp3 0:51 /opt/hp3070/bin/e test monitor | testhead
is 1 | msi '/hp307
operator 25181 25169 0 12:02:28 ttyp3 0:01 /opt/hp3070/bin/e test monitor | load '/va
r/hp3070/standard/
operator 25152 1 0 12:02:22 ? 0:00 /usr/dt/bin/ttsession -s
operator 25159 25010 0 12:02:24 ? 0:00 mwm
operator 25169 25161 0 12:02:28 ttyp3 0:00 basic test monitor | load '/var/hp3070/sta
ndard/TCM' | run
operator 25200 25197 0 12:03:40 ttyp3 0:00 operator tm_standard -h -o
operator 25010 20224 0 12:02:17 ? 0:00 /home/operator/.x11start /home/operator/.x
11start
operator 25196 25194 0 12:03:38 ttyp3 0:00 basic test monitor | testhead is 1 | msi '
/hp3070/boards/725
operator 25161 25010 0 12:02:27 ? 0:01 hpterm -name basic -geometry =80x24 -geome
try +12+117 -cr li

[Robert-Jan Goossens_1]

Hi,

Take a look at next doc,

http://www4.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000006447666

or you check the env for user operator, see if anything get redirected to /tmp.

Hope it helps,

Robert-Jan.

[Tim Adamson_1]

Hi,

By the looks of that output, the file name is a with the letter "a" appended.

I would start looking through the scripts that are executed when a login session starts.

By the looks of things, you have CDE logins, so start from there.

Remember that a pid can be obtained from the shell by $$ so maybe the script is sending information to $$a

Worth a try.


Cheers!

[Jeffrey W. Stewart]

The files with NONE are created when the operator logs in. I called the HP Response Center and they are looking into the problem. I found that the xxx.ps files are created if the system is rebooted. Files are created for any user logging in or out. I wonder if this is unique to the hp3070, b.04.pd software. Thanks for all your replies.

[Jeffrey W. Stewart]

This link takes me to Europe site where I don't have any access. I am logged in when this happens.


http://www4.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000006447666

[Robert-Jan Goossens_1]

Hi again,

US
http://www2.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000006447666

Regards,

Robert-Jan.

[Jeffrey W. Stewart]

These files are created due to user setup used by hp3070 SAM.