/tmp - mysterious hidden files?

[Tim Killinger]

what is using all the space in /tmp?


I'll admit I've limited UX experience, but what am I missing here? Or is my math just bad?

Here's my /tmp FS with %used, blks free and blks total:

/tmp 82% 142276 819200

and here is output from du
icgsil1:/tmp> du
0 ./lost+found
0 ./.opccfgmerge
4056 .

and here is what's in /tmp:
icgsil1:/tmp> ll
total 2952
drwxr-xr-x 2 root sys 96 Apr 19 2002 .opccfgmerge
-rw-rw-rw- 1 root sys 1469558 Oct 8 14:36 JSPlog.txt
-rw-r--r-- 1 root root 102 Oct 8 12:06 btmp.out
-rw-r--r-- 1 root root 6 Oct 8 12:06 btmp.stat
-rw-r--r-- 1 root sys 0 Oct 7 19:14 iPlanetIcgs.out
-rw-rw-rw- 1 root sys 331 Oct 8 14:34 icgsFtp.out
drwxr-xr-x 2 root root 96 Apr 19 2002 lost+found
-rw-rw-rw- 1 root sys 227 Oct 8 14:31 queueManager.log
-rw-rw-rw- 1 icgroute icgs 130 Oct 8 14:18 receive.ksh.out
-rw-rw-rw- 1 root sys 1454 Oct 6 11:00 web_tab.log
-rw-r--r-- 1 root root 525 Oct 8 14:35 wtmp.out
-rw-r--r-- 1 root root 7 Oct 8 14:35 wtmp.stat
icgsil1:/tmp>

Thanks in advance!!!!!!!

[RAC_1]

do
du -skx /tmp/* | sort -rn

Anil

[A. Clay Stephenson · Accepted solution]

UNIX has no hidden files; those that begin with "." are only "hidden" in the sense that ls by default doesn't display them. Almost certainly, you are dealing with files that have been unlinked (rm'ed) but not yet free. The space is not really freed until all processes which have the file open either close the file or terminate.

One very common operation in the /tmp directory (although it should now be done by applications in /var/tmp) is to create a file, immediately unlink it, and then continue to use the file. Although there will not be a directory entry for this temporary file, it does exist and occupies space until closed. To get a good understanding of this, man 2 unlink.

Generally the cure is to find the processes that have the files open and kill them. Lsof is a very good tool to help you find these files.

[Govind_3]

The DATA Blocks of the FS assigned to /tmp are not cleared immediately after use by the processes. Rather the inodes are reused as Clay mentioned. Thats the reason you see this. You wouldnt however notice this when the system is just rebooted :)
-Cheers
Govind