/var/tmp files

[Andy McDade]

We have over 800 files in /var/tmp on our box all called "puffin.xxxx" i.e. puffin.2949.
The hostname of this 11i PA-RISC box is "Puffin".
Another appears evry fe minutes, and all the files are exactly 2097152 in size and I can't get rid of them:
rm: puffin.2949 not removed. Device busy
If I try to null them I get this error:
sh[2]: puffin.2949: Cannot create the specified file.

fuser and lsof don't seem to shed any light on the matter, although I'm not too sure on the syntax I should be using for lsof.

Any help appreciated.

[Cheryl Griffin]

What is the output from:
# what /var/tmp/puffin.2949
# file /var/tmp/puffin.2949

[Andy McDade]

# what /var/tmp/puffin.2949
/var/tmp/puffin.2949:

# file /var/tmp/puffin.2949
/var/tmp/puffin.2949: commands text

[BOUZALMAD Youssef]

Have you tried fuser -u puffin.xxxx ?

What type of file is it ?! Socket, Pipe, File ?!

You may find which process works on them...

[Cheryl Griffin]

# cat /var/tmp/puffin.2949 |more
or
# strings /var/tmp/puffin.2949 |more

[BOUZALMAD Youssef]

Maybe fuser -cu /var/tmp can hrlp you if /var/tmp is a mount point.

[Andy McDade]

/var/tmp is not a mointpoint.
the files are just full of nothing (cat -v shows completely "^@")
fuser shows nothing, lsof shows nothing, the files types are shown in my previous post.

[Prashant Zanwar_4]

you can check for

ps -aef | grep -i puffin

and also

ps -aef | grep -i 2949

grep -i puffin /etc/init.d/*

just try to trace the processes from where the service is starting, and check with application guys if they know something about it..

Hope it helps
Thanks
Prashant

[Robert-Jan Goossens]

Could these be created by a cron command ?

Could you check the timestamps on the files and compare them with your cron entryâ s.

Best regards,
Robert-

[BOUZALMAD Youssef]

You should rather use strings than cat.

fuser puffin.xxx 2>/dev/null should give you at least one process number.

Anyway, fuser /var/tmp should works even if it is not a moutnt point !

[Andy McDade]

honestly, "fuser puffin.xxxx" gives no output.

[Cheryl Griffin]

What is the output of:
# swapinfo -tam

[Andy McDade]

swapinfo -tam
Mb Mb Mb PCT START/ Mb
TYPE AVAIL USED FREE USED LIMIT RESERVE PRI NAME
dev 4096 0 4096 0% 0 - 1 /dev/vg00/lvol2
localfs 1790 0 1790 0% none 0 1 /var/tmp
reserve - 5725 -5725
total 5886 5725 161 97% - 0 -


Ahhh! Is swap using /var/tmp in some way? Can I switch it off?

[Cheryl Griffin]

Take it out of /etc/fstab and you'll have to reboot.

[Cheryl Griffin]

And you need to blame someone ;^) or smack somebody around for doing this.

[Andy McDade]

Hmm. I looked the /etc/fstab and there is no entry for swap, this is fstab:

/dev/vg00/lvol3 / vxfs delaylog 0 1
/dev/vg00/lvol1 /stand hfs defaults 0 1
/dev/vg00/lvol4 /home vxfs delaylog 0 2
/dev/vg00/lvol5 /opt vxfs delaylog 0 2
/dev/vg00/lvol7 /tmp vxfs delaylog 0 2
/dev/vg00/lvol8 /usr vxfs delaylog 0 2
/dev/vg00/lvol9 /var vxfs delaylog 0 2
/dev/vg00/lvol6 /opt/perf vxfs delaylog 0 2
/dev/vg00/lvol10 /var/adm/crash vxfs delaylog 0 2
/dev/vg00/lvol11 /var/adm/sw vxfs delaylog 0 2
/dev/vg00/lvol12 /var/opt/dce vxfs delaylog 0 2
/dev/vg00/lvol13 /opt/emc vxfs delaylog 0 2
/dev/vg01/lvol1 /var/opt/encina/local vxfs delaylog 0 2
/dev/vg01/lvol5 /appcode vxfs delaylog 0 2
/dev/vg01/lvol2 /var/mqm vxfs delaylog 0 2
/dev/vg01/lvol3 /opt/mqm vxfs delaylog 0 2
/dev/vg01/lvol6 /users vxfs delaylog 0 2
/dev/vg01/lvol7 /var/mqm/log vxfs delaylog 0 2
/dev/vg01/lvol8 /var/spool/lp vxfs delaylog 0 2
/dev/vg01/lvol12 /admin vxfs delaylog 0 2
/dev/vg01/inf1 /informix731FD7X2 vxfs log 0 2
#/dev/vg00/swap ... swap defaults 0 0
#/dev/vg01/swap ... swap defaults 0 0

[BOUZALMAD Youssef]

Maybe you can try via SAM

@Cheryl : Congratulations !

[Cheryl Griffin]

When were the swap entries commented out?
When was the last time your system was rebooted?

[Cheryl Griffin]

Any update on this?

It's possible the entries were commented out and the system was not rebooted, therefore it's still in use.

Look at the date of the /etc/fstab, although this date could be changed at anytime and compare it to:
# uptime

[Mark Greene_1]

Have you tried fuser /var/tmp i.e. fuser on just the directory? Given what swapinfo reports, you may just get the pid for swapper but worth a check.

mark