On 05/03/2012 02:35, deanm(a)sharplabs.com wrote:
On Thu, 03 May 2012 at 15:40:40, Tim wrote:
> While I can't answer to why old files might be disappearing, other
> than
> to check more than just *daily* CRON entries (hourly, weekly,
> specific
> hours of the day), I'll suggest one thing: If you want to keep /tmp
> contents through a reboot, make sure that /tmp isn't mounted as
> tmpfs.
Thanks. Checked those. weekly is empty. hourly contains the
anacron
trigger file and "mcelog.cron" which contains only comments.
Not sure what you mean by specific hours of the day. I don't know
how
to tell when a file is removed from /tmp/, if that's what you mean.
/tmp is not mounted at all on my system. It is a merely an ordinary
subdir of /.
Thanks for the suggestions.
Keep 'em coming.
Dean
If you don't mind waiting you could put an audit watch on that
directory and look for things unlinking files in the directory. Once you
notice a file missing you can look through the audit logs for the
syscall that did it and identify the offending process.
Dave