On 05/03/2012 02:35, deanm@sharplabs.com wrote:
On Thu, 03 May 2012 at 15:40:40, Tim wrote:
While I can't answer to why old files might be disappearing, other than to check more than just *daily* CRON entries (hourly, weekly, specific hours of the day), I'll suggest one thing: If you want to keep /tmp contents through a reboot, make sure that /tmp isn't mounted as tmpfs.
Thanks. Checked those. weekly is empty. hourly contains the anacron trigger file and "mcelog.cron" which contains only comments.
Not sure what you mean by specific hours of the day. I don't know how to tell when a file is removed from /tmp/, if that's what you mean.
/tmp is not mounted at all on my system. It is a merely an ordinary subdir of /.
Thanks for the suggestions. Keep 'em coming.
Dean
If you don't mind waiting you could put an audit watch on that directory and look for things unlinking files in the directory. Once you notice a file missing you can look through the audit logs for the syscall that did it and identify the offending process.
Dave