1

Is it possible to trace which files are creating files in the /tmp folder on a linux OS? I want to back trace some files to find out where they have come from

user1398287
  • 5,245
  • 5
  • 21
  • 25
  • In general, the only metadata you have about a file is contained within its [*inode*](https://en.wikipedia.org/wiki/Inode). That does not retain any information about the name of the process that created it. – Oliver Charlesworth Feb 02 '14 at 12:09
  • Names of the files might give you some hints, if they've got something else but what tmpnam() produces. –  Feb 02 '14 at 12:12

1 Answers1

1

If the files are open you could find the processes with something like

ll -d /proc/[1-9]*/fd/* | grep /tmp/
Armali
  • 18,255
  • 14
  • 57
  • 171