Process holding /tmp space, need to know the process details

UNIX Solaris
1

Hi ,
In a server /tmp has almost reached 75% and i can see the File system utilization is 48Mb only , so i believe some process is using the /tmp space. I would like to know which process is using /tmp space.

# df -h /tmp
Filesystem             size   used  avail capacity  Mounted on
swap                    16G    12G   4.1G    75%    /tmp

# du -sh /tmp
  48M   /tmp

This requirement is for a zone , so i am not able to use lsof command. Can someone please tell me if there is any other way to find out which process is using max of /tmp

I know that i can get the process using a mount using fuser command but it does not talk about which process is using max space.

Please help me out on this

2

Why don't you just see who owns the files in the /tmp directory

ls -l /tmp
3

i see lots of files owned by two users but how can come to a conclusion which user and what process intiated by him is using the space

4

Sometimes I will see stuff owned by aptar, for example. Aptar is application account for the Oracle database on the server.

You may want to look at the logs.
Like /var.log/messages for example.

You can remove most/all the files in the /tmp many of the files could be old and not used.

5

In my case , the files are consuming only 48Mb of 4G , I do agree that there are lots of files under /tmp but their space utilization is all together 48Mb. Rest of the space is used by some processes , i like to know which process do that ? Since this is a solaris zone , i am not able to use lsof .

6

Here is a small shell script that will show you some details about all the non empty files currently open in the /tmp file system sorted by processes holding them.
You should easily find the deleted files, if any, that account to the missing space and the script should have no problem running in a zone (untested though).

#!/bin/ksh
pfiles /proc/* | nawk '
/^[1-9][0-9]*/ {process=$0;next}
/size:0$/ {next}
/'$(sleep 300 > /tmp/.$$ &
pid=$!
pfiles $pid | nawk '/ 1:/ {print $4}'
kill $pid;rm /tmp/.$$)'/ {onTmp=1;finfo=$0;next}
/\// {if(onTmp) printf("%s\n%s\n%s\n",process,finfo,$0);onTmp=0}
/ [0-9]*: / {if(onTmp) printf("%s\n%s (deleted)\n",process,finfo);onTmp=0}
'

Explanations about how the script works is left as an exercise for the reader :wink:

7

Thanks , But i see a kill command in the script , is the script going to kill the top space using process under /tmp ? Well i just want them to be listed ! I dont want to kill them as they are application process

8

As I already wrote, my script will report processes and files. It won't do any destructive action on your existing processes or data.

9 
pfiles $pid | nawk '/ 1:/ {print $4}'
kill $pid;rm /tmp/.$$)'/ {onTmp=1;finfo=$0;next}

I am just confused with the kill command over there . What does it kill ?

10

It kills the transient "sleep 300" process just launched.