How do I find what is creating these bunch of zero byte files under /tmp directory every few minutes.
AIX - 5.3 TL05
# ls -l /tmp
-rw-r--r-- 1 root system 0 Nov 05 16:54 n83n7a
-rw-r--r-- 1 root system 0 Nov 05 16:54 ZO3S7a
-rw-r--r-- 1 root system 0 Nov 05 16:54 58w8ya
-rw-r--r-- 1 root system 0 Nov 05 16:53 oVul7a
-rw-r--r-- 1 root system 0 Nov 05 16:49 iN3h7a
-rw-r--r-- 1 root system 0 Nov 05 16:45 rL9oUa
-rw-r--r-- 1 root system 0 Nov 05 16:45 ch5lEa
Probably the (interactive) shells are doing this. If you enter a long (multiline) command like a for-loop, a while-loop, etc. shells create temporary files they sometimes "forget" to delete. Over time these files accumulate.
Other programs oftenly do the same. For instance the /tmp directory of one of my machines looks like this (part of it - rest snipped):
-rw-rw-r-- 1 root admin 1833 Oct 23 11:21 aaaHxubqa
-rw-rw-r-- 1 root admin 1833 Oct 23 11:21 aaaIDYiEa
-rw-rw-r-- 1 root admin 1833 Oct 23 11:21 aaaIG7jaa
-rw-rw-r-- 1 root admin 1833 Oct 23 11:21 aaaIL3nya
-rw-rw-r-- 1 root admin 1833 Oct 23 11:21 aaaILabEa
-rw-r----- 1 xlcuser staff 360 Oct 28 09:58 xlcLD3JUaMf
-rw-r----- 1 xlcuser staff 360 Oct 27 13:31 xlcLD3Laeaf
-rw-r----- 1 xlcuser staff 363 Nov 04 16:39 xlcLD4HYiaf
-rw-r----- 1 xlcuser staff 360 Oct 27 13:31 xlcLD4Haeif
-rw-r----- 1 xlcuser staff 360 Oct 28 09:58 xlcLD4IUaUf
-rw-r----- 1 xlcuser staff 363 Oct 27 13:30 xlcLD4oIhaf
-rw-r----- 1 xlcuser staff 363 Nov 04 16:53 xlcLD5D3myf
-rw-r----- 1 xlcuser staff 363 Oct 28 09:58 xlcLD5hUiUf
The first group is from shell processes, the second group is from xlc.
Delete them if they bother you. You could do it from cron with a "find .... -exec rm ..." or configure skulker to go after them.
Thanks for your response but I just don't want to delete files because there are like quite a bunch of files (owned by root/system) created every other day and I'm afraid of deleting that might be related to some application/OS even though its in /tmp which usually have files that are not really important.
Anyways I'm trying to find where these files are being generated from and for this I'm looking at the option of setting up 'audit' mode, keep you guys posted.
Now the following has nothing to do with the problem directly, but:
Whatever is placed in /tmp is supposed to br deleted after some time (usually 24 hours). This is what /tmp is for.
Many systems have automatic deletion of the contents of /tmp based on this rule (created more than 24h ago) and whoever puts data in /tmp should be aware that such a rule might be in place. If someone loses valuable data because placing it in /tmp and nowhere else its his fault, not the fault of the systems administrator keeping the machine clean. Its like throwing away some valuable paper on the street and then complaining about the street-cleaning doing its job because it isn't there any more a week later.