Very Computer

Can anybody recommend a "safe" strategy for tidying /usr/tmp?

Many Thanks,
   =Adrian=

Safe against what? If you just want something safe against users
playing games with symlinks, try 'tmpwatch' or 'tmpreaper'.

If you want a tmp cleaner that's safe against accidental deletion of
files which are still in use, you shouldn't be using Unix...

Peter

Quote:> If you want a tmp cleaner that's safe against accidental deletion of
> files which are still in use, you shouldn't be using Unix...

A bit harsh I think. I have a /usr/tmp with 3057 files, with modification
dates ranging from today back to 1997!! Some of the files are nearly 1Mb,
which all adds up. I don't think it in the least unreasonable to expect
there to be a method of identifying "redundant" files in this directory. For
example: Is is safe to assume that all files created before the last boot
can be deleted?

Regards,
   =Adrian=

find /usr/tmp -atime +7 -exec rm {} \;
will execute files that have not been accessed for seven days, you can
put this in as a cron entry, you might want to warn your users not to
store things they need there... but usually anything that has not been
accessed for seven days will not be in use.

See man find for more options like mtime.
Specifying files names within the command using:
- Ceri Davies

find /usr/tmp -atime +7 \( -name core -o -name '*.bak' \) -exec rm {} \;

No, because /usr/tmp is used for things like editor backups which are
expressly intended to be used to recover after a crash, and you don't know
how quickly after a reboot the user will resume the edit.

You should formulate a policy and post it; something like, each day we
delete all /usr/tmp files older than X. I'd say X=1 week is a reasonable
starting point for negotiations. For "older than" you could use modified
date or, if you wanted to be really nice, access date.

If you wanted to put more work into it, compare the last-modified times with
the last-accessed times for all the files in /usr/tmp and note any files
that are very old AND recently accessed. That means someone is keeping
read-only material of enduring interest in /usr/tmp.

Much as it grates on the sensibilites, you should probably do a one-time
archive of the directory tree before the first time you purge it. If you
don't, for sure you'll find out your VPs have been keeping their CVs there.

Chip

It is reasonable to assume that it if you delete files (not sockets,
pipes directories, symlinks or doors) that have do not have a recent
timestamp (ctime or atime), you will not cause any problems to the
operating system.

Users, on the other hand, may wish to continue using files from before
the last reboot. Consider what happens if somebody uses /usr/tmp to
store a database consisting of multiple files. (Call it "netscape-cache"
for the sake of argument.) Some files will be more recent than others,
but if you delete one of files, you should delete all of them to avoid
leaving behind an inconsistent database.

How do you know when a user has genuinely finished with a file? Unix
doesn't have any way for a user to declare how long they want a
temporary file for.

And it's not that uncommon for users to request /tmp files from backups...

Peter

Quote:> Users, on the other hand, may wish to continue using files from before
> the last reboot. Consider what happens if somebody uses /usr/tmp to
> store a database consisting of multiple files. (Call it "netscape-cache"
> for the sake of argument.) Some files will be more recent than others,
> but if you delete one of files, you should delete all of them to avoid
> leaving behind an inconsistent database.

> How do you know when a user has genuinely finished with a file? Unix
> doesn't have any way for a user to declare how long they want a
> temporary file for.

Apart the System/dba administrators, "users" do not have access to a unix
prompt. They are in fact "locked" into a third party application. The
adminstrators have a policy along the lines of "don't put something in /tmp
if it matters". However the intended purpose /usr/tmp is not clear to me, I
can find no reference to it in my copies of the Adminstration guide. It is
Obvious that most of the files must be "rubbish", this wouldn't matter if
they are small files, but they are taking up a considerable amount of space.
Although the Modification times on the files are many months/years ago, all
but a handful have a recent (within the last 5 days or so) access time!! All
files a names similar to "AAAzynZm_.TMP" Hence my question.

Quote:> And it's not that uncommon for users to request /tmp files from backups...

Not on our systems!!

Regards,
   =Adrian=

/usr/tmp is usually a symlink to /var/tmp, which should be documented.

Quote:>All files a names similar to "AAAzynZm_.TMP" Hence my question.

Given that the above filename is 'random', you can safely assume that
the application that created it isn't going to find it again, so it
can be deleted without anything noticing.

Looking at the file's contents or using fuser might tell you what
created it. Good applications will clean up temporary files after
themselves; accumulation of files might indicate something going
wrong, or it could just be sloppy programming.

Peter

[...]

Quote:

>And it's not that uncommon for users to request /tmp files from backups...

What do you tell them when they ask? "There's no tmpfsdump program, sorry"? ...

Chris Thompson
Email: cet1 [at] cam.ac.uk