tmpwatch stop working - unknow process keep updating access time

[t1000]

Hello. I have a very wired problem with /tmp & tmpwatch here.

All files(owned by different users)' access time in /tmp are updated by an unknown process every 5 minutes.

Because of this, tmpwatch will not auto clean-up tmp files and /tmp gets full quickly.

I've created a script which runs lsof every 0.1 seconds to monitor /tmp but still could not find out why.

I've checked all cron tasks from all users and created from /etc/cron.xxx/.

The only task runs every 5 minutes is /usr/local/cpanel/bin/dcpumon.

It's cPanel's system monitor process.

Is that possible that it caused the problems?

Thanks!

 

[cPanelTristan]

Hello,

Rather than running an lsof every second, could you try configuring auditd on the machine?

Here is a guide on using it:

Linux audit files to see who made changes to a file

Of note, some VPS systems cannot use auditd.

Thanks!