[SOLVED] Strange file showing up in /tmp

lce411 · 05-23-2013, 01:55 PM

I keep getting Nagios errors saying that my "/" partition is out of space. The only thing I can find that is "out of the ordinary" is a file in /tmp named "MCjJlQUS". It's a binary file that is owned by root:root and contains nothing but 100MB of:

Code:

00a7cc70  cb fc 43 b0 39 50 c2 68  fe 3f bc 81 df 44 2e d7  |..C.9P.h.?...D..|
00a7cc80  40 52 07 37 89 e2 3f 1f  af ce b6 8a 9e 15 06 8c  |@R.7..?.........|
00a7cc90  c3 30 23 15 fc 27 7c 55  50 13 98 ba a7 d9 65 65  |.0#..'|UP.....ee|
00a7cca0  b8 b8 78 e7 a7 81 7f 2e  3e bc 7c 8b 8d 3f 5e cf  |..x.....>.|..?^.|
00a7ccb0  a2 88 93 cc d7 af e2 33  aa ce a6 43 eb c0 74 35  |.......3...C..t5|
00a7ccc0  7f 34 04 f5 48 fb 2d 4d  18 32 4d 54 49 37 1e 2c  |.4..H.-M.2MTI7.,|
00a7ccd0  7e 93 d9 dd 5c 46 31 37  c4 06 02 3e 77 80 1e 36  |~...\F17...>w..6|

Has anyone ever seen this? Is there a way to see what program or service actually created the file? It's appeared on a couple of servers. The only thing we have running on all servers is NRPE, but I can't find anything in the file to suggest it's coming from that. If anyone has experienced this and knows how to stop it, I would appreciate some advice.

Guttorm · 05-23-2013, 02:01 PM

Hi

You could try:

lsof | grep MCjJlQUS

If the file is open, it will show you which program it is.

lce411 · 05-23-2013, 02:19 PM

Quote:

Originally Posted by Guttorm

Hi

You could try:

lsof | grep MCjJlQUS

If the file is open, it will show you which program it is.

Thanks for the tip. It looks like someone on the team has been testing out HBSS and that's where the file is coming from.