I would like to use tmpwatch to regularly clear out old unused files that build up in our /tmp directory. I'd prefer to use the default tmpwatch settings where files in /tmp are deleted only if they have not been accessed for the last 10 days. I don't want to blow away any files that could be in use.
However, on this particular server we use ClamAV to scan various directories on the server on a nightly basis -- including the /tmp folder. This resets the last accessed time on the file and prevents tmpwatch from clearing it out.
One solution would be to set tmpwatch to run at an interval shorter than 24 hours. However, I'd prefer not to do that because 1. a <24 hour window is very short and the file could still be in use and 2. /tmp is a common staging ground for hackers. I wouldn't want to blow away a hackers script or any evidence that we'd been hacked, before ClamAV has the opportunity to catch it and notify us.
Another solution would be to clear out files based upon their last modified timestamp, but again we could run into issues where files still in use are deleted (e.g., /tmp/mysql.sock).
Any ideas for resolving or working around this issue?
0 Answers