Something is nuking the subdirs in /tmp/amanda at semi-random intervals.

[Almost-retired]

Greeting all;

Going through my emails I just found a message from my wrapper script for amanda, which gets ultra verbose and bitchy when it can't find the /tmp/amanda/Daily subdir to store its logs in, and of course its serious enough that the backup is a total failure.

I have no clue what is deleting that subdir and its lone log file, but it is something I have to become root to re-create and then chown to the correct perms to restore.

What is doing this /tmp cleaning and how can I configure it to skip that and a couple other directories in /tmp that aren't precious, but when they come up missing I have quite a bit of work to  restore them so that the software that needs them runs again?

Thanks.

--
Cheers, Gene
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
The verdict of a jury is the a priori opinion of that juror who smokes
the worst cigars.
                -- H. L. Mencken

[Bald Brick]

What does "semi-random intervals" mean?

The purpose of /tmp is to store temporary files. It's not meant to store permanent files or directories that, for instance, must survive a reboot. If an application expects it to, then that is a bug in that application.

That said, the files and directories in /tmp usually remain there until something removes or overwrites them -- unless your /tmp is in RAM. If it is in RAM it will naturally be emptied every time you shut down your computer. (The easiest way of moving it to RAM is ticking the option to clean it at boot in PCC. And if that's what you've done you cannot configure your system to skip some directories in /tmp.)

But if you haven't set up /tmp this way we have to figure out which apps you have running when /tmp is cleaned.

[Almost-retired]

Semi-random seems to be about every 3 months or so, and it just did it yesterday the 13th sometime after amanda ran at 1am, and its running again this morning at 1am.  Uptime is currently about 50 minutes short of 7 days, so its not a reboot triggered thing.  I suppose I could add a mkdir which won't do anything if it already exists, but that seems sort of hokey too.  I would much rather find the guilty party of services and configure it to skip that whole tree in /tmp, because it doesn't bother the parent directory at all, /tmp/amanda has a rather lengthy cache of files in it, all of which are in fact managed and expired by amanda.  Here is a chkconfig --list output so you can see whats running.
[root@coyote firmware]# chkconfig --list
acpid           0:off   1:off   2:off   3:on    4:on    5:on    6:off   7:on
alsa            0:off   1:off   2:on    3:on    4:on    5:on    6:off   7:off
apmd            0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
apmiser         0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
atd             0:off   1:off   2:off   3:on    4:on    5:on    6:off   7:off
atieventsd      0:off   1:off   2:off   3:off   4:off   5:on    6:off   7:off
avahi-daemon    0:off   1:off   2:on    3:on    4:on    5:on    6:off   7:off
bpalogin        0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
cpufreq         0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
crond           0:off   1:off   2:on    3:on    4:on    5:on    6:off   7:off
cups            0:off   1:off   2:on    3:on    4:on    5:on    6:off   7:off
dansguardian    0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
denyhosts       0:off   1:off   2:off   3:on    4:on    5:on    6:off   7:off
dm              0:off   1:off   2:on    3:off   4:on    5:on    6:off   7:on
dnsmasq         0:off   1:off   2:on    3:on    4:on    5:on    6:off   7:off
gpm             0:off   1:off   2:on    3:on    4:on    5:on    6:off   7:off
haldaemon       0:off   1:off   2:on    3:on    4:on    5:on    6:off   7:on
hddtemp         0:off   1:off   2:on    3:on    4:on    5:on    6:off   7:off
httpd           0:off   1:off   2:off   3:on    4:on    5:on    6:off   7:off
ibod            0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
ip6tables       0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
ipsec-setkey    0:off   1:off   2:off   3:on    4:on    5:on    6:off   7:off
iptables        0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
irqbalance      0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
kheader         0:off   1:off   2:on    3:on    4:off   5:on    6:off   7:off
laptop-mode     0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
lm_sensors      0:off   1:off   2:on    3:on    4:on    5:on    6:off   7:off
mandi           0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
messagebus      0:off   1:off   2:on    3:on    4:on    5:on    6:off   7:on
msec            0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
mtinkd          0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
mysqld          0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
netconsole      0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
netfs           0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
network         0:off   1:off   2:on    3:on    4:on    5:on    6:off   7:off
network-auth    0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
network-up      0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
nfs-common      0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
nfs-server      0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
ntpd            0:off   1:off   2:on    3:on    4:on    5:on    6:off   7:off
numlock         0:off   1:off   2:off   3:on    4:on    5:on    6:off   7:on
oki4daemon      0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
partmon         0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
pktcdvd         0:off   1:off   2:off   3:on    4:on    5:on    6:off   7:off
portreserve     0:off   1:off   2:on    3:off   4:on    5:off   6:off   7:off
pppoe           0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
pptp            0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
racoon          0:off   1:off   2:off   3:on    4:on    5:on    6:off   7:off
resmgr          0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
resolvconf      0:off   1:off   2:on    3:on    4:on    5:on    6:off   7:off
rpcbind         0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
saslauthd       0:off   1:off   2:off   3:on    4:on    5:on    6:off   7:off
sendmail        0:off   1:off   2:on    3:on    4:on    5:on    6:off   7:off
shorewall       0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
smartd          0:off   1:off   2:on    3:on    4:on    5:on    6:off   7:off
smb             0:off   1:off   2:off   3:on    4:on    5:on    6:off   7:off
sound           0:off   1:off   2:on    3:on    4:on    5:on    6:off   7:off
spamd           0:off   1:off   2:on    3:on    4:on    5:on    6:off   7:off
squid           0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
sshd            0:off   1:off   2:on    3:on    4:on    5:on    6:off   7:off
syslog          0:off   1:off   2:on    3:on    4:on    5:on    6:off   7:on
timidity        0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
udev-post       0:off   1:on    2:on    3:on    4:on    5:on    6:off   7:off
ultrabayd       0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
upsd            0:off   1:off   2:on    3:on    4:on    5:on    6:off   7:on
upsmon          0:off   1:off   2:on    3:on    4:on    5:on    6:off   7:on
uuidd           0:off   1:off   2:off   3:on    4:off   5:on    6:off   7:off
wattospm-daemon 0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
winbind         0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
wine            0:off   1:off   2:on    3:on    4:on    5:on    6:off   7:off
wlan            0:off   1:off   2:off   3:off   4:off   5:off   6:off   7:off
xfs             0:off   1:off   2:on    3:on    4:on    5:on    6:off   7:off
xinetd          0:off   1:off   2:off   3:on    4:on    5:on    6:off   7:off

xinetd based services:
        amanda:         on
        cups-lpd:       off
        cvs:            off
        rsync:          on
        saned:          on
        sshd-xinetd:    off
        swat:           off

There is at least one question mark, one for racoon, I haven't the foggiest what that ringtailed burglar is for, but I doubt its for housekeeping in /tmp.

I've done the usual grep for the usual suspects in /etc, but came up empty.

Any other ideas?

Thanks, Gene
--
Cheers, Gene
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
"Joy is wealth and love is the legal tender of the soul."
-- Robert G. Ingersoll

[Bald Brick]

That was a lot of information to chew on at one sitting....

But the culprit doesn't have to be a daemon started from a script somewhere under /etc/rc.d. If the system services that aren't just run at startup really can run for three months without causing any trouble it is even more likely to be some other app. What else have you run lately?

Racoon is a tool for handling Internet Key Exchange, and I can't see why it would remove anything from your /tmp. But I've never used it, so who am I to say?

But I repeat: you shouldn't expect the data in /tmp -- including the subdirectories -- to be persistent.

[Almost-retired]

Well, if by default, /tmp's permissions would allow the amanda user to recreate this missing directory when it come up missing, it wouldn't bother me.  But while it seems amanda can create and maintain its own log files in /tmp/amanda, and in /tmp/amanda-dbg with subdirs there another 3 levels deep, my wrapper script, running as the user amanda, and who is a member of group disk, seems not to have perms to create this /tmp/amanda/Daily subdir when it comes up missing, so I have to su -, create it, then chown it to amanda:disk again when it comes up missing.

The parent 'amanda' and amanda-dbg directories are user only access.  and I note that the /tmp/aanda tree has nothing older than the 12th of Dec in it right now.  with a 30 tape, tape a day format, there should be stuff back to Nov 16th in it now.

I don't ever run any of the 'disk cleaner' utils as I have some stuff a decade+ old.  Yeah, in some respects I am a packrat, but I just found some decade old code for os9/6809 that had the source for a boot from the hard drive module and made it work yesterday, unlike the commercial software I bought for that.  Yup, believe it or not, I have a 'trash 80' color computer in the basement with 2 hard drives on it, running right now, logged into it with minicom.  Its (the coco3) only 23 years old.

amanda is a system user here, but gets its privileges by being made a member of group disk.  No shell, no password has ever been setup.  Doesn't need it.

If it happens again, and I know it will, I suppose I can move that logfile to some other place that isn't subjected to a cleanup at odd intervals.

Thanks.

[Was_Just19]

The user  ~/tmp   is normally a link to  /tmp  which should I believe have ownership as root but permission for all user to r/w to it ...  at least that is how it is set up here.

So I would look to the permissions on  /tmp   and ensure that    ~/tmp   is a link to it .....  after which the permission problem should not exist ....

That is my very simplistic view ....   

[Bald Brick]

Almost-retired,

What are the permissions of your /tmp? They should be 1777.

[Almost-retired]

I loosened that whole path up a bit, so we'll see if the problem comes back again.

Thanks.

--
Cheers, Gene
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)
Wilcox's Law:
        A pat on the back is only a few centimeters from a kick in the pants.

[Almost-retired]

It did it again 3 or 4 days ago, so I just gave up and moved the file to someplace where amanda has priv's, and the unknown housekeepers built in D&C wand can't reach.

Thanks to all who tried to help, you know who you are.  Happy, healthy, and Prosperous new years wishes to all too.

 --
Cheers, Gene
"There are four boxes to be used in defense of liberty:
 soap, ballot, jury, and ammo. Please use in that order."
-Ed Howdershelt (Author)

[Was_Just19]

The user  ~/tmp   is normally a link to  /tmp  which should I believe have ownership as root but permission for all user to r/w to it ...  at least that is how it is set up here.

So I would look to the permissions on  /tmp   and ensure that    ~/tmp   is a link to it .....  after which the permission problem should not exist ....

That is my very simplistic view ....   

I just did an install of KDE 2010.12    and the (edit to add ~) ~/tmp  directory is not a link by default.
Also it has permissions ONLY for the user to access ......  all others forbidden.

regards.

[Bald Brick]

The user  ~/tmp   is normally a link to  /tmp  which should I believe have ownership as root but permission for all user to r/w to it ...  at least that is how it is set up here.

So I would look to the permissions on  /tmp   and ensure that    ~/tmp   is a link to it .....  after which the permission problem should not exist ....

That is my very simplistic view ....  

I just did an install of KDE 2010.12    and the  /tmp  directory is not a link by default.

Do you perhaps mean the ~/tmp directory? (Naturally /tmp would not be a link.)

Also it has permissions ONLY for the user to access ......  all others forbidden.

This would make sense if you mean ~/tmp and if it isn't a symbolic link. (If it is a symlink, talking about its permissions is meaningless.)

But /tmp should nevertheless have the permissions 1777, or drwxrwxrwt. Note the digit "1" in 1777 and the "t" at the end of drwxrwxrwt. They indicate that the sticky bit is set, and that means that while everybody can enter the directory and write files in the directory, nobody but a file's owner can change the file. And that means that a local ~/tmp can relatively safely be just a link to /tmp.

[Was_Just19]

Sorry type ......  yes ~/tmp ......  which on previous installs had been a link to   /tmp

[Bald Brick]

Sorry type ......  yes ~/tmp ......  which on previous installs had been a link to   /tmp

During the last few years I have personally found that after a reinstall ~/tmp has sometimes been a symlink and sometimes not. If it hasn't been a link I've usually replaced it with one.

[Was_Just19]

Sorry type ......  yes ~/tmp ......  which on previous installs had been a link to   /tmp

During the last few years I have personally found that after a reinstall ~/tmp has sometimes been a symlink and sometimes not. If it hasn't been a link I've usually replaced it with one.

I think I might just leave it separate for the moment and see how it works out.
Might be a better setup .....  the user tmp stuff being on the /home/user partition .....

[Bald Brick]

Sorry type ......  yes ~/tmp ......  which on previous installs had been a link to   /tmp

During the last few years I have personally found that after a reinstall ~/tmp has sometimes been a symlink and sometimes not. If it hasn't been a link I've usually replaced it with one.

I think I might just leave it separate for the moment and see how it works out.
Might be a better setup .....  the user tmp stuff being on the /home/user partition .....

Seems sensible, but I have /tmp in RAM, and then it also makes sense to make all the other tmp directories links to /tmp: none of them will take up any disk space and they will all be cleared at shutdown....