Arsthbt

By mistake I noticed that in /tmp directory are continuously created some files then immediately deleted. Using a succession of ls -l /tmp I managed to catch the created files:

-rw------- 1 root root 0 Apr 2 19:37 YlOmPA069G
-rw------- 1 root root 0 Apr 2 19:37 l74jZzbcs6

or another example:

-rw------- 1 root root 0 Apr 2 19:44 AwVhWakvQ_
-rw------- 1 root root 0 Apr 2 19:44 RpRGl__cIM
-rw------- 1 root root 0 Apr 2 19:44 S0e72nkpBl
-rw------- 1 root root 0 Apr 2 19:44 emxIQQMSy2

It's about Ubuntu 18.10 with 4.18.0-16-generic. This is an almost fresh install: I added some server software (nginx, mysql, php7.2-fpm) but even with those closed the problem persists.

What are the files created and why?
How would I stop this behaviour? a very undesirable one on a SSD

Thank you!

UPDATE

The guilty software is x2goserver.service.

I suggest installing and running fnotifystat to detect the process that is creating these files:

sudo apt-get install fnotifystat
sudo fnotifystat -i /tmp

You will see process that is doing the open/close/read/write activity something like the following:

Total Open Close Read Write PID Process Pathname
 3.0 1.0 1.0 0.0 1.0 5748 firefox /tmp/cubeb-shm-5748-input (deleted)
 2.0 0.0 1.0 0.0 1.0 18135 firefox /tmp/cubeb-shm-5748-output (deleted)
 1.0 1.0 0.0 0.0 0.0 5748 firefox /tmp/cubeb-shm-5748-output (deleted)

Determine which program/process is touching files

You can use tools such as lsof to determine which processes and binaries are touching/opening which files. This could become troublesome if the files change frequently, so you can instead set up a watch to notify you:

$ sudo fnotifystat -i /tmp

Sometimes, simply looking at the user or group owner gives you a good hint (ie: ls -lsha).

Put /tmp into RAM instead of disk

If you desire, you can put your /tmp directory into RAM. You will have to determine if this is a smart move based on available RAM, as well as the size and frequency of read/writes.

$ sudo vim /etc/fstab

...
# tmpfs in RAM
tmpfs /tmp tmpfs defaults,noatime,mode=1777 0 0
...

$ sudo mount /tmp
$ mount | grep tmp # Check /tmp is in RAM
tmpfs on /tmp type tmpfs (rw,noatime)

If you have enough RAM, this can be considered a very good thing to do for both the longevity of your SSD, as well as the speed of your system. You can even accomplish this with smaller amounts of RAM if you tweak tmpreaper (sometimes tmpwatch) to be more aggressive.