The /tmp folder on a PHP server keeps filling up with files like these

-rw-------  1 user 5242880 Mar 16 04:32 php3FruGk
-rw-------  1 user 5242880 Mar 16 04:32 php4CsNMh
-rw-------  1 user 5242880 Mar 16 04:32 php4iEwia
-rw-------  1 user 5242880 Mar 16 04:32 php4NpfIo
-rw-------  1 user 5242880 Mar 16 04:32 php7PUmhu

What creates those? It just started happening last week, and the server has issues when /tmp is full. They contain unfamiliar text. What type of encoding is this?

«¾^O"ô<96><83>³E¨<9d>^X$^[,^[Si<8c>¤vB϶<8c>t2_%&)ü<9d>&<9e><8f><93>sª<88>sâZ.Ö<84>!¯^Dx³^M <87>dÛÖ^VºV^AY<97>Ùp

CodePudding user response：

They are not necessarily files generated by a PHP script, but they can be.

If there are several dozen files with the same timestamp, a process writes them in a loop.

And maybe their name begins to suggest PHP session files.

Check process that have same user than theses files and verify it is an authorized process.

You can use this to try to identify the process using /tmp :

cd /tmp
fuser -v .

CodePudding user response：

It could be different stuffs like for example a files uploaded or a PHP session that refers to a user !