Tmpwatch – recursively delete files

If you are a Linux administrator, then you certainly need a tool to delete old files – especially old backup files or /tmp directory. Here comes tmpwatch. With parameter time and path, tmpwatch will recursively delete all files older then a given time. But if you use NetBackup, then you might have a problem with deleting files.

Here is my crontab entry for cleaning /tmp directory:

bash> crontab -l

# clean /tmp directory every two hours
0 */2 * * * /usr/sbin/tmpwatch -maf 8 /tmp

This crontab entry will delete all files from the /tmp directory older than 8 hours. Cron will run tmpwatch every two hours. Parameters for the tmpwatch are:

• m – make the decision about deleting a file based on the file’s mtime
• a – remove all file types, not just regular files, symbolic links and directories
• f – remove files even if root doesn’t have write access

I also use tmpwatch to delete old MySQL backup files. Every morning, cron starts mysqldump to save file in a /backup directory. After a month, /backup directory will contain about 30 MySQL backup files. With tmpwatch, the number of files can be limited (tmpwatch -maf 240 /backup – will keep the last 10 backup files)

I firstly used tmpwatch with -caf parameters and that works. In the meantime, we implemented NetBackup system. The result was: no left space on device /dev/sda5 Why? Because tmpwatch didn’t find any file to delete. And why? Because of NetBackup! :) I thought c parameter means the file creation time, but man tmpwatch says:

• c – make the decision about deleting a file based on the file’s ctime (inode change time)

What is inode change time?
The inode change time represents the time when the file’s meta-information last changed. One common example of this is when the permissions of a file change. Changing the permissions doesn’t access the file, so the atime doesn’t change, nor does it modify the file, so the mtime doesn’t change. Yet, something about the file itself has changed, and this must be noted somewhere. This is the job of the ctime field.

# to display a file's mtime run:
ls -l <filename>

# to display a file's atime run:
ls -lu <filename>

# to display a file's ctime run:
ls -lc <filename>

Why NetBacup changes inode change time?
NetBackup has to read files for backup. This will change file’s atime and after full backup, all files on the Linux system would have the same atime. For this reason, NetBackup saves the file’s atime prior to reading the file, and (by default) resets the atime using the utime(2) system call. The utime system call changes the inode time.

After I changed parameter -caf to -maf, tmpwatch and NetBackup began to live harmoniously. :)