Weird /tmp problem

[Ken A]

You are running ls and df as root, right? Are you running any IDS? It's 
good to rule out the worst case scenarios first, even if that might seem 
paranoid. /tmp is an obvious target. ls output shouldn't conflict with 
df output. check ls -la carefully for anything funny looking (a dir 
beginning with a space, etc).
Ken A.
Pacific.Net

Gavin Nelmes-Crocker wrote:
> I'm suddenly seeing a really strange problem which has bugged me now for 
> a couple of days with no resolution
> 
> Box Bluequartz (cobalt type OS)
> 
> df -h gives below
> 
> Filesystem            Size  Used Avail Use% Mounted on
> /dev/md1              6.0G  1.4G  4.3G  24% /
> /dev/md0               99M   38M   56M  41% /boot
> none                 1014M     0 1014M   0% /dev/shm
> /dev/md4               62G  8.6G   50G  15% /home
> /dev/md2             1012M   34M  927M   4% /tmp
> /dev/md3              4.0G  1.7G  2.1G  45% /var
> 
> I have Mailscanner-4.57.6-1 installed (upgraded tonight from slightly 
> earlier version to see if the problem got resolved.
> 
> Problem - When i turn MailScanner on suddenly /tmp starts to fill 
> rapidly and i then see an error in the logs
> 
>  MailScanner[21007]: ERROR: Unable to create temporary directory
> 
> If i do du -h i see below clearly showing there is a problem with /tmp
> 
> Filesystem            Size  Used Avail Use% Mounted on
> /dev/md1              6.0G  1.4G  4.3G  24% /
> /dev/md0               99M   38M   56M  41% /boot
> none                 1014M     0 1014M   0% /dev/shm
> /dev/md4               62G  8.6G   50G  15% /home
> /dev/md2             1012M 1012M     0 100% /tmp
> /dev/md3              4.0G  1.7G  2.1G  45% /var
> 
> but if i look at a listing with ls -al i see nothing different and more 
> importantly nothing taking up massive disk space.
> 
> The result is that the users mail gets processed but they get no message 
> and no subject the email is blank apart from the Mailscanner headers
> 
> As soon as i stop mailscanner and restart sendmail on its own everything 
> returns to normal.
> 
> Where should i be looking? this was all working until Monday morning 
> when it suddenly stopped, as far as i know no reboot or software update 
> to cause it - weird
> 
> Thanks
> 
> Regards
> 
> Gavin