Who keeps removing that file?
- by mgerdts
Over the years, I've had many times when some file gets removed and there's no obvious culprit. With dtrace, it is somewhat easy to figure out:
#! /usr/sbin/dtrace -wqs
syscall::unlinkat:entry
/cleanpath(copyinstr(arg1)) == "/dev/null"/
{
stop();
printf("%s[%d] stopped before removing /dev/null\n", execname, pid);
system("ptree %d; pstack %d", pid, pid);
}
That script will stop the process trying to remove /dev/null before it does it. You can allow it to continue by restarting (unstopping?) the command with prun(1) or killing it with kill -9. If you want the command to continue automatically after getting the ptree and pstack output, you can add "; prun %d" and another pid argument to the system() call.
