Centos – Why are files being removed from /tmp

Stock F14 only deletes /tmp files once a day and only if they are more than 10days old via /etc/cron.daily/tmpwatch.

You could use the auditing subsystem. Suppose the files are in the dir /tmp/help. In /etc/audit/audit.rules add

-a exit,always -F path=/tmp/help

Then restart auditd with /etc/rc.d/init.d/auditd restart. Here is what is logged in /var/log/audit/audit.log when I execute rm /tmp/help/heregoes:

type=SYSCALL msg=audit(1299113860.183:47): arch=c000003e syscall=263 success=yes exit=0 a0=ffffffffffffff9c a1=133a0c0 a2=0 a3=1 items=2 ppid=21286 pid=21328 auid=500 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts361 ses=1 comm="rm" exe="/bin/rm" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
type=CWD msg=audit(1299113860.183:47):  cwd="/root"
type=PATH msg=audit(1299113860.183:47): item=0 name="/tmp/help/" inode=398818 dev=fd:00 mode=040755 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0
type=PATH msg=audit(1299113860.183:47): item=1 name="/tmp/help/heregoes" inode=398819 dev=fd:00 mode=0100644 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:user_tmp_t:s0

The first (rather long) line shows the executable, pid, and ppid, which may help.

You should use lsof /tmp to see currently opened file.

If you delete a file, while a software still have a lock on it, you won't see it anymore, but it will still have hd space assigned to it.