You might try running the command
sudo dtrace -qn 'syscall::open:entry /arg1&O_CREAT/ {printf("%5d %s file:%s\n",pid,execname,copyinstr(arg0));}' | grep '[:/]0$'
in a terminal window. The dtrace
output will list the process ID, process name, and filename argument for any open()
call with the O_CREAT
flag set, meaning it will create the file if it does not already exist. Drop the final grep bit if you want to see all potentially file creating open()
calls, but then the output might possibly overwhelm you. Hit ctrl-C when you're done with it.
If something keeps creating files named 0
, the culprit ought to show up in the output.
(Edit: Fixed the grep invocation.)
0
as the exit status to indicate that they ran successfully. Is it possible that you've somehow ended up redirecting the output from shell scripts or unix commands to empty files? I know I end up with misdirected output occasionally. Are they ending up in your home folder?