`/tmp/` is filled with numbered empty files over time (`0000000011xxxxxx`) [duplicate]

Question

On my MBP, /tmp/ fills up with empty files named 0000000011608c4c, 0000000011944a47 etc. They're owned by root:wheel and a lot of them are created at once at seemingly random times:

$ ls -ltr /tmp/0000000011* 
-rw------- 1 root wheel 0 Mar 29 09:23 /tmp/0000000011608c4c
-rw------- 1 root wheel 0 Mar 29 21:37 /tmp/0000000011944a47
-rw------- 1 root wheel 0 Mar 29 21:37 /tmp/000000001194c736
-rw------- 1 root wheel 0 Mar 29 21:37 /tmp/000000001195b0a4
-rw------- 1 root wheel 0 Mar 29 21:37 /tmp/000000001196abea
-rw------- 1 root wheel 0 Mar 29 21:37 /tmp/000000001197cd67
-rw------- 1 root wheel 0 Mar 29 21:38 /tmp/0000000011990882
-rw------- 1 root wheel 0 Mar 29 21:38 /tmp/00000000119a2aba
-rw------- 1 root wheel 0 Mar 29 21:38 /tmp/00000000119a962d
-rw------- 1 root wheel 0 Mar 29 21:38 /tmp/00000000119b1c91
-rw------- 1 root wheel 0 Mar 29 21:38 /tmp/00000000119bc041
-rw------- 1 root wheel 0 Mar 29 21:38 /tmp/00000000119c905a
-rw------- 1 root wheel 0 Mar 29 21:38 /tmp/00000000119da295
-rw------- 1 root wheel 0 Mar 29 21:38 /tmp/00000000119f4737
-rw------- 1 root wheel 0 Mar 29 21:38 /tmp/0000000011a1b60e
-rw------- 1 root wheel 0 Mar 30 12:07 /tmp/0000000011bd9959
-rw------- 1 root wheel 0 Mar 30 12:07 /tmp/0000000011be0f55
-rw------- 1 root wheel 0 Mar 30 12:07 /tmp/0000000011be9f57
...

How can I find out what might cause this?

Answer 1

You can use lsof to list open files by their command and process id, and then look them up in Activity Monitor if the name is too long for the column.

Since these are owned by root somehow, you might try the command sudo lsof | grep /tmp.

This uses the super user account to list all open files and selectively filter the stream for '/tmp' using the grep command.