/tmp filling up with .crt files

[gordo32]

For every cycle of this add-on it creates a /tmp/httplib2_merged_certificates_xxxxx.crt file where xxxxx is a unique number. The file always contains the same 243 root & intermediate certificates.

After about 1200 times cycling through the add-on stops working. When I clean up these files in /tmp, the add-on continues to work.

Other than a cron job to clean these up periodically does someone have a fix for this.

FYI, using 2.25.10 version of the TA on Splunk Heavy Forwarder 6.6.5.

[gordo32 · Accepted solution]

It turns out that these .crt files aren't related to this add-on as I first suspected. Uninstalled the add-on and the .crt files continue to collect.

[gordo32]

Also, if it matters at all Ubuntu 16.04 and Splunk is running as Splunk user (not root). Confirmed that the .crt files belong to Splunk user, so not an access issue.