> I've had a c-icap/squid failure and noticed that it was because my tmpfs on /var/tmp was full (12 GB).
> It was filled with files such as these:
> # lsof +D /var/tmp/
> COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
> c-icap 773 root 31u REG 0,48 1204 2169779504 /var/tmp/CI_TMP_xqWE8 B
> c-icap 3080 root 29u REG 0,48 1204 2169784571 /var/tmp/CI_TMP_pE6B7 6
> The fact that these files build up and are not deleted might be a side-effect of something that's failing.
> Do you think that the c-icap process is the only one responsible for cleaning these files up?
> Or is there some Squid configuration option or a cache log event I should check regarding this?
Definitely not Squid configuration. Squid does not know anything about
these files or even about c-icap/clamav purposes. The ICAP protocol does
not have a notion of a disk file.
If there are no live ICAP transactions using those files, then somebody
(c-icap and/or clamav) is not deleting unused files when they should be
deleting them. The latter could mean a misconfigured lazy garbage
collection, overload conditions, or bugs, but it will be all on the ICAP
service side. I do not know enough about c-icap and do not remember
enough about clamav to guide you to a solution, unfortunately.