XSOAR /var/tmp folder

NizanCohen — Mon, 09 Mar 2026 10:26:17 GMT

Hi all.

I'm reaching out to you as I require an assistance (maybe someone encountered this already) with the /var/tmp folder.

Since two weeks ago it started to fill up with files called "container_images_docker-tar[NUMBERS]" without being automaticlly deleted (as expected from a tmp folder).

I've tried contacting support and they told me to create a new variable environment for tmpdir and set it to another directory that my server has with much more storage, hoping it will redirect all tmp files to there. This did not work.

So, I was hoping to hear from you guys, did you encounter this issue and if yes, how did you resolve it?

my system is running version 6.12 (will be upgraded to 6.14 in to upcoming month).

Re: XSOAR /var/tmp folder

herry067broof — Wed, 18 Mar 2026 10:39:14 GMT

Hello,

You can try to fix it

Run sudo lsof +D /var/tmp | grep docker-tar to see exactly which process is currently holding those files open. That’ll point you to the actual culprit.

In the meantime, you can clear out the old ones safely with:
find /var/tmp -name "container_images_docker-tar*" -mtime +1 -delete

topic XSOAR /var/tmp folder in Cortex XSOAR Discussions

XSOAR /var/tmp folder

Re: XSOAR /var/tmp folder