Elasticsearch creates empty directories in /tmp, can I delete these empty directories

Question

Elasticsearch creates directories inside /tmp. These directories used to execute native code by jna and libffi. Most of the time these directories are empty and have the name like elasticsearch.KNoHBn19. More info here.

When running Elasticsearch for years it filled up root(/) directory due to the directories created by Elasticsearch in the /tmp. To override this, I can point Elasticsearch tmp directory to another disk via setting ES_TMPDIR. But still have thousands of empty directories.

Is it safe to remove these old empty directories created by Elasticsearch? Or Elasticsearch will use all the empty directories created in tmp.

Answer 1

JNA installs its native library in a temporary directory on startup, and after loading it, never uses that path again; similarly for the libffi used by JNA. It is safe to remove these JNA temporary directories/files. The location of these are controlled by JNA's and libffi's temporary directory environment variables, as outlined in the link in your question.

ElasticSearch uses its own temporary directory during execution. From the documentation:

The service automatically configures a private temporary directory for use by Elasticsearch when it is running. This private temporary directory is configured as a sub-directory of the private temporary directory for the user running the installation. If the service will run under a different user, you can configure the location of the temporary directory that the service should use by setting the environment variable ES_TMPDIR to the preferred location before you execute the service installation.

So if you are not currently running Elasticsearch, you are free to delete all those files. If you're currently running it, however, those files/directories may be in use and you should not delete them.

I suspect in this case that the executable will likely have a lock on the files preventing their accidental deletion, but have not confirmed this. If not, it would be useful to limit write permission to the ES_TMPDIR to the Elasticsearch user.