I've been messing around with cron recently, I wanted to create a simple cronjob that will send a simple GET request to a website, every minute. Everything would have worked if not for some strange files appearing in cron.d (which seem like some SSL certificates but are in some binary format (I could read header though) but some are normal text files ). I've tried sending files and output to /dev/null but to no avail files keep appearing. I get them every time I use curl or wget.

The files in question have the following names:

There are many more of those and they are being created every time I call wget or curl, despite setting them to redirect everything to /dev/null both with simple redirect on std::out and std::err and also with wget redirect flag (-O) to null (I've also set -q). I turned off my cronjob in crontab, but they are still appearing after calling both programs.

My question: What are those files, and can I somehow stop them from appearing?

  • 1
    Please, 1) show us the exact cmds you issue from cron. 2) Test for exit codes on those commands. 3) Specify above-mentioned file locations... 4) Last report to us (if you wish) by adding an EDIT section at the end of your original post. 5) Expect more questions.
    – Cbhihe
    Aug 7, 2020 at 18:32
  • Ha ! and you can also show us your ~/.wgetrc file if you tweaked it in any way... ;-) Meanwhile I have the answer to question 3: /etc/cron.d/. ;-)
    – Cbhihe
    Aug 7, 2020 at 18:53
  • You could run file on a few of them, in case they have a magic number. You could ls -l a few of them -- the size might indicate if they are complete copies of your downloads. You could check your Linux mailbox -- cron sends mail in some situations. Aug 7, 2020 at 21:03

1 Answer 1


Ok, I've got it.

A program called tcpflow (that is used for monitoring HTTP traffic in my case) was creating those files. I must have run tcpflow while I was in /etc/cron.d and it started doing it's thing. That would also explain "strange" file names that are just a set of IP addresses.

//from tcpflow man page
By default tcpflow stores all captured data in files that have names of the form:
...here the contents of the above file would be data transmitted from host port 2345, to host port 45103.

That would explain why calling wget/curl on HTTP and HTTPS had been creating those files. I should have read the manual :)

I've ended up killing tcpflow processes (I've got 3 of them running at once, that explains 3 copies of the same file marked with c1 and c2 respectively)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .