Debian – Using the /tmp folder for backups, recommended

So, the --exclude-from file, will be:

var/tmp/
var/cache/

and use rsync like this:

rsync -aAv --delete --stats --exclude-from /excludes /home /var /usr/local /etc /Backup/

I've ran into this problem when examining behavior of a particular application I didn't trust. The application would create and later delete its temp files. kenorb's solution is good, however using cat can lead to race condition( that is a file may be removed while cat is working, so partial data only is retrieved).

A lower chance of race condition can be done with creating a hard-link to the file itself. greping and creating hard link can be combined via awk. Thus what I've came up with is the following;

inotifywait -e create -m --format "%w/%f" /tmp/suspicious_dir/ 2>&1 | 
awk 'NR>2{n=split($0,a,"/");system("ln "$0" /tmp/hardlink_to_"a[n]);}'

Since we're using -e create flag , we're only interested in temporary files that are going to be immediately created, and the output format gives us the full path to created temp file. Ignoring first two lines of output via NR>2. For every reported file, there will be created a hard link in form /tmp/hardlink_to_<original filename>