Why can't you use filemon to find out which process generate those tmp files? You have to do it in real time to catch the process right?