Skip to content

Finding Temporary Files and Log Output

Claude Code creates temporary files during session execution. This guide shows you how to find them and understand their purpose.

Temporary File Locations

Primary Locations

  1. /tmp directory - Main temporary storage
  2. Session directories - ~/.claude/projects/<project>/<session>/
  3. MCP server logs - Usually in /tmp with unique names

Finding Claude Temp Files

Method 1: By Name Pattern

# Find Claude-related files in /tmp
find /tmp -name "*claude*" -o -name "*anthropic*" 2>/dev/null

# Find MCP server logs
find /tmp -name "*mcp*" -type f 2>/dev/null

# Find JSONL logs
find /tmp -name "*.jsonl" -type f 2>/dev/null

Method 2: By Process

# Find open files by claude process
lsof | grep -i claude

# Find temp files opened by node processes
lsof -c node | grep /tmp

Method 3: By Recent Modification

# List recently modified files in /tmp
ls -lt /tmp | head -30

# Find files modified in last hour
find /tmp -type f -mmin -60 | head -20

Method 4: From Session Data

The most reliable method is to extract paths from the session JSONL itself:

# Extract all file paths mentioned in logs
grep -oP '"/[^"]*"' session.jsonl | sort -u

# Find temp file references
grep -i "/tmp" session.jsonl | jq -r '.message.content' 2>/dev/null

Understanding File Naming

Session Files

~/.claude/projects/<project>/
├── <session-uuid>.jsonl              # Main session log
├── <session-uuid>/                   # Session directory
│   ├── subagents/
│   │   ├── agent-<uuid>.jsonl       # Subagent conversation log
│   │   └── agent-<uuid>.meta.json   # Subagent metadata
│   └── memory/
│       └── MEMORY.md                 # Session memory

Temporary Files

Temp files typically follow patterns:

/tmp/claude-<uuid>-<type>.log
/tmp/mcp-server-<uuid>.sock
/tmp/anthropic-<session-id>

Extracting Temp File References from JSONL

Using Bun and Zod Types

import { parseClaudeMessages } from '@claude-dashboard/claude-zod';
import { Bun } from 'bun';

// Read JSONL file
const lines = await Bun.file('session.jsonl').text();
const messages = parseClaudeMessages(lines.split('\n'));

// Extract file paths from assistant messages
const filePaths = messages
  .filter(m => m.type === 'assistant')
  .flatMap(m => m.message.content)
  .filter(c => c.type === 'text')
  .flatMap(c => c.text.match(/\/tmp\/[^\s]+/g) || [])
  .filter((v, i, a) => a.indexOf(v) === i); // Unique

console.log('Temp files mentioned:', filePaths);

Using jq

# Extract all /tmp paths from tool results
cat session.jsonl | jq -r '
  select(.type == "user") |
  .message.content |
  capture("/tmp/[^\"\\s]+") |
  .[0]
' | sort -u

Common Temp File Types

1. MCP Server Logs

/tmp/mcp-<server-name>-<uuid>.log

These contain MCP server stdout/stderr.

2. Socket Files

/tmp/mcp-<uuid>.sock

Unix domain sockets for MCP communication.

3. Tool Output

/tmp/claude-tool-<uuid>.out

Temporary output from long-running tools.

4. Cache Files

/tmp/claude-cache-<hash>

Cached API responses or computed data.

Session-to-Temp-File Mapping

To find which temp files belong to which session:

import { parseClaudeMessage } from '@claude-dashboard/claude-zod';

interface SessionTempFiles {
  sessionId: string;
  tempFiles: string[];
  mcpServers: string[];
}

function extractTempFileReferences(jsonlPath: string): SessionTempFiles {
  const sessionId = jsonlPath.match(/([a-f0-9-]+)\.jsonl$/)[1];
  const tempFiles = new Set<string>();
  const mcpServers = new Set<string>();

  for (const line of Bun.file(jsonlPath).text().split('\n')) {
    const msg = parseClaudeMessage(line);
    if (!msg || msg.type !== 'user') continue;

    const content = typeof msg.message.content === 'string' 
      ? msg.message.content 
      : JSON.stringify(msg.message.content);

    // Extract /tmp paths
    const tmpMatches = content.match(/\/tmp\/[^\s"']+/g);
    tmpMatches?.forEach(m => tempFiles.add(m));

    // Extract MCP server names
    const mcpMatches = content.match(/mcp[-_]?server[-_]?([a-z0-9-]+)/gi);
    mcpMatches?.forEach(m => mcpServers.add(m));
  }

  return {
    sessionId,
    tempFiles: Array.from(tempFiles),
    mcpServers: Array.from(mcpServers),
  };
}

Cleaning Up Temp Files

Safe Cleanup Script

#!/bin/bash
# cleanup-claude-temp.sh

# Find Claude temp files older than 1 hour
find /tmp -name "*claude*" -type f -mmin +60 -delete
find /tmp -name "*mcp*.sock" -type f -mmin +60 -delete

# Remove orphaned session directories
# (sessions not in ~/.claude/projects/)

Monitoring Temp Usage

# Check Claude temp file size
du -sh /tmp/*claude* /tmp/*mcp* 2>/dev/null

# Monitor in real-time
watch -n 2 'ls -lh /tmp/*claude* 2>/dev/null | wc -l'

Integration with Claude Dashboard

The Claude Dashboard can display temp file references:

  1. Parse session JSONL using @claude-dashboard/claude-zod
  2. Extract /tmp paths from message content
  3. Display in session details with file status (exists/deleted)
  4. Provide cleanup actions for orphaned files
// Example: Add to SessionDetail page
interface TempFileReference {
  path: string;
  mentionedAt: Date;
  messageType: string;
  exists: boolean;
}

async function getSessionTempFiles(sessionId: string): Promise<TempFileReference[]> {
  const jsonlPath = `~/.claude/projects/.../${sessionId}.jsonl`;
  const references: TempFileReference[] = [];

  // Parse and extract...

  // Check if files still exist
  for (const ref of references) {
    ref.exists = await Bun.file(ref.path).exists();
  }

  return references;
}

Best Practices

  1. Don't rely solely on /tmp searches - Extract from session data
  2. Check file existence - Temp files are often cleaned up automatically
  3. Respect session boundaries - Only access temp files for your sessions
  4. Monitor disk usage - Temp files can accumulate
  5. Use Zod types - Type-safe parsing prevents errors

Troubleshooting

Can't Find Expected Files

  • Files may have been cleaned up by system tmpwatch
  • Check session JSONL for actual paths used
  • Verify session UUID is correct

Too Many False Positives

  • Filter by modification time (last 24h)
  • Match specific patterns (e.g., claude- prefix)
  • Cross-reference with session timestamps

Permission Issues

# Check file permissions
ls -la /tmp/*claude*

# Most should be readable by user
# If not, check process ownership
ps aux | grep claude

Next Steps