No CentOS 6, parece que tmpwatch
está baseando sua decisão de excluir quando um arquivo foi acessado pela última vez (atime). Se tiver sido 10 dias (10d) ou mais, será excluído quando tmpwatch
for executado.
Na página tmpwatch
man:
By default, tmpwatch dates files by their atime (access time), not
their mtime (modification time). If files aren't being removed when
ls -l implies they should be, use ls -u to examine their atime to see if
that explains the problem.
Também na página man:
The time parameter defines the threshold for removing files. If the
file has not been accessed for time, the file is removed. The time
argument is a number with an optional single-character suffix specifying
the units: m for minutes, h for hours, d for days. If no suffix is
specified, time is in hours.