Just to fill inn what I found out. The job that does this is called

Base: Auto-vacuum internal data

and lives here:

class AutoVacuum(models.AbstractModel):
 """ Expose the vacuum method to the cron jobs mechanism. """
 _name = 'ir.autovacuum'
 _description = 'Automatic Vacuum'
.
.
.
 @api.model
 def power_on(self, *args, **kwargs):
 if not self.env.user._is_admin():
 raise AccessDenied()
 self.env['ir.attachment']._file_gc()
 self._gc_transient_models()
 self._gc_user_logs()
 return True

Hi

I actually have a interesting case. I currently run v15 on odoo.sh and I'm exporting database to try to import it with filestore to different machine for testing and I get 'virus' warning on some file in the odoo db dump.

I was able to locate the phisical file with it's name from antivirus and tried to search for the file in ir.attachment table using the field "Stored Filename" (technical name of field 'store_fname'). Result is the file name that is physically in database dump is not found in the ir.attachment, but the file is physically in the filestore folder when doing db backup.

This is where it gets interesting... in pararel I'm tring to migrate to v17 and have my staging running with v17 version with the same database backup, and there I can find the file in ir.attachment based on it's "Stored Filename".

I want to remove the file from v15 to continue migration, but I cannot locate it.

any ideas?