Page 1 of 2 12 LastLast
Results 1 to 10 of 16

Thread: Mysterious Find!

  1. #1

    Question Mysterious Find!

    Every once in a while, my computer hard-drive makes lot of noise and the whole computer seems unresponsive. When that happens, I also find this command running and making all the ruckus:

    /usr/bin/find / -type d (-fstype nfs -o fstype NFS -o fstype nfs3 -o -fstype afs -o -fstype proc -o -fstype smbfs -o -fstype autofs -o fstype iso9660 -o -fstype ncpfs -o fstype coda -o -fstype devpts -o -fstype ftpfs -o -fstype devfs -o -fstype mfs -o -fstype sysfs -o -fstype shfs -o -fstype cifs -o -fstype 9P -o regex \(^/mnt$\)\|\(^/cdrom$\)\|\(^/tmp$\)\|\((^/usr/tmp$\)\|\(^/var/spool$\)\|(^/proc$\)\|\(^/media$\)\|\(^/sys$\)) -prune -print 0

    I see this command in the System Monitor, so I may have transcribed it a bit wrong. It runs at apparently random times and, needless to say, I did not start it. Many questions come to mind:

    What gives? Is it a virus? A prank? Something useful? Who does this? What does this?
    How to I stop it from happening again? Is this the right forum?

    Any ideas and answers would be greatly appreciated,

    Thanks in advance,
    - Itai
    http://www.google.com/profiles/idanan

  2. #2
    Join Date
    Jun 2008
    Location
    Groningen, Netherlands
    Posts
    14,033
    Blog Entries
    12

    Default Re: Mysterious Find!

    Do you use "locate" ? This might come from 'updatedb'. Please open a terminal window and do:
    Code:
    rpm -qa | grep locate
    Copy and paste output here.

    Edit: This is not a virus. Yes, this forum is OK.
    - Athlon X6 3.6 GHz, 16 GB DDR3, 30 GB SSD, 3 TB of disks, GT540, openSUSE 12.2 x86_64 + KDE 4.10 + GNOME 3
    - ASUS A73SD, Intel + GT610M Optimus, 6 GB, 120 GB SSD, openSUSE Tumbleweed

    Anything that can go wrong.... will teach us

    http://en.opensuse.org/User:Knurpht
    http://nl.opensuse.org/Gebruiker:Knurpht

  3. #3
    Join Date
    Jun 2008
    Location
    Frisco, TX
    Posts
    1,179

    Default Re: Mysterious Find!

    idanan wrote:

    >
    > Every once in a while, my computer hard-drive makes lot of noise and the
    > whole computer seems unresponsive. When that happens, I also find this
    > command running and making all the ruckus:
    >
    > /usr/bin/find / -type d (-fstype nfs -o fstype NFS -o fstype nfs3 -o
    > -fstype afs -o -fstype proc -o -fstype smbfs -o -fstype autofs -o fstype
    > iso9660 -o -fstype ncpfs -o fstype coda -o -fstype devpts -o -fstype
    > ftpfs -o -fstype devfs -o -fstype mfs -o -fstype sysfs -o -fstype shfs
    > -o -fstype cifs -o -fstype 9P -o regex
    > \(^/mnt$\)\|\(^/cdrom$\)\|\(^/tmp$\)\|\((^/usr/tmp$\)\|\(^/var/spool$\)\|

    (^/proc$\)\|\(^/media$\)\|\(^/sys$\))
    > -prune -print 0


    Find all directories under / that not of certain filesystem types and don't
    match certain paths and output the result to SOMETHING you didn't show.

    So... this is incomplete. Find out the process that is getting fed this
    information when it runs and it might make better sense. I'm guessing that
    because of the -print 0, it might be getting fed to something like xargs -0
    which in turn is going to run SOMETHING on the list of dirs. (but that's
    just a guess)


  4. #4

    Default Re: Mysterious Find!

    Thanks! Here is the output I got:

    >rpm -qa | grep locate
    findutils-locate-4.4.0-46.2.x86_64

    Does that help?

    - Itai

    Quote Originally Posted by Knurpht View Post
    Do you use "locate" ? This might come from 'updatedb'. Please open a terminal window and do:
    Code:
    rpm -qa | grep locate
    Copy and paste output here.

    Edit: This is not a virus. Yes, this forum is OK.
    - Itai
    http://www.google.com/profiles/idanan

  5. #5

    Default Re: Mysterious Find!

    OK, how do I find that out? The Process Manager shows the PID of the find... Can I use that? I would not know how either though...
    I'll have to wait for the next time that happens though, it does every couple of days more or less... I think.

    Thanks in advance,

    - Itai
    - Itai
    http://www.google.com/profiles/idanan

  6. #6
    Join Date
    Feb 2009
    Location
    Spain
    Posts
    21,861

    Default Re: Mysterious Find!

    On 2010-10-28 15:36, idanan wrote:

    > What gives? Is it a virus? A prank? Something useful? Who does this?
    > What does this?


    locate / updatedb. A cron job. See "/etc/sysconfig/locate".

    Not the only job that run finds: there are also security scripts that do something similar.

    --
    Cheers / Saludos,

    Carlos E. R.
    (from 11.2 x86_64 "Emerald" at Telcontar)

  7. #7

    Default Re: Mysterious Find!

    Thanks!

    That could make sense... I fear I do not understand cron anymore... my /etc/crontab is empty but there is a /etc/cron.daily/suse.de-updatedb which may be related... but I'm just guessing.

    So, is this useful? If not, how do I get rid of it? If yes, how do I make it not hog all the disk access? If I can't, then how do I remove it anyways?

    The machine borders on the unusable when that happens, which is why I alway end up killing it.

    Thanks in advance,

    - Itai
    - Itai
    http://www.google.com/profiles/idanan

  8. #8
    Join Date
    Aug 2008
    Location
    Seattle, WA
    Posts
    1,518

    Default Re: Mysterious Find!

    Aside from finding the process, if your HDD is getting noisy you might want to test it. Most manufacturers provide diagnostic tools for this purpose.

  9. #9
    Join Date
    Jun 2008
    Location
    Groningen, Netherlands
    Posts
    14,033
    Blog Entries
    12

    Default Re: Mysterious Find!

    Installing findutils-locate AFAIK has to be started a first time maually, by 'updatedb' with root permissions.

    When the noise starts, repeat this a couple of times:
    Code:
    ps -ea | grep updatedb
    You will see it show up.

    If you want to stop it, open a terminal window and do:
    Code:
    KDE: kdesu 'krwite /etc/sysconfig/locate'
    GNOME: gnomesu 'gedit /etc/sysconfig/locate'
    Look for this line:
    Code:
    RUN_UPDATEDB=yes
    change that to:
    Code:
    RUN_UPDATEDB=no
    Reboot, and the process won't start. Mind: the results for 'locate' will not be updated any longer, simply since the file database is not updated anymore.
    - Athlon X6 3.6 GHz, 16 GB DDR3, 30 GB SSD, 3 TB of disks, GT540, openSUSE 12.2 x86_64 + KDE 4.10 + GNOME 3
    - ASUS A73SD, Intel + GT610M Optimus, 6 GB, 120 GB SSD, openSUSE Tumbleweed

    Anything that can go wrong.... will teach us

    http://en.opensuse.org/User:Knurpht
    http://nl.opensuse.org/Gebruiker:Knurpht

  10. #10

    Default Re: Mysterious Find!

    Quote Originally Posted by idanan View Post

    So, is this useful?
    Personally, I'm a big locate fan; I use it to find files all the time, but some people never use it. For them, its useless, for me its vital.

    A lot of people use 'find' directly, and that is versatile -it can do tricks that locate can never do- but it is slow for big searches. Locate, on the other hand, is fast, but simple.

    Conventionally, an 'updatedb' is run at some quiet time -say at 03:00- but that doesn't work if the computer is always off at that time. Of course, you can manually run 'updatedb' at a time of your choice, too.

Page 1 of 2 12 LastLast

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •