Mysterious Find!

Every once in a while, my computer hard-drive makes lot of noise and the whole computer seems unresponsive. When that happens, I also find this command running and making all the ruckus:

/usr/bin/find / -type d (-fstype nfs -o fstype NFS -o fstype nfs3 -o -fstype afs -o -fstype proc -o -fstype smbfs -o -fstype autofs -o fstype iso9660 -o -fstype ncpfs -o fstype coda -o -fstype devpts -o -fstype ftpfs -o -fstype devfs -o -fstype mfs -o -fstype sysfs -o -fstype shfs -o -fstype cifs -o -fstype 9P -o regex (^/mnt$)|(^/cdrom$)|(^/tmp$)|((^/usr/tmp$)|(^/var/spool$)|(^/proc$)|(^/media$)|(^/sys$)) -prune -print 0

I see this command in the System Monitor, so I may have transcribed it a bit wrong. It runs at apparently random times and, needless to say, I did not start it. Many questions come to mind:

What gives? Is it a virus? A prank? Something useful? Who does this? What does this?
How to I stop it from happening again? Is this the right forum?

Any ideas and answers would be greatly appreciated,

Thanks in advance,

Do you use “locate” ? This might come from ‘updatedb’. Please open a terminal window and do:


rpm -qa | grep locate

Copy and paste output here.

Edit: This is not a virus. Yes, this forum is OK.

idanan wrote:

>
> Every once in a while, my computer hard-drive makes lot of noise and the
> whole computer seems unresponsive. When that happens, I also find this
> command running and making all the ruckus:
>
> /usr/bin/find / -type d (-fstype nfs -o fstype NFS -o fstype nfs3 -o
> -fstype afs -o -fstype proc -o -fstype smbfs -o -fstype autofs -o fstype
> iso9660 -o -fstype ncpfs -o fstype coda -o -fstype devpts -o -fstype
> ftpfs -o -fstype devfs -o -fstype mfs -o -fstype sysfs -o -fstype shfs
> -o -fstype cifs -o -fstype 9P -o regex
> (^/mnt$)|(^/cdrom$)|(^/tmp$)|((^/usr/tmp$)|(^/var/spool$)|
(^/proc$)|(^/media$)|(^/sys$))
> -prune -print 0

Find all directories under / that not of certain filesystem types and don’t
match certain paths and output the result to SOMETHING you didn’t show.

So… this is incomplete. Find out the process that is getting fed this
information when it runs and it might make better sense. I’m guessing that
because of the -print 0, it might be getting fed to something like xargs -0
which in turn is going to run SOMETHING on the list of dirs. (but that’s
just a guess)

Thanks! Here is the output I got:

>rpm -qa | grep locate
findutils-locate-4.4.0-46.2.x86_64

Does that help?

  • Itai

OK, how do I find that out? The Process Manager shows the PID of the find… Can I use that? I would not know how either though…
I’ll have to wait for the next time that happens though, it does every couple of days more or less… I think.

Thanks in advance,

  • Itai

On 2010-10-28 15:36, idanan wrote:

> What gives? Is it a virus? A prank? Something useful? Who does this?
> What does this?

locate / updatedb. A cron job. See “/etc/sysconfig/locate”.

Not the only job that run finds: there are also security scripts that do something similar.


Cheers / Saludos,

Carlos E. R.
(from 11.2 x86_64 “Emerald” at Telcontar)

Thanks!

That could make sense… I fear I do not understand cron anymore… my /etc/crontab is empty but there is a /etc/cron.daily/suse.de-updatedb which may be related… but I’m just guessing.

So, is this useful? If not, how do I get rid of it? If yes, how do I make it not hog all the disk access? If I can’t, then how do I remove it anyways?

The machine borders on the unusable when that happens, which is why I alway end up killing it.

Thanks in advance,

  • Itai

Aside from finding the process, if your HDD is getting noisy you might want to test it. Most manufacturers provide diagnostic tools for this purpose.

Installing findutils-locate AFAIK has to be started a first time maually, by ‘updatedb’ with root permissions.

When the noise starts, repeat this a couple of times:


ps -ea | grep updatedb

You will see it show up.

If you want to stop it, open a terminal window and do:


KDE: kdesu 'krwite /etc/sysconfig/locate'
GNOME: gnomesu 'gedit /etc/sysconfig/locate'

Look for this line:


RUN_UPDATEDB=yes

change that to:


RUN_UPDATEDB=no

Reboot, and the process won’t start. Mind: the results for ‘locate’ will not be updated any longer, simply since the file database is not updated anymore.

Personally, I’m a big locate fan; I use it to find files all the time, but some people never use it. For them, its useless, for me its vital.

A lot of people use ‘find’ directly, and that is versatile -it can do tricks that locate can never do- but it is slow for big searches. Locate, on the other hand, is fast, but simple.

Conventionally, an ‘updatedb’ is run at some quiet time -say at 03:00- but that doesn’t work if the computer is always off at that time. Of course, you can manually run ‘updatedb’ at a time of your choice, too.

Same here. I can’t imagine my working life without ‘locate’.

On 2010-10-28 20:06, Knurpht wrote:

>
> Reboot,

Don’t reboot! For Tux shake, this is not Windows!


Cheers / Saludos,

Carlos E. R.
(from 11.2 x86_64 “Emerald” at Telcontar)

On 2010-10-28 19:36, idanan wrote:
>
> Thanks!
>
> That could make sense… I fear I do not understand cron anymore… my
> /etc/crontab is empty

Empty file? Then your suse system is broken. Expect problems. Please reinstall it.

> but there is a /etc/cron.daily/suse.de-updatedb
> which may be related… but I’m just guessing.

Yes, it is related.

> So, is this useful? If not, how do I get rid of it? If yes, how do I
> make it not hog all the disk access? If I can’t, then how do I remove it
> anyways?

uninstall the findutils-locate rpm, or edit “/etc/sysconfig/locate”:

RUN_UPDATEDB=“no”

> The machine borders on the unusable when that happens, which is why I
> alway end up killing it.

If it does, you have problems with your hardware setup.


Cheers / Saludos,

Carlos E. R.
(from 11.2 x86_64 “Emerald” at Telcontar)

Thanks everyone. These replies were all very helpful.

Well, the crontab file itself is not empty, just nothing is scheduled. Everything is working normally.

Never used locate, so I’m guessing uninstalling it is my best bet. I do use ‘find’ but extremely rarely.

I’m extremely organized, so searching on my own computer is something of a rarity. When I was on the Google Desktop development team I was one of only two who did not use our own product!
Searching for files simple has never be a common use-case for me. I can’t reorganize the web, so I still search there :wink:

  • Itai

This could be a bad sector somewhere on the drive, Linux will try to read data until it succeeds or the end of time which ever comes first. This causes the drive to tick and the system to freeze. So please check the hardware.

Thanks for the suggestion. It is easy to remember that this is an amazing community
with advice like this :slight_smile:

Cheers,

  • Itai