From owner-freebsd-questions@FreeBSD.ORG Sat Dec 26 00:24:56 2009 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 7C4DD1065672 for ; Sat, 26 Dec 2009 00:24:56 +0000 (UTC) (envelope-from freebsd-questions@m.gmane.org) Received: from lo.gmane.org (lo.gmane.org [80.91.229.12]) by mx1.freebsd.org (Postfix) with ESMTP id 38C068FC14 for ; Sat, 26 Dec 2009 00:24:55 +0000 (UTC) Received: from list by lo.gmane.org with local (Exim 4.50) id 1NOKSj-00026O-25 for freebsd-questions@freebsd.org; Sat, 26 Dec 2009 01:24:53 +0100 Received: from pool-68-239-67-110.res.east.verizon.net ([68.239.67.110]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 26 Dec 2009 01:24:53 +0100 Received: from nightrecon by pool-68-239-67-110.res.east.verizon.net with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Sat, 26 Dec 2009 01:24:53 +0100 X-Injected-Via-Gmane: http://gmane.org/ To: freebsd-questions@freebsd.org From: Michael Powell Followup-To: gmane.os.freebsd.questions Date: Fri, 25 Dec 2009 19:24:04 -0500 Lines: 31 Message-ID: References: <20091226042600.1920a0e1@icy.localdomain> Mime-Version: 1.0 Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: 7Bit X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: pool-68-239-67-110.res.east.verizon.net User-Agent: KNode/4.3.4 Sender: news Subject: Re: strange find process X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 26 Dec 2009 00:24:56 -0000 Anh Ky Huynh wrote: > Hi all, > > At 2:00 am today, I turned my laptop on and suddenly found a strange > process: > > $ ps xauw | grep find > ... find -sx ./bin -type f > ( -perm -u+x -or -perm -g+x -or -perm -o+x ) > ( -perm -u+s -or -perm -g+s ) -exec ls -liTd {} + > > What is the purpose of this process? If that is a system check then where > is the log file? There are some scripts called periodic which execute and perform various different things depending upon whether it is a daily, weekly, or monthly. The output will get emailed to root, or redirected to an alias of root. The above looks strangely enough like a snippet of this activity. The daily usually runs every morning here at 3AM, the weekly rebuilds the locate and whatis database something like 4:15AM Saturday morning, and the monthly is an end of the month count of login activity. More info can be found in man periodic. There is a periodic.conf in /etc/defaults, and the scripts themselves live in /etc/periodic and you can take a look. My bet is you stumbled upon one of the periodic script runs. -Mike