From owner-freebsd-questions@FreeBSD.ORG Thu Jun 5 15:30:20 2008 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id CCF661065674 for ; Thu, 5 Jun 2008 15:30:20 +0000 (UTC) (envelope-from cptsalek@gmail.com) Received: from ti-out-0910.google.com (ti-out-0910.google.com [209.85.142.188]) by mx1.freebsd.org (Postfix) with ESMTP id 59BF58FC0C for ; Thu, 5 Jun 2008 15:30:20 +0000 (UTC) (envelope-from cptsalek@gmail.com) Received: by ti-out-0910.google.com with SMTP id d27so210857tid.3 for ; Thu, 05 Jun 2008 08:30:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=29MJLQmJMJZrXwwJieTLugxQp3lJEm84HZJC+15oxcQ=; b=aJweVERpiRsizzaVkLbUw+4mi6+VSLBpmLfKFRu235/9MoODmphRS7ufKkJYn/t1lk wI1U0IQuFX6pvVE7GH9T8E8udVxbhWj8GkHTZnvHkYJQEPKf2Xr+6GpD0o0ZQ0rGqUiD 4r63nsdv681WxgXT0xDtl2VU0CFE2XHjIhXbA= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=NNlavnj1hxNB4qxFpW1jWwvPYTLDTpDk1j4rsj0Z6a3eGbvGXBZ8c95UsBZy2XHxYj ZJYYe2fLGEVVsV4GRhVO3YmtFG3t4b3C9jSB/rKac14ZbyPm6lKarHaq0UgnHTQAADlK X0FvZyfzPqqIjPKM6xVLVe5aaSC2EpV8xj2Kw= Received: by 10.150.202.8 with SMTP id z8mr1998616ybf.5.1212679817453; Thu, 05 Jun 2008 08:30:17 -0700 (PDT) Received: by 10.150.155.3 with HTTP; Thu, 5 Jun 2008 08:30:17 -0700 (PDT) Message-ID: <14989d6e0806050830l44b2c0f0jb6816a40b077d110@mail.gmail.com> Date: Thu, 5 Jun 2008 17:30:17 +0200 From: "Christian Walther" To: stevefranks@ieee.org In-Reply-To: <539c60b90806041125s6b2fc0cbqbba52225d27e4583@mail.gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline References: <539c60b90806041125s6b2fc0cbqbba52225d27e4583@mail.gmail.com> Cc: FreeBSD Mailing List Subject: Re: intrusion? find is thrashing my disk every time I boot. X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 05 Jun 2008 15:30:20 -0000 2008/6/4 Steve Franks : > I'm really no security expert. I don't leave the system up 24/7, and > I'm on a US DSL connection with a bunch of windows boxes. > > Seems to be a recent phenomena, I've started experiencing disk > thrashing I can hear across the room. ps and top report cvslockd has > been responsible for the thrashing (which usually occurs at a specific > time of day (~1 am MST)), but now, find is doing the thrashing at boot > every time (within the last week at least). Needless to say, I > haven't changed the system in any way during that week. On windows, > I'd just assume this to be normal behavior, but on FreeBSD, it's got > me worried... > I doubt that this is a security issue, but I think you've a silent filesystem corruption. Best thing to do would be to boot to single user and check all filesystems manually to make sure that there isn't anything that goes unnoticed. HTH Christian