Hello, I recently installed Suse Pro 9.1 onto my laptop. I have run yast online_update every second day. Today, after booting up, I noticed that performance was slow, so I ran "top" and saw that user "nobody" was running a "find". I killed it immediately. Who is this user? Is this normal, or do I have an intruder? If so, how should I proceed? John
On Tuesday 23 November 2004 12:15, John Ryan wrote:
Hello, I recently installed Suse Pro 9.1 onto my laptop. I have run yast online_update every second day. Today, after booting up, I noticed that performance was slow, so I ran "top" and saw that user "nobody" was running a "find". I killed it immediately.
Who is this user?
Is this normal, or do I have an intruder? If so, how should I proceed?
No, this is perfectly normal, nobody is a low-privilege system user doing useful things like building locate databases, etc. Leave him alone to get on with his job ... HTH Fergus
John
Hi John,
John Ryan
Today, after booting up, I noticed that performance was slow, so I ran "top" and saw that user "nobody" was running a "find". I killed it immediately.
Do not do this again, please.
Who is this user?
A system user.
Is this normal, or do I have an intruder? If so, how should I proceed?
Absolutely normal, because "nobody" starts a process for indexing the contents of your harddrives. If you open up a console and do a "locate $whatever" or "find $whatever" this goes faster. "nobody" does this with invoking an "updatedb"-process and depending on the environment of the system this can dramatically slow down the system. Normally this process is "cron"ed to sometime at night, but if the system power is off, the "updatedb"-process is starting some minutes after the system is powered on. For more info: man updatedb bis dahin - kind regards Martin Mewes -- Member of the Webmin Translation Team http://www.webmin.com/ http://webmin.mamemu.de/ Debian, SuSE, Securityfocus and Webmin - Mailinglist mboxes http://www.mewes.tv/mbox/
John Ryan wrote:
so I ran "top" and saw that user "nobody" was running a "find". I killed it immediately.
No need to do that.
Who is this user?
A very unprivileged user in a Linux system to do certain tasks that don't need very many privileges.
Is this normal, or do I have an intruder?
This is normal. It is updating a database to be used by the locate command.
If so, how should I proceed?
Next time let it finish. You can turn it off via Yast>System
etc/sysconfig editor>Applications>Locate>RUN_UPDATEDB and set it to no, but only if you never use the locate command. If you use it, leave it on. HTH.
-- Joe Morris New Tribes Mission Email Address: Joe_Morris@ntm.org Registered Linux user 231871
participants (4)
-
Fergus Wilde -
Joe Morris (NTM) -
John Ryan -
Martin Mewes