Anders Johansson wrote:

On Wednesday 18 August 2004 04:06, Darrell Cormier wrote:

...

I have just installed SuSE 9.1 Pro on my system. Periodically a job is started in the background of which I have not found the source. Can someone explain to me what is going on when the following is running?

(following capture is from top): PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 10181 nobody 34 19 1528 752 1244 D 4.0 0.1 0:03.34 find

When something is run periodically, your best bet is to look at the cron jobs. At 4.15am, the daily jobs are run. One of these is "updatedb", which updates your locate database, so you can use "locate" to find files quickly. That is what you're seeing above

Thanks Anders. That was my guess but I ran crontab -l as both my user and root and nothing was listed in the crontab. As root I also su nobody and ran a crontab -l and saw nothing. Do these cron jobs not show up in a crontab for any user? DC

* Darrell Cormier [08-17-04 21:33]:

Thanks Anders. That was my guess but I ran crontab -l as both my user and root and nothing was listed in the crontab. As root I also su nobody and ran a crontab -l and saw nothing. Do these cron jobs not show up in a crontab for any user?

did you look in /etc: /etc/cron.d/ /etc/cron.daily/ /etc/cron.hourly/ /etc/cron.monthly/ /etc/crontab /etc/cron.weekly/ -- Patrick Shanahan Registered Linux User #207535 http://wahoo.no-ip.org @ http://counter.li.org HOG # US1244711 Photo Album: http://wahoo.no-ip.org/photos

On Wednesday 18 August 2004 05:29, Darrell Cormier wrote:

Yes, I have looked there but was confused as to the user these were executed under. It also does not quite answer my original question. As Anders mentioned the daily cron is set to run at 04:14 and hourly crons run at 59 minutes of each hour. Now for the kicker, the process that was running for which I sent the original post ran approximately 30 minutes before I sent the message. That would make it at about 20:30 according to my system time. This time does not match any of the /etc/crontab.xxxxx definitions. So I am still a bit confused on this `find` that is run by "nobody".

Did you boot the machine shortly before that?

Also, can you tell me exactly what this line in /etc/crontab means: -*/15 * * * * root test -x /usr/lib/cron/run-crons && /usr/lib/cron/run-crons >/dev/null 2>&1

- means 'don't log it' */15 means every 15 minutes root is the user it should run as "test -x /usr/lib/cron/run-crons && /usr/lib/cron/run-crons" means "see if the script called run-crons exists and is executable, and if it does and is, then run it "> /dev/null 2>&1 " means "redirect all output to /dev/null" (in other words, throw it away so it doesn't get sent to the system administrator every 15 minutes What happens is this: run-crons checks for the existence of some files in /var/spool/cron/lastrun, cron.hourly, cron.weekly etc. If it doesn't find cron.hourly, it runs the cron.hourly scripts. It also checks to see how long it has been since it last run a certain set of scripts. If it's been too long it will run them immediately. This is likely why you saw it running at an off-time. You had your system powered off when it was supposed to run, so when you turned it on it ran immediately Note that 4.14 is when the lock file gets deleted. The scripts run at 4.15