find process running uncommanded

aal · 01-17-2008, 03:50 PM

Hi all,

I keep a little cpu monitor running on my suse 10.1 / KDE desktop, and there is fairly often unexplained cpu usage. At these times, checking the process table shows that the process "find" is running, owner "nobody".

As I attempt to look into it, it shuts down.

This is generally, but not always, whilst online (dial-up modem).

I have the firewall enabled, and never manually altered the default settings, although I have used limewire.

It's hard to search for information on this problem because find is such a common word. What to do?

Thanks in advance.

regards...... andrew.

wildcat22 · 01-17-2008, 03:56 PM

The process is almost undoubtedly being run by cron.

As root:

Code:

 $ crontab -l

Check to see if your find command is in there.
If it is, you can remove it by:

Code:

 $ crontab -e

You may want to set the EDITOR environment variable first. vi is usually the default, but your results may vary.

aal · 01-17-2008, 05:15 PM

Thanks for that wildcat 22,

This is what I got:

Code:

/home/andrew # crontab -l
no crontab for root

I looked up man page for cron and the crontab command syntax. I've never established any scheduled tasks myself, and I'm still not exactly clear if the system would be setting that up by itself?

regards..... andrew.

wildcat22 · 01-17-2008, 06:20 PM

Hrm.

That's interesting.

To answer the immediate question, sometimes (though maybe it's old fashioned) the OS comes preconfigured with some entries.

Now for the more pressing question...

Just for completeness sake, might as well check cron for your own user names. Same command.

Also, try checking out /var/log/messages and a couple other logs. See if you can correlate the find command to anything being output there.

aal · 01-17-2008, 09:16 PM

Hi Wildcat22,

No crontab for any user name on my system.

To check the log files was a good idea. No instance of string "find" in /var/log/messages. I searched from root for all files *log*, containing string "find" then sorted by modify date. Thousands of files, but only one candidate in the last ten days, cups error log, and the context was irrelevant (i.e. it was only like "to find out more....").

I'm both paranoid by nature and the perennial noob. Am I mad to think this is happening due to some hack? When it's running, as soon as I try to investigate it, it stops. Or if I kill the process (as user NOT root), after I get the usual "you don't have permissions" message, five or ten seconds later, this "find" process disappears from the process list.

regards..... andrew.

wildcat22 · 01-18-2008, 10:30 AM

Well, I don't think it's any "hack" as you put it. I wouldn't worry too much about a breach of security.

I'm at a loss at the moment. I guess I need some more information about it to go any further. If you can get an output of the exact command that's being run, that will be useful. As well as characterize how long it runs for usually, when it runs, etc. Does it only run when you are online? Or have you only been looking for it when you are online?

aal · 01-19-2008, 12:06 AM

hi Wildcat22,

Thanks again for that:

Quote:

Originally Posted by wildcat22

If you can get an output of the exact command that's being run, that will be useful. As well as characterize how long it runs for usually, when it runs, etc. Does it only run when you are online? Or have you only been looking for it when you are online?

How can I get the exact command, is there a record of all such commands anywhere?

As far as I know, it generally runs for a decent time, at least for several minutes. Perhaps I've noticed this two or three times a week, for many months now. Generally, I've only watched it for a minute or so, before trying to find out more about what's going on, at which point it always stops.

I'll just let it run next time. I've never yet seen it finish by itself, when I've not been intervening somehow.

It isn't exclusively when online. But, I have no recollection of this happening before I'd installed and used limewire. Shortly after installing that, I found a bunch of (unknown) IPs listed in my xauthorities, which really did not belong. I had a look at the firewall settings then, and saw that limewire makes changes. I'd been thinking this is leftover from that episode.

regards.... andrew.

wildcat22 · 01-19-2008, 09:08 AM

I had forgotten about the limewire bit.

I suppose it quite possibly could be from that. When it's running, just save the output of whatever command you are using to see that it is running.

Code:

 $ ps aux > afile

... would work.

unSpawn · 01-19-2008, 10:06 AM

Quote:

Originally Posted by wildcat22

Well, I don't think it's any "hack" as you put it. I wouldn't worry too much about a breach of security.

One thing I learnt from handling (perceived) incidents is that while it's a nice remark to ease a (potential) victims it would be better not to say it. Until you back it by proof it's just an assumption, an opinion, you see.

Quote:

Originally Posted by aal

How can I get the exact command, is there a record of all such commands anywhere?

Logging of (the filenames of) cronjobs goes to whatever syslogd is configured to log to ('grep cron /etc/syslog.conf').
There's one crontab not mentioned in this thread and thats the systems one: /etc/crontab.
To check the directories mentioned in /etc/crontab for jobs containing the word "find" do 'find /etc -type d -name \*cron\* | xargs grep find -r'

aal · 01-19-2008, 07:43 PM

Thanks to you both,

Quote:

Originally Posted by unSpawn

Logging of (the filenames of) cronjobs goes to whatever syslogd is configured to log to ('grep cron /etc/syslog.conf').
There's one crontab not mentioned in this thread and thats the systems one: /etc/crontab.
To check the directories mentioned in /etc/crontab for jobs containing the word "find" do 'find /etc -type d -name \*cron\* | xargs grep find -r'

There is no syslog.conf file on my system, but there is a file /etc/syslog-ng.conf, which I assume ot be the same thing. It contains this line:

Code:

#destination cron { file("/var/log/cron"); };

So it appears the cron stuff should be kept in /var/log/cron? But this file does not exist.

However there is an /etc/crontab, and the command above gives:

Code:

 # find /etc -type d -name \*cron\* | xargs grep find -r
/etc/cron.daily/suse.de-clean-core:  for DUMMY in `find /var/lib/locatedb -mtime -7 2> /dev/null` ; do
/etc/cron.daily/suse.de-clean-core:      for i in `find "$COREFILE" ! \( -fstype nfs -o -fstype NFS \) \
/etc/cron.daily/suse.de-backup-rc.config:    NEW_MD5="`find $ETC_RCCONFIG /etc/sysconfig -type f | xargs cat | md5sum`"
/etc/cron.daily/suse-tetex:     test -d $p/pk/  && find $p/pk/  -type f -and -atime +20 -print0
/etc/cron.daily/suse-tetex:     test -d $p/tfm/ && find $p/tfm/ -type f -and -atime +60 -print0
/etc/cron.daily/suse-clean_catman:      find /var/cache/man -name '*.gz' -type f -atime +$CATMAN_ATIME  -print0 | \
/etc/cron.daily/suse.de-updatedb:    # avoid error messages from updatedb when using user nobody for find.
/etc/cron.daily/suse.de-clean-tmp:      find $DIR/. $OMIT ! -type d ! -type s ! -type p \
/etc/cron.daily/suse.de-clean-tmp:      } || echo "Error: Can not find /usr/bin/safe-rm"
/etc/cron.daily/suse.de-clean-tmp:      find $DIR/. -depth -mindepth 1 $OMIT -type d -empty \

Plenty of find-ing there, and given the talk about avoiding error messages when using user nobody for find, I suppose this is now resolved: there is nothing untoward going on.

Thanks very much for your help. If you still feel generous, can you let me know if I was right those many months ago to be concerned about finding seven IP addresses in my xauthorities?

At the time, I just removed the entries that didn't belong. What should I have done? Or is that also normal?

regards..... andrew.