Hi guys,

I'm pretty new to Linux, currently running suse 9.3.

Something pretty strange seems to be happening on my machine, at least, I''ve never noticed it before. I have a permanently on braodband connection, which is why I'm a bit concerned about the following. Sometimes, when I am away from the keyboard and not using the machine my hard drive light will come on and stay on for some long time. Is this some kind of normal scheduled activity happening in the background or is it evidence that the machine is being hacked and the hard drive scanned? If it could be either, is there any way I can tell which it is?

Thanks everyone,

Draiocht

That is not necessarily an abnormal thing. There are several housekeeping processes such as updating the slocate db and various cron things like automatic patch updating. That being said, it's a good idea to verify what's the cause of the activity. Check the output of ps aux and top for any processes that appear during the observed disk activity. A good tip is to take a baseline snapshot of the system using those commands when you don't see activity and use that for comparison. When you identify the process, look it up in /proc by PID # and get info on the binary. Then verify the integrity of the binary using md5sum or rpm -Va.

Thanks very much, that's exactly the kind of information I was looking for.

Regards,

Draiocht