strange find process

[Michael Powell]

Anh Ky Huynh wrote:

> Hi all,
> 
> At 2:00 am today, I turned my laptop on and suddenly found a strange
> process:
> 
> $ ps xauw | grep find
> ... find -sx ./bin -type f
>      ( -perm -u+x -or -perm -g+x -or -perm -o+x )
>        ( -perm -u+s -or -perm -g+s ) -exec ls -liTd {} +
> 
> What is the purpose of this process? If that is a system check then where
> is the log file?

There are some scripts called periodic which execute and perform various 
different things depending upon whether it is a daily, weekly, or monthly. 
The output will get emailed to root, or redirected to an alias of root.

The above looks strangely enough like a snippet of this activity. The daily 
usually runs every morning here at 3AM, the weekly rebuilds the locate and 
whatis database something like 4:15AM Saturday morning, and the monthly is 
an end of the month count of login activity.

More info can be found in man periodic. There is a periodic.conf in 
/etc/defaults, and the scripts themselves live in /etc/periodic and you can 
take a look. My bet is you stumbled upon one of the periodic script runs.

-Mike