From owner-freebsd-questions@FreeBSD.ORG Fri Aug 17 15:22:34 2007 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 0A38E16A41A for ; Fri, 17 Aug 2007 15:22:34 +0000 (UTC) (envelope-from listreader@lazlarlyricon.com) Received: from proxy3.bredband.net (proxy3.bredband.net [195.54.101.73]) by mx1.freebsd.org (Postfix) with ESMTP id BFD0013C491 for ; Fri, 17 Aug 2007 15:22:33 +0000 (UTC) (envelope-from listreader@lazlarlyricon.com) Received: from trapper.homedns.org (213.114.40.248) by proxy3.bredband.net (7.3.127) id 46C581F500001C36; Fri, 17 Aug 2007 13:39:12 +0200 Received: from trapper.homedns.org (localhost [127.0.0.1]) by trapper.homedns.org (8.13.8/8.13.8) with ESMTP id l7HBdB4X062236; Fri, 17 Aug 2007 13:39:12 +0200 (CEST) (envelope-from listreader@lazlarlyricon.com) Message-ID: <46C588DF.1050700@lazlarlyricon.com> Date: Fri, 17 Aug 2007 13:39:11 +0200 From: Rolf G Nielsen User-Agent: Thunderbird 2.0.0.6 (X11/20070810) MIME-Version: 1.0 To: brad clawsie References: <20070817101935.GA1064@localhost.gateway.2wire.net> In-Reply-To: <20070817101935.GA1064@localhost.gateway.2wire.net> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Cc: freebsd-questions@freebsd.org Subject: Re: curious root find running X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Aug 2007 15:22:34 -0000 brad clawsie wrote: > hi > > while sitting at my computer tonight i noticed a great deal of disk > activity. i found that this process was running: > > $ ps -auxwww 1463 > USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND > root 1463 4.3 0.1 1876 1404 ?? D 3:01AM 0:07.26 find /usr > -xdev -type f ( -perm -u+x -or -perm -g+x -or -perm -o+x ) ( -perm > -u+s -or -perm -g+s ) -print0 > > any idea why this is running? is it part of a sanctioned background > process? > > thanks! > brad > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org" > > > It's part of the nightly security check. Check out the periodic(8) man page and the scripts in the subdirectories of /etc/periodic. The command you had running is in /etc/periodic/security/100.chksetuid. -- Sincerly, Rolf Nielsen