mjhjmtu

Folks,

find executed by nobody runs automatically on every fresh boot (in the morning when I boot the system). I guess it is to do with updatedb. How can I confirm my assumption and stop this from executing automatically. My ps aux | grep find output is as follows:

~~> ps aux | grep find
root 4492 0.0 0.0 4288 748 ? SN 08:10 0:00 /bin/sh /usr/bin/updatedb.findutils
root 4500 0.0 0.0 4288 108 ? SN 08:10 0:00 /bin/sh /usr/bin/updatedb.findutils
root 4526 0.0 0.0 55444 2988 ? SN 08:10 0:00 su nobody -s /bin/sh -c /usr/bin/find / -ignore_readdir_race ( -fstype NFS -o -fstype nfs -o -fstype nfs4 -o -fstype afs -o -fstype binfmt_misc -o -fstype proc -o -fstype smbfs -o -fstype autofs -o -fstype iso9660 -o -fstype ncpfs -o -fstype coda -o -fstype devpts -o -fstype ftpfs -o -fstype devfs -o -fstype mfs -o -fstype shfs -o -fstype sysfs -o -fstype cifs -o -fstype lustre_lite -o -fstype tmpfs -o -fstype usbfs -o -fstype udf -o -fstype ocfs2 -o -type d -regex '(^/tmp$)|(^/usr/tmp$)|(^/var/tmp$)|(^/afs$)|(^/amd$)|(^/alex$)|(^/var/spool$)|(^/sfs$)|(^/media$)|(^/var/lib/schroot/mount$)' ) -prune -o -print0
nobody 4538 0.0 0.0 4288 748 ? SNs 08:10 0:00 sh -c /usr/bin/find / -ignore_readdir_race ( -fstype NFS -o -fstype nfs -o -fstype nfs4 -o -fstype afs -o -fstype binfmt_misc -o -fstype proc -o -fstype smbfs -o -fstype autofs -o -fstype iso9660 -o -fstype ncpfs -o -fstype coda -o -fstype devpts -o -fstype ftpfs -o -fstype devfs -o -fstype mfs -o -fstype shfs -o -fstype sysfs -o -fstype cifs -o -fstype lustre_lite -o -fstype tmpfs -o -fstype usbfs -o -fstype udf -o -fstype ocfs2 -o -type d -regex '(^/tmp$)|(^/usr/tmp$)|(^/var/tmp$)|(^/afs$)|(^/amd$)|(^/alex$)|(^/var/spool$)|(^/sfs$)|(^/media$)|(^/var/lib/schroot/mount$)' ) -prune -o -print0
nobody 4539 7.9 0.0 16844 2752 ? DN 08:10 0:06 /usr/bin/find / -ignore_readdir_race ( -fstype NFS -o -fstype nfs -o -fstype nfs4 -o -fstype afs -o -fstype binfmt_misc -o -fstype proc -o -fstype smbfs -o -fstype autofs -o -fstype iso9660 -o -fstype ncpfs -o -fstype coda -o -fstype devpts -o -fstype ftpfs -o -fstype devfs -o -fstype mfs -o -fstype shfs -o -fstype sysfs -o -fstype cifs -o -fstype lustre_lite -o -fstype tmpfs -o -fstype usbfs -o -fstype udf -o -fstype ocfs2 -o -type d -regex (^/tmp$)|(^/usr/tmp$)|(^/var/tmp$)|(^/afs$)|(^/amd$)|(^/alex$)|(^/var/spool$)|(^/sfs$)|(^/media$)|(^/var/lib/schroot/mount$) ) -prune -o -print0
cathyserver 5223 0.0 0.0 13380 940 pts/1 S+ 08:12 0:00 grep find

First impression is that it some daemon is scouting the /var /tmp /var/spool /alex /amd /afs /var/tmp for something. How can I find which process/daemon executes this? Is this any webserver? By the way I do not have any /alex /amd directories in my system.

The find is indeed part of updatedb, which runs daily, triggered by the cron daemon.

You can verify by comparing the find parameters from your process list against the configuration in /etc/updatedb.conf.

On Debian Stretch you can switch the locate and its corresponding updatedb command between the alternatives mlocate and locate.findutils:

sudo apt install mlocate locate
sudo update-alternatives --config locate

mlocate

cron daemon uses /etc/cron.daily/mlocate.

To disable the daily run you can either uninstall the package mlocate or disable its cron job by removing execution right:

sudo chmod -x /etc/cron.daily/mlocate

To re-enable it:

sudo chmod +x /etc/cron.daily/mlocate

locate.findutils

cron daemon uses /etc/cron.daily/locate.

To disable the daily run you can either uninstall the package locate or disable its cron job by removing execution right:

sudo chmod -x /etc/cron.daily/locate

To re-enable it:

sudo chmod +x /etc/cron.daily/locate

Source for disable/enable lines: https://askubuntu.com/questions/268130/can-i-disable-updatedb-mlocate