> From: "Derek Neighbors" > > > Do you have anything in cron script that might do things that > access the > disk. Like udpatedb? > > -Derek > Derek, Good point, "Service crond status" shows cron running. When I loaded the OS I didn't remember setting this up? 8-( "emacs /etc/crontab" shows: SHELL =.... PATH=... MAILTO=... HOME=/ # run-parts 01 * * * root run-parts /etc/cron.hourly 02 4 * * root run-parts /etc/cron.daily 03 4 * * root run-parts /etc/cron.weekly 04 4 1 * root run-parts /etc/cron.monthly These seem tobe running at 1,2,3,4 in the morning (as I read the book "Running Linux" - O'Reilly). The unusual activity took place just before noon and the computer's clock (via GUI) shows to be about 10 min fast. > From: "Jeremy C. Reed" > > > Maybe some cron jobs? > > > 2) Any ideas as to how I can determine why all the disk activity? > > ps auxwwww > > lsof > > Jeremy C. Reed > http://bsd.reedmedia.net/ > Jeremy, "ps auxwwww" shows a lot of good stuff. Unfortunately, I re-booted (paranoia) before I posted the issue. I think I will save this for the next encounter. Thanks > From: Kevin > > I'll bet it is updatedb or makewhatis or logrotate or > something similar > doing it's job. These janitorial functions are usually configured as > cron jobs. > > man cron > man crontab > man anacron > man anacrontab > > ls -halF /etc/cron.* > > > ...Kevin > > Kevin, Thanks "ls -halF /etc/cron.* | more" shows the contents of the files (see Derek above): /etc/cron.hourly /etc/cron.daily /etc/cron.weekly /etc/cron.monthly most of which looks something like: -rwxr-xr-x 1 root root 277 Aug 28 2002 0anacron* -rwxr-xr-x 1 root root 414 Apr 28 2002 makewhatis.cron* but I am still stuck on the timing, just before noon instead of the wee hours in the morning. > From: Kevin > > > Also, when the disk is thrashing check the `top` command to > see what is > working so hard. > > Note the time of day it happens (and/or day of week) and check for a > matching entry in the appropriate /etc/cron.* file. If you are > unfamiliar with cron, there are plenty of web resources > describing cron > syntax like: http://www.tech-geeks.org/contrib/mdrone/cron-howto.html > > For example, my box is setup to execute jobs in the /etc/cron.daily > directory at 04:02 every morning... > > # cat /etc/crontab | grep daily > 02 4 * * * root run-parts /etc/cron.daily > > At that time every morning cron will launch these jobs... > > # ls -hF /etc/cron.daily/ > logrotate* > makewhatis.cron* > collect-honeypot* > tmpwatch* > tripwire-check* > snort-check* > Kevin, This kind of makes sense in a convoluted sort of way. I shut the system down every night such that these jobs may never get to run. 8-( This morning I didn't boot the system till around 10:00. If these systems were to run from the "last boot" instead of the 1,2,3,4 AM indicated by the commands in crontab (is that a possible feature), this would explain it. I think I may need to let this thing run all night from time to time. Thanks > From: "Thomas Cameron" > > Most of Microsoft's desktop OS's periodically index available > filesystems. > It is very possible that a Windows box (you laptop, if that's > what it is > running) is just checking the contents of the shared filesystem. > > Also, Linux itself does things like flushing filesystem cache pretty > regularly, which causes disk activity. > > Are there any Samba or OS log entires during the activity > time? What does > netstat -a show you? How about top? > > Thomas > Thomas, I never thought about windows being involved. The laptop is Win2K