> From: "Derek Neighbors" <
derek@gnue.org>
>
>
> Do you have anything in cron script that might do things that
> access the
> disk. Like udpatedb?
>
> -Derek
>
Derek,
Good point,
"Service crond status" shows cron running. When I loaded the OS I didn't
remember setting this up? 8-(
"emacs /etc/crontab" shows:
SHELL =....
PATH=...
MAILTO=...
HOME=/
# run-parts
01 * * * root run-parts /etc/cron.hourly
02 4 * * root run-parts /etc/cron.daily
03 4 * * root run-parts /etc/cron.weekly
04 4 1 * root run-parts /etc/cron.monthly
These seem tobe running at 1,2,3,4 in the morning (as I read the book
"Running Linux" - O'Reilly).
The unusual activity took place just before noon and the computer's clock
(via GUI) shows to be about 10 min fast.
> From: "Jeremy C. Reed" <reed@reedmedia.net>
>
>
> Maybe some cron jobs?
>
> > 2) Any ideas as to how I can determine why all the disk activity?
>
> ps auxwwww
>
> lsof
>
> Jeremy C. Reed
> http://bsd.reedmedia.net/
>
Jeremy,
"ps auxwwww" shows a lot of good stuff. Unfortunately, I re-booted
(paranoia) before I posted the issue.
I think I will save this for the next encounter.
Thanks
> From: Kevin <plug-discuss@firstpacket.com>
>
> I'll bet it is updatedb or makewhatis or logrotate or
> something similar
> doing it's job. These janitorial functions are usually configured as
> cron jobs.
>
> man cron
> man crontab
> man anacron
> man anacrontab
>
> ls -halF /etc/cron.*
>
>
> ...Kevin
>
>
Kevin,
Thanks
"ls -halF /etc/cron.* | more" shows the contents of the files (see Derek
above):
/etc/cron.hourly
/etc/cron.daily
/etc/cron.weekly
/etc/cron.monthly
most of which looks something like:
-rwxr-xr-x 1 root root 277 Aug 28 2002 0anacron*
-rwxr-xr-x 1 root root 414 Apr 28 2002 makewhatis.cron*
but I am still stuck on the timing, just before noon instead of the wee
hours in the morning.
> From: Kevin <plug-discuss@firstpacket.com>
>
>
> Also, when the disk is thrashing check the `top` command to
> see what is
> working so hard.
>
> Note the time of day it happens (and/or day of week) and check for a
> matching entry in the appropriate /etc/cron.* file. If you are
> unfamiliar with cron, there are plenty of web resources
> describing cron
> syntax like: http://www.tech-geeks.org/contrib/mdrone/cron-howto.html
>
> For example, my box is setup to execute jobs in the /etc/cron.daily
> directory at 04:02 every morning...
>
> # cat /etc/crontab | grep daily
> 02 4 * * * root run-parts /etc/cron.daily
>
> At that time every morning cron will launch these jobs...
>
> # ls -hF /etc/cron.daily/
> logrotate*
> makewhatis.cron*
> collect-honeypot*
> tmpwatch*
> tripwire-check*
> snort-check*
>
Kevin,
This kind of makes sense in a convoluted sort of way. I shut the system
down every night such that these jobs may never get to run. 8-(
This morning I didn't boot the system till around 10:00. If these systems
were to run from the "last boot" instead of the 1,2,3,4 AM indicated by the
commands in crontab (is that a possible feature), this would explain it.
I think I may need to let this thing run all night from time to time.
Thanks
> From: "Thomas Cameron" <thomas.cameron@camerontech.com>
>
> Most of Microsoft's desktop OS's periodically index available
> filesystems.
> It is very possible that a Windows box (you laptop, if that's
> what it is
> running) is just checking the contents of the shared filesystem.
>
> Also, Linux itself does things like flushing filesystem cache pretty
> regularly, which causes disk activity.
>
> Are there any Samba or OS log entires during the activity
> time? What does
> netstat -a show you? How about top?
>
> Thomas
>
Thomas,
I never thought about windows being involved. The laptop is Win2K
(text/plain)