find command of nobody runs on every fresh boot in the morning - debian stretch

Question

Folks,

find executed by nobody runs automatically on every fresh boot (in the morning when I boot the system). I guess it is to do with updatedb. How can I confirm my assumption and stop this from executing automatically. My ps aux | grep find output is as follows:

~~> ps aux | grep find
root      4492  0.0  0.0   4288   748 ?        SN   08:10   0:00 /bin/sh /usr/bin/updatedb.findutils
root      4500  0.0  0.0   4288   108 ?        SN   08:10   0:00 /bin/sh /usr/bin/updatedb.findutils
root      4526  0.0  0.0  55444  2988 ?        SN   08:10   0:00 su nobody -s /bin/sh -c /usr/bin/find / -ignore_readdir_race      \( -fstype NFS -o -fstype nfs -o -fstype nfs4 -o -fstype afs -o -fstype binfmt_misc -o -fstype proc -o -fstype smbfs -o -fstype autofs -o -fstype iso9660 -o -fstype ncpfs -o -fstype coda -o -fstype devpts -o -fstype ftpfs -o -fstype devfs -o -fstype mfs -o -fstype shfs -o -fstype sysfs -o -fstype cifs -o -fstype lustre_lite -o -fstype tmpfs -o -fstype usbfs -o -fstype udf -o -fstype ocfs2 -o      -type d -regex '\(^/tmp$\)\|\(^/usr/tmp$\)\|\(^/var/tmp$\)\|\(^/afs$\)\|\(^/amd$\)\|\(^/alex$\)\|\(^/var/spool$\)\|\(^/sfs$\)\|\(^/media$\)\|\(^/var/lib/schroot/mount$\)' \) -prune -o -print0
nobody    4538  0.0  0.0   4288   748 ?        SNs  08:10   0:00 sh -c /usr/bin/find / -ignore_readdir_race      \( -fstype NFS -o -fstype nfs -o -fstype nfs4 -o -fstype afs -o -fstype binfmt_misc -o -fstype proc -o -fstype smbfs -o -fstype autofs -o -fstype iso9660 -o -fstype ncpfs -o -fstype coda -o -fstype devpts -o -fstype ftpfs -o -fstype devfs -o -fstype mfs -o -fstype shfs -o -fstype sysfs -o -fstype cifs -o -fstype lustre_lite -o -fstype tmpfs -o -fstype usbfs -o -fstype udf -o -fstype ocfs2 -o      -type d -regex '\(^/tmp$\)\|\(^/usr/tmp$\)\|\(^/var/tmp$\)\|\(^/afs$\)\|\(^/amd$\)\|\(^/alex$\)\|\(^/var/spool$\)\|\(^/sfs$\)\|\(^/media$\)\|\(^/var/lib/schroot/mount$\)' \) -prune -o -print0
nobody    4539  7.9  0.0  16844  2752 ?        DN   08:10   0:06 /usr/bin/find / -ignore_readdir_race ( -fstype NFS -o -fstype nfs -o -fstype nfs4 -o -fstype afs -o -fstype binfmt_misc -o -fstype proc -o -fstype smbfs -o -fstype autofs -o -fstype iso9660 -o -fstype ncpfs -o -fstype coda -o -fstype devpts -o -fstype ftpfs -o -fstype devfs -o -fstype mfs -o -fstype shfs -o -fstype sysfs -o -fstype cifs -o -fstype lustre_lite -o -fstype tmpfs -o -fstype usbfs -o -fstype udf -o -fstype ocfs2 -o -type d -regex \(^/tmp$\)\|\(^/usr/tmp$\)\|\(^/var/tmp$\)\|\(^/afs$\)\|\(^/amd$\)\|\(^/alex$\)\|\(^/var/spool$\)\|\(^/sfs$\)\|\(^/media$\)\|\(^/var/lib/schroot/mount$\) ) -prune -o -print0
cathyserver  5223  0.0  0.0  13380   940 pts/1    S+   08:12   0:00 grep find

First impression is that it some daemon is scouting the /var /tmp /var/spool /alex /amd /afs /var/tmp for something. How can I find which process/daemon executes this? Is this any webserver? By the way I do not have any /alex /amd directories in my system.

Answer 1

The find is indeed part of updatedb, which runs daily, triggered by the cron daemon.

You can verify by comparing the find parameters from your process list against the configuration in /etc/updatedb.conf.

On Debian Stretch you can switch the locate and its corresponding updatedb command between the alternatives mlocate and locate.findutils:

sudo apt install mlocate locate
sudo update-alternatives --config locate

mlocate

cron daemon uses /etc/cron.daily/mlocate.

To disable the daily run you can either uninstall the package mlocate or disable its cron job by removing execution right:

sudo chmod -x /etc/cron.daily/mlocate

To re-enable it:

sudo chmod +x /etc/cron.daily/mlocate

locate.findutils

cron daemon uses /etc/cron.daily/locate.

To disable the daily run you can either uninstall the package locate or disable its cron job by removing execution right:

sudo chmod -x /etc/cron.daily/locate

To re-enable it:

sudo chmod +x /etc/cron.daily/locate

Source for disable/enable lines: https://askubuntu.com/questions/268130/can-i-disable-updatedb-mlocate