I have some daemon which writes Mongo and MySQL backups to the directory /opt/BACKUP, but I don't know - what kind of daemon, when it works and where I can find its settings?

These files are in the directory:

-rwxrwxrwx 1 root  root 10954766682 Aug 30 21:02 history_2013-08-26.sql.bz2
-rw-r--r-- 1 root  root 22707064861 Sep 19 07:07 history.sql
drwx------ 2 root  root       16384 Dec 24  2012 lost+found
drwxr-xr-x 3 root  root        4096 Sep 19 03:12 mongodb
-rw-r--r-- 1 root  root  6708923175 Sep 18 04:16 mongodb.0.tgz
-rw-r--r-- 1 root  root  6685715560 Sep 17 04:16 mongodb.1.tgz
-rw-r--r-- 1 root  root  6733542547 Sep 19 04:17 mongodb.tgz
drwxr-xr-x 5 mysql root        4096 Sep 19 06:25 mysql
drwxr-xr-x 2 root  root        4096 Dec 24  2012 nobacula
drwxr-xr-x 2 root  root        4096 Aug 29 04:05 tmp

How I can find who writes mongodb.* and history_2013-08-26.sql.bz2?

  • Check your crontabs: /etc/cron.d or /etc/cron.daily. In some of them you'll probably find something related to mongoDB. The utility should be 'mongodump', and the configuration, if not in /etc, is at command line level.
    – AndrewQ
    Sep 19 '13 at 7:28
  • If you can catch it in the act, lsof filename should give you the process that is writing to it.
    – terdon
    Sep 19 '13 at 15:34

You cannot find out directly. The only information you have is the owner and the timestamps of the files.


since the files in question are owned by root, this gives you little information.

timestamps - mongodb

As you can see, the mongodb backups basically all happen at the same time (quarter past 4 in the morning). This - and the fact that the creation time is somewhen at night, when services are most likely under little load) makes it very likely that the backup is triggered by a cron process; therefore you need to check the cron-configuration.

  • /etc/crontab (unlikely, since this is usually controlled by the system)
  • /etc/cron.daily/ (might be, depending on your settings; on my Debian/jessie system, cron.daily jobs are run at 6:25 in the morning according to /etc/crontag, thus unlikely as well)
  • /etc/cron.d/ (most likely)
  • the root-user's crontab file (e.g. /var/spool/cron/crontabs/root but best accessed by running crontab -l as root or sudo crontab -l -u root.)

timestamps - mysql

The history.sql file is pretty recent (Sept.19), and has been created pretty early (7:07); it might as well have been created by a cron-job (see above)

The history_2013-08-26.sql.bz2 has been created on Aug.30 at 21:02; assuming that 9pm is a time when sysadmins might be expected to do some work and noting that there is a discrepancy between timestamp (Aug.30) and file-name (Aug.26), I'd assume that this file has been created manually.

  • Thank you! The demon was found in the folder /etc/cron.daily
    – SoWa
    Sep 20 '13 at 8:27
  • btw, a process started periodically by cron is not strictly-speaking a "daemon" (a deamon is continuously running)
    – umläute
    Sep 20 '13 at 10:26

There are ways to know who wrote a file but they usually require setting up a watch beforehand.

Since all files were created at about the same time, look for daily cron jobs that run about that time. This has a good chance of giving you the answer.

If you have BSD process accounting enabled, run lastcomm to see what processes might have been running at the time the file was written. It can be difficult, since process accounting only keeps track of when a process was started, not when it finished running.

There are ways to find out who's responsible the next time a file is created. One possibility is with the audit subsystem:

auditctl -A exit,always -F path=/opt/BACKUP/mongodb.tgz -S open -S rename

Another possibility is with inotify. For example, set up an incron job:

/opt/BACKUP/mongodb.tgz IN_MOVED_TO,IN_CREATE logger $% $@/$#

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.