현재 프비 5.3을 테스트용을 설치해둔 상태입니다.
그런데.. 얼마전부터 보니 오후 1시쯤 되어서 하드가 돌아가는 소리가 나면 확인을 해 보면 find를 하고 있네요..
top으로 확인해 보면 아래와 같습니다..
ps ax로 확인한 결과입니다..
test# ps ax
PID TT STAT TIME COMMAND
0 ?? DLs 0:03.28 [swapper]
1 ?? ILs 0:00.63 /sbin/init --
2 ?? DL 0:58.85 [g_event]
3 ?? DL 1:36.46 [g_up]
4 ?? DL 1:
37.19 [g_down]
5 ?? DL 0:00.00 [thread taskq]
6 ?? DL 0:00.00 [kqueue taskq]
7 ?? DL 0:07.97 [fdc0]
8 ?? DL 0:02.55 [pagedaemon]
9 ?? DL 0:00.00 [vmdaemon]
10 ?? DL 0:00.00 [ktrace]
11 ?? RL 14129:15.79 [idle]
12 ?? WL 0:00.00 [irq0: clk]
13 ?? WL 0:00.01 [irq1: atkbd0]
14 ?? WL 0:00.00 [irq3: sio1]
15 ?? WL 0:
00.00 [irq4: sio0]
16 ?? WL 1:21.12 [irq5: xl0]
17 ?? WL 0:00.00 [irq6: fdc0]
18 ?? WL 0:00.00 [irq7: ppc0]
19 ?? WL 0:00.00 [irq8: rtc]
20 ?? WL 0:00.00 [irq9: uhci0]
21 ?? WL 0:00.00 [irq10:]
22 ?? WL 0:00.00 [irq11:]
23 ?? WL 0:00.00 [irq12: psm0]
24 ?? WL 0:00.00 [irq13:]
25 ?? WL 0:16.48 [irq14: ata0]
26 ?? WL 0:
00.00 [irq15: ata1]
27 ?? WL 39:32.23 [swi5: clock sio]
28 ?? WL 0:00.00 [swi4: vm]
29 ?? WL 1:03.60 [swi1: net]
30 ?? DL 1:31.33 [yarrow]
31 ?? WL 0:00.00 [swi6:+]
32 ?? WL 0:00.00 [swi2: camnet]
33 ?? WL 0:00.00 [swi3: cambio]
34 ?? WL 0:00.00 [swi6: acpitaskq]
35 ?? WL 0:00.00 [swi6: task queue]
36 ?? WL 0:00.00 [swi6:+]
37 ?? DL 0:00.18 [usb0]
38 ?? DL 0:00.00 [usbtask]
39 ?? WL 0:00.00 [swi0: sio]
40 ?? DL 1:36.82 [pagezero]
41 ?? DL 0:39.59 [bufdaemon]
42 ?? DL 24:
36.99 [syncer]
43 ?? DL 0:16.69 [vnlru]
44 ?? DL 0:03.83 [hpt_wt]
45 ?? IL 0:00.00 [nfsiod 0]
46 ?? IL 0:00.00 [nfsiod 1]
47 ?? IL 0:00.00 [nfsiod 2]
48 ?? IL 0:
00.00 [nfsiod 3]
49 ?? DL 1:49.66 [schedcpu]
158 ?? Is 0:00.00 adjkerntz -i
214 ?? Is 0:00.00 /sbin/devd
234 ?? Is 0:06.88 /usr/sbin/syslogd -s
309 ?? Is 0:04.35 /usr/sbin/usbd
345 ?? Is 0:00.04 /usr/sbin/sshd
351 ?? Ss 1:08.41 sendmail: accepting connections (sendmail)
355 ?? Is 0:01.63 sendmail: Queue
runner@00:30:00 for /var/spool/clientmqueue (sendmail)
371 ?? Is 0:11.27 /usr/sbin/cron -s
25105 ?? I 0:00.00 cron: running job (cron)
25107 ?? Is 0:00.02 /bin/sh -c periodic weekly
25110 ?? I 0:00.03 /bin/sh - /usr/sbin/periodic weekly
25116 ?? I 0:00.01 /bin/sh - /usr/sbin/periodic weekly
25117 ?? I 0:00.00 /bin/sh - /usr/sbin/periodic weekly
25118 ?? I 0:00.01 mail -s
test.kangx.com weekly run output root
25127 ?? I 0:00.03 /bin/sh - /etc/periodic/weekly/310.locate
25132 ?? IN 0:00.05 su -fm nobody
25133 ?? IN 0:00.02 _su -m -f (csh)
25134 ?? IN 0:00.02 /bin/sh /usr/libexec/locate.updatedb
25137 ?? DN 0:28.98 find -s / ! ( -fstype ufs ) -prune -or -path /tmp -prune -or -path /usr/tmp
25138 ?? IN 0:00.02 /bin/sh /usr/libexec/locate.mklocatedb -presort
25140 ?? SN 0:00.78 locate.code
/tmp/locatenVvbzEgVhW/mklocate6rNeApu6dF/_mklocatedb25138.bigra
locate.code가 뭔가 이상하고..
약간 의심스러운데..
혹 해킹이나 외부침입이 있는 것이 아닌지 알고 싶습니다..
그럼 수고하세요..
