unknown process running - find private_root

[Jeff Hoevenaar]

I have many many of these processes running. What is it and can it be stopped?

root 22086 1 0 09:09:13 ? 0:00 /usr/bin/xargs /usr/bin/chacl -d 2100.*
root 14844 24858 0 14:16:26 pts/1 0:00 grep 22086
root 22087 22086 230 09:09:13 ? 1:37 /usr/bin/find / ! -fstype nfs ! -path /export/private_roots/

[RAC_1]

The first process is xargs, the second grep and last one is find.

If they are causing a problem, you can kill them. User kill -15 for the first time.

Anil

[Chris Xu]

If you did not run those commands, it looked like some other person with root access were doing something. I would ask around before I'd kill these processes if there were other admins, though they were not system processes and OK to be stopped.

Chris.

[Bill Hassell]

Start by looking in $HOME/.sh_history to see if they were started by a root user. Since the xargs command has init as a parent (PID=1), it looks like this was something put into the background. Also check cron to see if the process is being run there. It looks like a runaway script.

[Ermin Borovac]

I think these processes are left over from a SAM session. When user is removed using SAM and user files are selected to be 'removed from all local file systems', SAM will kick off these processes in the background. Have a look in /var/sam/log/samlog, you should find them there.

# strings -a /usr/sam/lbin/upusrfiles | grep chacl
/usr/bin/nohup /usr/bin/nice /usr/bin/find / ! -fstype nfs -only ! -path /export/private_roots/\* -acl opt -a \( ! -user %d \) -a -acl '%d.*' -print | /usr/bin/xargs /usr/bin/chacl -d '%d.*' > /dev/null 2>&1 &

Get yourself a copy of lsof and run it with process id of the find process(es) (lsof -p ) to see why they are hung.