Help /usr/bin/find high cpu load

Hi,

since some time i have the problem that after some time my MyCloud starts two /usr/bin/find which are consuming a lot of CPU load.
After restarting the MyCloud again the jobs are gone.
But they reappear some days later again using the CPU.
I have disabled the wd stuff all the time i have the MyCloud ( /etc/init.d/wdmcserverd stop, /etc/init.d/wdphotodbmergerd stop ). This was always working fine until this strange find jobs appeared.

Top is looking like:
32297 32296 nobody R N 3968 0.7 1 52.3 /usr/bin/find /
13408 13407 nobody R N 3968 0.7 0 42.8 /usr/bin/find /

The complete find statement is:

13398 root      4288 S N  su nobody -s /bin/sh -c /usr/bin/find / -ignore_readdir_race      \( -fstype 
NFS -o -fstype nfs -o -fstype nfs4 -o -fstype afs -o -fstype binfmt_misc -o -fstype proc -o -fstype 
smbfs -o -fstype autofs -o -fstype iso9660 -o -fstype ncpfs -o -fstype coda -o -fstype devpts -o -fstype 
ftpfs -o -fstype devfs -o -fstype mfs -o -fstype shfs -o -fstype sysfs -o -fstype cifs -o -fstype lustre_lite 
-o -fstype tmpfs -o -fstype usbfs -o -fstype udf -o -fstype ocfs2 -o      -type d -regex '\(^/tmp$\)\|\ 
(^/usr/tmp$\)\|\(^/var/tmp$\)\|\(^/afs$\)\|\(^/amd$\)\|\(^/alex$\)\|\(^/var/spool$\)\|\(^/sfs$\)\|\(^/media$\)\|\ 
(^/var/lib/schroot/mount$\)' \) -prune -o -print0
13407 nobody    1632 S N  sh -c /usr/bin/find / -ignore_readdir_race      \( -fstype NFS -o -fstype nfs - 
o -fstype nfs4 -o -fstype afs -o -fstype binfmt_misc -o -fstype proc -o -fstype smbfs -o -fstype autofs - 
o -fstype iso9660 -o -fstype ncpfs -o -fstype coda -o -fstype devpts -o -fstype ftpfs -o -fstype devfs -o 
-fstype mfs -o -fstype shfs -o -fstype sysfs -o -fstype cifs -o -fstype lustre_lite -o -fstype tmpfs -o - 
fstype usbfs -o -fstype udf -o -fstype ocfs2 -o      -type d -regex '\(^/tmp$\)\|\(^/usr/tmp$\)\|\ 
(^/var/tmp$\)\|\(^/afs$\)\|\(^/amd$\)\|\(^/alex$\)\|\(^/var/spool$\)\|\(^/sfs$\)\|\(^/media$\)\|\ 
(^/var/lib/schroot/mount$\)' \) -prune -o -print0
13408 nobody    3936 R N  /usr/bin/find / -ignore_readdir_race ( -fstype NFS -o -fstype nfs -o -fstype 
nfs4 -o -fstype afs -o -fstype binfmt_misc -o -fstype proc -o -fstype smbfs -o -fstype autofs -o -fstype 
iso9660 -o -fstype ncpfs -o -fstype coda -o -fstype devpts -o -fstype ftpfs -o -fstype devfs -o -fstype 
mfs -o -fstype shfs -o -fstype sysfs -o -fstype cifs -o -fstype lustre_lite -o -fstype tmpfs -o -fstype 
usbfs -o -fstype udf -o -fstype ocfs2 -o -type d -regex \(^/tmp$\)\|\(^/usr/tmp$\)\|\(^/var/tmp$\)\|\ 
(^/afs$\)\|\(^/amd$\)\|\(^/alex$\)\|\(^/var/spool$\)\|\(^/sfs$\)\|\(^/media$\)\|\(^/var/lib/schroot/mount$\) ) - 
prune -o -print0

32282 root      4288 S N  su nobody -s /bin/sh -c /usr/bin/find / -ignore_readdir_race      \( -fstype 
NFS -o -fstype nfs -o -fstype nfs4 -o -fstype afs -o -fstype binfmt_misc -o -fstype proc -o -fstype 
smbfs -o -fstype autofs -o -fstype iso9660 -o -fstype ncpfs -o -fstype coda -o -fstype devpts -o -fstype 
ftpfs -o -fstype devfs -o -fstype mfs -o -fstype shfs -o -fstype sysfs -o -fstype cifs -o -fstype lustre_lite 
-o -fstype tmpfs -o -fstype usbfs -o -fstype udf -o -fstype ocfs2 -o      -type d -regex '\(^/tmp$\)\|\ 
(^/usr/tmp$\)\|\(^/var/tmp$\)\|\(^/afs$\)\|\(^/amd$\)\|\(^/alex$\)\|\(^/var/spool$\)\|\(^/sfs$\)\|\(^/media$\)\|\ 
(^/var/lib/schroot/mount$\)' \) -prune -o -print0
32296 nobody    1632 S N  sh -c /usr/bin/find / -ignore_readdir_race      \( -fstype NFS -o -fstype nfs - 
o -fstype nfs4 -o -fstype afs -o -fstype binfmt_misc -o -fstype proc -o -fstype smbfs -o -fstype autofs - 
o -fstype iso9660 -o -fstype ncpfs -o -fstype coda -o -fstype devpts -o -fstype ftpfs -o -fstype devfs -o 
-fstype mfs -o -fstype shfs -o -fstype sysfs -o -fstype cifs -o -fstype lustre_lite -o -fstype tmpfs -o - 
fstype usbfs -o -fstype udf -o -fstype ocfs2 -o      -type d -regex '\(^/tmp$\)\|\(^/usr/tmp$\)\|\ 
(^/var/tmp$\)\|\(^/afs$\)\|\(^/amd$\)\|\(^/alex$\)\|\(^/var/spool$\)\|\(^/sfs$\)\|\(^/media$\)\|\ 
(^/var/lib/schroot/mount$\)' \) -prune -o -print0
32297 nobody    3968 R N  /usr/bin/find / -ignore_readdir_race ( -fstype NFS -o -fstype nfs -o -fstype 
nfs4 -o -fstype afs -o -fstype binfmt_misc -o -fstype proc -o -fstype smbfs -o -fstype autofs -o -fstype 
iso9660 -o -fstype ncpfs -o -fstype coda -o -fstype devpts -o -fstype ftpfs -o -fstype devfs -o -fstype 
mfs -o -fstype shfs -o -fstype sysfs -o -fstype cifs -o -fstype lustre_lite -o -fstype tmpfs -o -fstype 
usbfs -o -fstype udf -o -fstype ocfs2 -o -type d -regex \(^/tmp$\)\|\(^/usr/tmp$\)\|\(^/var/tmp$\)\|\ 
(^/afs$\)\|\(^/amd$\)\|\(^/alex$\)\|\(^/var/spool$\)\|\(^/sfs$\)\|\(^/media$\)\|\(^/var/lib/schroot/mount$\) ) - 
prune -o -print0

I hope someone can tell me where this jobs are coming from.
The user looks also strange with nobody?

Thanks and best regards,
Stefan

Next time this happens. 32297 is the process id of the current process. 32296 is the process id o the process that started 32297. So show the name of the process that started the find.

Thanks rac8006,

if i try to find the root job, perhaps it is some cron job?

What i did:

root@WDMyCloud root # top
PID  PPID USER     STAT   VSZ %VSZ CPU %CPU COMMAND
5641  5640 nobody   R N   3968  0.7   0 47.9 /usr/bin/find / -ignore_readdir_race ( -fstype NFS -o - 
16555 16554 nobody   R N   5568  1.0   1 46.7 /usr/bin/find / -ignore_readdir_race ( -fstype NFS -o - 

When i search for 5641 or 5640 i only get other finds.
So i did:

root@WDMyCloud root # ps -ef | grep find
5585 root      1632 S N  {updatedb.findut} /bin/sh /usr/bin/updatedb.findutils
5595 root      1632 S N  {updatedb.findut} /bin/sh /usr/bin/updatedb.findutils
5631 root      4288 S N  su nobody -s /bin/sh -c /usr/bin/find / -ignore_readdir_race      \( -fstype NFS 
5640 nobody    1632 S N  sh -c /usr/bin/find / -ignore_readdir_race      \( -fstype NFS -o -fstype nfs -o 
5641 nobody    4000 R N  /usr/bin/find / -ignore_readdir_race ( -fstype NFS -o -fstype nfs -o -fstype  
16497 root      1632 S N  {updatedb.findut} /bin/sh /usr/bin/updatedb.findutils
16508 root      1632 S N  {updatedb.findut} /bin/sh /usr/bin/updatedb.findutils
16545 root      4288 S N  su nobody -s /bin/sh -c /usr/bin/find / -ignore_readdir_race      \( -fstype 
16554 nobody    1632 S N  sh -c /usr/bin/find / -ignore_readdir_race      \( -fstype NFS -o -fstype nfs -
16555 nobody    5568 R N  /usr/bin/find / -ignore_readdir_race ( -fstype NFS -o -fstype nfs -o -fstype 
28195 root      2592 S    grep find

When searching for 1632 i got a lot of jobs started by 1632 but no root job with 1632:
Please see:

root@WDMyCloud root # ps -ef
PID USER       VSZ STAT COMMAND
1 root      2560 S    init
2 root         0 SW   [kthreadd]
3 root         0 SW   [ksoftirqd/0]
5 root         0 SW<  [kworker/0:0H]
7 root         0 SW   [migration/0]
8 root         0 SW   [rcu_bh]
9 root         0 SW   [rcu_sched]
10 root         0 SW   [migration/1]
11 root         0 SW   [ksoftirqd/1]
13 root         0 SW<  [kworker/1:0H]
14 root         0 SW<  [khelper]
15 root         0 SW   [kdevtmpfs]
16 root         0 SW<  [netns]
240 root         0 SW<  [writeback]
242 root         0 SW<  [bioset]
244 root         0 SW<  [kblockd]
252 root         0 SW<  [ata_sff]
262 root         0 SW   [khubd]
271 root         0 SW<  [md]
361 root         0 SW<  [rpciod]
373 root         0 SW   [kswapd0]
374 root         0 SW   [fsnotify_mark]
375 root         0 SW<  [nfsiod]
376 root         0 SW<  [cifsiod]
378 root         0 SW<  [xfsalloc]
379 root         0 SW<  [xfs_mru_cache]
380 root         0 SW<  [xfslogd]
381 root         0 SW<  [crypto]
404 root         0 SW   [ocf_0]
405 root         0 SW   [ocf_ret_0]
406 root         0 SW   [ocf_1]
407 root         0 SW   [ocf_ret_1]
548 root         0 SW   [scsi_eh_0]
551 root         0 SW   [scsi_eh_1]
567 root         0 SW   [spi0]
656 root         0 SW<  [kcryptd]
669 root         0 SW<  [deferwq]
686 root         0 SW   [scsi_eh_2]
692 root         0 SW   [scsi_eh_3]
693 root         0 SW   [usb-storage]
698 root         0 SW   [scsi_eh_4]
699 root         0 SW   [usb-storage]
738 root         0 SW<  [kworker/0:1H]
749 root         0 SW   [jbd2/sda3-8]
750 root         0 SW<  [ext4-dio-unwrit]
753 root         0 SW   [jbd2/sda7-8]
754 root         0 SW<  [ext4-dio-unwrit]
767 root         0 SW<  [loop0]
1012 root         0 SW<  [kworker/1:1H]
1145 root      2528 S    xmldb -n config
1148 root      2240 S    xmldb -n config -s /var/run/xmldb_sock_wto
1201 root      848m S    /usr/local/restsdk/restsdk-server -device-kind alpha
1496 root      2560 S    /sbin/udhcpc -R -r 192.168.69.111 -i egiga0 -x hostname WDMyCloud -p 
1606 root      1920 S    /usr/sbin/syslogd -r -m 0 --rt_line 800
1689 root      2048 S    mserver
1708 root     13920 S    mail_daemon
1758 root         0 SW<  [bioset]
1759 root         0 SW   [md0_raid1]
1774 root         0 SW   [jbd2/sda4-8]
1775 root         0 SW<  [ext4-dio-unwrit]
1782 root      2464 S    noip2 -b -f 34560
1798 root     10880 S    sysinfod
1801 root      2240 S    xmldb -n config -s /var/run/xmldb_sock_sysinfo -p 
1917 messageb  7872 S    /usr/bin/dbus-daemon --system
1920 root      8576 S    avahi-daemon: running [WDMyCloud.local]
2097 root      5120 S    /usr/sbin/sshd -f /etc/ssh/sshd_config
2117 root      1856 S    lld2d egiga0
2207 root      4480 S    set_pwm
2367 root         0 SW   [kworker/1:3]
2473 root         0 SW   [jbd2/sdb1-8]
2474 root         0 SW<  [ext4-dio-unwrit]
2712 root         0 SW   [jbd2/sdc1-8]
2713 root         0 SW<  [ext4-dio-unwrit]
2813 admin    52128 S    smbd -D
2814 root     51488 S    smbd -D
2955 root         0 SW   [jbd2/sdd1-8]
2956 root         0 SW<  [ext4-dio-unwrit]
3302 root      3552 S    sevcd
3392 root     57728 S    httpd -f /usr/local/apache2/conf/httpd.conf -k graceful
3431 root      6976 S    chk_io
3445 root      5120 S    temperature_monitor
3498 root      5056 R    system_daemon
3506 root      7680 S N  /usr/local/orion/communicationmanager/communicationmanager -f 120 -l 5
3544 root      2560 S    init
3836 root         0 SW   [jbd2/sda2-8]
3837 root         0 SW<  [ext4-dio-unwrit]
4078 root      2048 S    /usr/local/twonky/twonkystarter -D -ip 192.168.69.111 -httpport 9000 -appdata /mnt/HD/HD_a2/.twonkymedia -logfile /mnt/HD/HD_a2/.twonkymedia/twonkymedia-log.txt
4080 root     64416 S    /usr/local/twonky/twonkyserver -D -ip 192.168.69.111 -httpport 9000 -appdata /mnt/HD/HD_a2/.twonkymedia -logfile /mnt/HD/HD_a2/.twonkymedia/twonkymedia-log.txt
4208 root     95520 S    upnp_nas_device -webdir /etc/upnp
4225 root         0 SW   [knetatop]
4260 root      3712 S    apkg
4265 root      2560 S    {mysqld_safe} /bin/sh /usr/bin/mysqld_safe --user=root --datadir=/mnt/HD_a4/.@database@
4426 root     27840 S    /usr/libexec/mysqld --basedir=/usr --datadir=/mnt/HD_a4/.@database@ --user=root --log-error=/mnt/HD_a4/.@database@/WDMyCloud.err --pid-file=/mnt/HD_a4/.@database@/WDMyCloud.pid
4521 root     14240 S    /usr/local/bin/wdnotifier
4535 root      177m S    /mnt/HD/HD_a2/Nas_Prog/plexmediaserver/binaries/Plex Media Server
4593 root      107m S N  {Plex Script Hos} Plex Plug-in [com.plexapp.system] /mnt/HD/HD_a2/Nas_Prog/plexmediaserver/binaries/Resources/Plug-ins-e67a4e892/Framework.bundle/Contents/Resources/Versions/2/Python/bootstrap.py --server-version 1.18.2.2058-e67a4e892 /mnt/HD/HD_a2/Nas_Prog/plexmediaserver/binaries/Resources/Plug-ins-e67a4e892/System.bundle
4821 root     49856 S    smbd -D
4823 root     53664 S    smbd -D
4837 root     24576 S    nmbd -D
5002 root      2432 S    /usr/sbin/rpcbind
5007 root         0 SW   [lockd]
5008 root         0 SW   [nfsd]
5009 root         0 SW   [nfsd]
5010 root         0 SW   [nfsd]
5011 root         0 SW   [nfsd]
5012 root         0 SW   [nfsd]
5013 root         0 SW   [nfsd]
5014 root         0 SW   [nfsd]
5015 root         0 SW   [nfsd]
5017 root      2624 S    /usr/sbin/rpc.mountd
5019 root      2240 S    /usr/sbin/rpc.statd
5262 root      4352 S    chk_hotplug
5270 root      2240 S    xmldb -n config -s /var/run/xmldb_sock_usbdev_info
5273 root     52736 S    /mnt/HD/HD_a2/Nas_Prog/plexmediaserver/binaries/Plex Tuner Service /mnt/HD/HD_a2/Nas_Prog/plexmediaserver/binaries/Resources/Tuner/Private /mnt/HD/HD_a2/Nas_Prog/plexmediaserver/binaries/Resources/Tuner/Shared 1.18.2.2058-e67a4e892 32600 /waitmutex
5411 root      4128 S    {cron} /usr/sbin/CRON
5418 root      1632 S    /bin/sh -c test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
5419 root      1568 S    run-parts --report /etc/cron.daily
5577 root      1632 S    {locate} /bin/sh /etc/cron.daily/locate
5585 root      1632 S N  {updatedb.findut} /bin/sh /usr/bin/updatedb.findutils
5595 root      1632 S N  {updatedb.findut} /bin/sh /usr/bin/updatedb.findutils
5596 root      6080 S N  /usr/bin/sort -z -f
5597 root      1632 S N  /usr/lib/locate/frcode -0
5631 root      4288 S N  su nobody -s /bin/sh -c /usr/bin/find / -ignore_readdir_race      \( -fstype NFS -o -fstype nfs -o -fstype nfs4 -o -fstype afs -o -fstype binfmt_misc -o -fstype proc -o -fstype smbfs -o -fstype autofs -o -fstype iso9660 -o -fstype ncpfs -o -fstype coda -o -fstype devpts -o -fstype ftpfs -o -fstype devfs -o -fstype mfs -o -fstype shfs -o -fstype sysfs -o -fstype cifs -o -fstype lustre_lite -o -fstype tmpfs -o -fstype usbfs -o -fstype udf -o -fstype ocfs2 -o      -type d -regex '\(^/tmp$\)\|\(^/usr/tmp$\)\|\(^/var/tmp$\)\|\(^/afs$\)\|\(^/amd$\)\|\(^/alex$\)\|\(^/var/spool$\)\|\(^/sfs$\)\|\(^/media$\)\|\(^/var/lib/schroot/mount$\)' \) -prune -o -print0
5640 nobody    1632 S N  sh -c /usr/bin/find / -ignore_readdir_race      \( -fstype NFS -o -fstype nfs -o -fstype nfs4 -o -fstype afs -o -fstype binfmt_misc -o -fstype proc -o -fstype smbfs -o -fstype autofs -o -fstype iso9660 -o -fstype ncpfs -o -fstype coda -o -fstype devpts -o -fstype ftpfs -o -fstype devfs -o -fstype mfs -o -fstype shfs -o -fstype sysfs -o -fstype cifs -o -fstype lustre_lite -o -fstype tmpfs -o -fstype usbfs -o -fstype udf -o -fstype ocfs2 -o      -type d -regex '\(^/tmp$\)\|\(^/usr/tmp$\)\|\(^/var/tmp$\)\|\(^/afs$\)\|\(^/amd$\)\|\(^/alex$\)\|\(^/var/spool$\)\|\(^/sfs$\)\|\(^/media$\)\|\(^/var/lib/schroot/mount$\)' \) -prune -o -print0
5641 nobody    4000 R N  /usr/bin/find / -ignore_readdir_race ( -fstype NFS -o -fstype nfs -o -fstype nfs4 -o -fstype afs -o -fstype binfmt_misc -o -fstype proc -o -fstype smbfs -o -fstype autofs -o -fstype iso9660 -o -fstype ncpfs -o -fstype coda -o -fstype devpts -o -fstype ftpfs -o -fstype devfs -o -fstype mfs -o -fstype shfs -o -fstype sysfs -o -fstype cifs -o -fstype lustre_lite -o -fstype tmpfs -o -fstype usbfs -o -fstype udf -o -fstype ocfs2 -o -type d -regex \(^/tmp$\)\|\(^/usr/tmp$\)\|\(^/var/tmp$\)\|\(^/afs$\)\|\(^/amd$\)\|\(^/alex$\)\|\(^/var/spool$\)\|\(^/sfs$\)\|\(^/media$\)\|\(^/var/lib/schroot/mount$\) ) -prune -o -print0
5793 106       4960 S    /usr/bin/dbus-daemon --system
5819 root      3232 S    /usr/sbin/cron
5840 105      55968 S    /usr/bin/minidlnad -f /etc/minidlna.conf -P /run/minidlna/minidlna.pid
7141 root         0 SW   [scsi_eh_5]
7142 root         0 SW   [usb-storage]
8183 root         0 SW   [jbd2/sde1-8]
8187 root         0 SW<  [ext4-dio-unwrit]
8539 root      4960 S    scheddler
9703 root         0 SW   [kworker/u4:2]
16324 root      4128 S    {cron} /usr/sbin/CRON
16331 root      1632 S    /bin/sh -c test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
16334 root      1568 S    run-parts --report /etc/cron.daily
16489 root      1632 S    {locate} /bin/sh /etc/cron.daily/locate
16497 root      1632 S N  {updatedb.findut} /bin/sh /usr/bin/updatedb.findutils
16508 root      1632 S N  {updatedb.findut} /bin/sh /usr/bin/updatedb.findutils
16509 root      6080 S N  /usr/bin/sort -z -f
16510 root      1632 S N  /usr/lib/locate/frcode -0
16545 root      4288 S N  su nobody -s /bin/sh -c /usr/bin/find / -ignore_readdir_race      \( -fstype NFS -o -fstype nfs -o -fstype nfs4 -o -fstype afs -o -fstype binfmt_misc -o -fstype proc -o -fstype smbfs -o -fstype autofs -o -fstype iso9660 -o -fstype ncpfs -o -fstype coda -o -fstype devpts -o -fstype ftpfs -o -fstype devfs -o -fstype mfs -o -fstype shfs -o -fstype sysfs -o -fstype cifs -o -fstype lustre_lite -o -fstype tmpfs -o -fstype usbfs -o -fstype udf -o -fstype ocfs2 -o      -type d -regex '\(^/tmp$\)\|\(^/usr/tmp$\)\|\(^/var/tmp$\)\|\(^/afs$\)\|\(^/amd$\)\|\(^/alex$\)\|\(^/var/spool$\)\|\(^/sfs$\)\|\(^/media$\)\|\(^/var/lib/schroot/mount$\)' \) -prune -o -print0
16554 nobody    1632 S N  sh -c /usr/bin/find / -ignore_readdir_race      \( -fstype NFS -o -fstype nfs -o -fstype nfs4 -o -fstype afs -o -fstype binfmt_misc -o -fstype proc -o -fstype smbfs -o -fstype autofs -o -fstype iso9660 -o -fstype ncpfs -o -fstype coda -o -fstype devpts -o -fstype ftpfs -o -fstype devfs -o -fstype mfs -o -fstype shfs -o -fstype sysfs -o -fstype cifs -o -fstype lustre_lite -o -fstype tmpfs -o -fstype usbfs -o -fstype udf -o -fstype ocfs2 -o      -type d -regex '\(^/tmp$\)\|\(^/usr/tmp$\)\|\(^/var/tmp$\)\|\(^/afs$\)\|\(^/amd$\)\|\(^/alex$\)\|\(^/var/spool$\)\|\(^/sfs$\)\|\(^/media$\)\|\(^/var/lib/schroot/mount$\)' \) -prune -o -print0
16555 nobody    5568 R N  /usr/bin/find / -ignore_readdir_race ( -fstype NFS -o -fstype nfs -o -fstype nfs4 -o -fstype afs -o -fstype binfmt_misc -o -fstype proc -o -fstype smbfs -o -fstype autofs -o -fstype iso9660 -o -fstype ncpfs -o -fstype coda -o -fstype devpts -o -fstype ftpfs -o -fstype devfs -o -fstype mfs -o -fstype shfs -o -fstype sysfs -o -fstype cifs -o -fstype lustre_lite -o -fstype tmpfs -o -fstype usbfs -o -fstype udf -o -fstype ocfs2 -o -type d -regex \(^/tmp$\)\|\(^/usr/tmp$\)\|\(^/var/tmp$\)\|\(^/afs$\)\|\(^/amd$\)\|\(^/alex$\)\|\(^/var/spool$\)\|\(^/sfs$\)\|\(^/media$\)\|\(^/var/lib/schroot/mount$\) ) -prune -o -print0
18839 root         0 SW   [kworker/0:2]
20410 root      8192 S    crond
22370 root         0 SW   [kworker/u4:0]
24624 root     62688 S    httpd -f /usr/local/apache2/conf/httpd.conf -k graceful
25653 root      7424 S <  /usr/bin/atop -a -w /var/log/atop/atop_current 60
25799 root         0 SW   [kworker/0:0]
25972 root     62656 S    httpd -f /usr/local/apache2/conf/httpd.conf -k graceful
26441 root     62688 S    httpd -f /usr/local/apache2/conf/httpd.conf -k graceful
26550 root      2624 S N  {openvpn} /bin/bash /usr/sbin/openvpn /usr/local/orion/openvpnclient/client.ovpn
26561 root      5088 S N  /usr/sbin/openvpn.bin /usr/local/orion/openvpnclient/client.ovpn
26572 root         0 SW   [kworker/1:1]
26997 root      4384 S    /usr/bin/rotatelogs -n 2 /var/log/apache2/web_error.log 256K
26999 root      4384 S    /usr/bin/rotatelogs -p /usr/local/sbin/rotateApache.sh -n 2 /var/log/apache2/access.log 200K
27000 root      4384 S    /usr/bin/rotatelogs -p /usr/local/sbin/rotateApache.sh -n 2 /var/log/apache2/access_ssl.log 200K
27406 root         0 Z    [rotateApache.sh]
27448 root      5120 S    sshd: sshd@notty
27458 root      2560 S    sh -c /usr/bin/sftp-server
27459 root      4480 S    /usr/bin/sftp-server
27465 root      8352 S    sshd: sshd@ttyp0
27474 root      2720 S    -sh
27922 root         0 SW   [kworker/1:0]
27962 root         0 SW   [kworker/0:1]
28704 root      8224 R    ps -ef

Any Idea?

Best regards,
Stefan

Ok, i think i found it.
The job was started from the additional debian installation.
It is called locate and does “cron script to update the `locatedb’ database.”
I disabled it, lets see if this helps.

Thanks and best regards,
Stefan