"Find" process is running every morning for five minutes

Question

Hello,
I upgraded to Leopard about a month ago. Not sure if this has been going on the entire time, but for at least the last two weeks, I have noticed that the "find" process is running pretty much every morning when I wake my MacBook Pro from sleep. This is really annoying because it runs for about five minutes as I'm trying to load up apps and get started on work. It brings things to a crawl because of all the disk activity is creates.
As I understand it, the find process should only run very briefly as part of the daily maintenance script. The amount of time it takes for this process to run (again, about 5 minutes) makes me think it's the weekly maintenance script that's running. But then why would that happen daily?
Finally, why is this happening in the morning at all? I thought these scripts were made to run themselves at 3am or something like that. I used to just run them manually from Terminal because I knew my laptop was never awake at 3am. Did the timing get changed with Leopard?
If anyone can shed some light on this, I'd be grateful. It'd be nice to just be running the scripts manually again.

Answer 1

I'm going to guess that the find is simply part of locate's periodic update process - it takes an inventory of files on the disk so that you can find them easily using the locate command.
It might not be, though - there are many other reasons why find may be running.
The trick is to use ps in the terminal along with a couple of switches to reveal the true cause.
In this case ps -axjw is probably what you're looking for. The -j switch tells it to print the processes' PID information, including its parent. You should see something like:
# ps -axjw | grep find
user 22423 22420 22420 44c4618 1 R s003 0:07.27 find -s /
In this case you can see one find process running, PID 22423, launched by user user. In addition, it's parent process is 22420 (the third column), so now you re-run ps asking for that PID via the -p switch:
ps -jwp 22458
USER PID PPID PGID SESS JOBC STAT TT TIME COMMAND
user 22420 21324 21324 44c4618 1 S s003 0:00.03 /bin/sh /usr/libexec/locate.updatedb
So putting this together, the first ps finds the PID and the Parent PID of the find command. The second command finds out what that parent command is. You can repeat the second command to work all the way back up the process tree if you like.