System Administration & Network Administration
debian cron process
Updated Tue, 13 Sep 2022 06:59:39 GMT

Odd process appearing about every 18-20 minutes that runs 'apt-get --just-print dist-upgrade'


Got this process running on a 4 core Virtual Machine server running Debian 11 that pops up about every 20 minutes:

/usr/bin/apt-get --just-print dist-upgrade

...and I'd like to stop it as this VM server is really not meant to be upgraded, certainly not every 20 minutes! At the most it sucks down a whole core at 100% for about 20-30 seconds while I'm trying to run other services or intense grep/find searches through various files.

Unattended upgrades is not installed, there is no service running for apt or cron-apt or unattended-upgrades, I find no entry in cron-apt that has 'just-print' as an option and 'dist-upgrade' entries in cron-apt are disabled, and there are no cron entries running every 20 minutes. Oh, and nothing appears regarding dist-upgrade in the history log for apt.

cron-apt documentation isn't much help - there isn't even mention of the 'just-print' option, so I do not currently think it is a cron-apt issue.

I'm a bit perplexed. Any tips on where to look for this entry and disable it are greatly appreciated.

Solution

Thanks to @Halfgaar, using pstree when the process reappeared revealed its parents, and as a result I could use that info to find what was running that command.

cims@cimsserver:/home/cims$ pstree -p -s
systemd(1)PM2 v4.2.3: God(1082){PM2 v4.2.3: God}(1083)
                                  {PM2 v4.2.3: God}(1084)
                                  {PM2 v4.2.3: God}(1085)
                                  {PM2 v4.2.3: God}(1086)
                                  {PM2 v4.2.3: God}(1087)
                                  {PM2 v4.2.3: God}(1088)
                                  {PM2 v4.2.3: God}(1318)
                                  {PM2 v4.2.3: God}(1319)
                                  {PM2 v4.2.3: God}(1320)
                                  {PM2 v4.2.3: God}(1321)
           VGAuthService(541)
           agetty(966)
           bash(558872)apt.sh(558874)apt.sh(558877)apt-get(558879)
                                                          awk(558880)
                                                          awk(558883)
                                                          sort(558881)
                                                          uniq(558882)
                         sponge(558875)

That last apt-get caught my eye (as it was the only thing running while I was watching htop), and finding the apt.sh file that was using it led me to the shell script that was running that command.

cims@cimsserver:/home/cims$ locate apt.sh
/usr/share/prometheus-node-exporter-collectors/apt.sh

Which turned out to be a Prometheus script that was meant to expose metrics from apt updates and gets sent to my Grafana server - just never used.

Thanks again to @Halfgaar for the pstree tip. Saved me some headaches. :)

Comments (4)


References