Strange AutoMount behavior

[JJ Neff]

It's happened enough, this time I knew just what was happening.
Soe of you may recall I lost my machine for a time because my /var/log ate up
all my HD, I moved /var/log to its own partition and it's been fine.  THe thing
that was filling it up was that an attempt was being made (ususally overnight)
to mount /home/jjnlocal and since automount was running it tried to go to
<server>/export/home/jjnlocal and mount it on <localmachine>/home/jjnlocal. 
THe problem is that jjnlocal was a local account to localmachine.  It did not
exist onthe server or in NIS maps.  SO the messages and daemons or syslogs
files grew unitl they filled up the HD.  I moved /var/log and removed jjnlocal
account from the localmachine.

Well the symptom is constant activity on the Harddrives (a scratching every 2
seconds) and constant network activity.  SO when I got up this morning and saw
those things I immediately did tail -f var/log/messages on the server and
localmachine and saw a constant write to each every second wanting to mount
(GET THIS) /home/.directory(the . was in the actual mount command!).  Now
"jjnlocal" I could see causing a problem since maybe some cron job checks or
updatedb's every home dir of every user listed in passwd file, but trying to
mount a home/.directory that was too much!

I did a ps-ef and saw that there was one rogue autofs process that had spawned
another that was trying the mount command over and over, every 2 seconds the
process ID changed as the current moutn failed, it wrote an error everywhere
then respawn mount process.  I finally killed the parent autofs process (that
only killed the run away mount not any of my current mounted real folders)  and
the activity immediately ceased.

THe obvious question is how do I search for processes, cron jobs, apps etc that
are trying to go to /home/.directory or other odd directories causing this
problem in the first place?


I was lucky to find the process that was obviosuly causing the problem but I
could not figure out how to find the trigger that initiated the attempted
autofs mount in the first place.
Thanks

JJN

__________________________________
Do you Yahoo!?
The New Yahoo! Shopping - with improved product search
http://shopping.yahoo.com