linux mint - unexplained wifi activity – 3.5.2021

[annevejb]

3.5.2021 I was doing simple home audiovisual activity, watching video. Just late afternoon I noticed that wifi had been active for maybe 25 minutes, when I had not been doing anything wifi related.

I assume that there will be log files that I can look at that might explain what has been going on to a very in the know linux user, are there any that would be useful to a lowish skilled linux user?

Is there a log file that lists external web sources that my machine might have been active with? This is nothing that appears on the Firefox history file.

[DAMIEN1307]

Just late afternoon I noticed that wifi had been active for maybe 25 minutes, when I had not been doing anything wifi related.

What made you think that "Psensor" was saying anything about wifi usage ???

All Psensor does is measure temperatures in various hardware components...it is a Temperature Monitor, not a wifi monitor...DAMIEN

[rene]

What made you think that "Psensor" was saying anything about wifi usage ???

I expect due to the red graph being "wifi_temp" according to the legend. Which wouldn't be to say that I'd have thought that a WiFi chip even had its own private temperature sensor, but oh well, if he/she says so...

[annevejb]

The sensor labeled WiFi relates to the WiFi on the TUF X570 WiFi board. Nice that this appears in Psensor.

The sensor normally gives a flat reading of around 3xC when WiFi is not in use. The final readings show what I usually experience as temperature increase related to normal WiFi use, ending with connecting to the Mint site and preparing this posting.

The earlier temperate peak is different. It is constantly high over maybe 25minutes. I assume that a download could cause that sort of power use, but I was watching a video and nowhere near the controls. Normally I prefer to disable WiFi when it is not in use, but it is enabled by default at bootup and this time I forgot to disable it.

[rene]

25 minutes seems long but certainly it's the case that e.g. Mint's Update Manager checks for updates every few hours by default. There isn't a very centralized log to look at for the general question no, likely unless you configure a firewall to log. journalctl -b has in this sense the advantage of being an indiscriminate info-dump so maybe you can relate times in it to your question.

[annevejb]

Thanks. journalctl -b only shows my current log in. I guess this sort of problem needs looking into before power off.

Further the 25 minutes is of continuous activity, likely a download, on optical broadband. That would be a lot of file. Mint update also tends to be faster than that. Is it wrong to guess that typical malware activity would be less than that too?

[rene]

I'd have absolutely no idea: no such thing as "typical malware activity" exists on Linux. Yes, that -bswitch explicitly limits display to the current boot. Leave it out and be even further deluged with information...

[annevejb]

Ahh:
sudo journalctl -S "2021-05-03"

session starts at 15:54:01

At around the start of the activity there is:
May 03 17:16:32 Mint-PMagic NetworkManager[985]: <info> [1620058592.9891] manager:>
May 03 17:16:32 Mint-PMagic dbus-daemon[979]: [system] Activating via systemd: serv>
May 03 17:16:32 Mint-PMagic systemd[1]: Starting Network Manager Script Dispatcher >
May 03 17:16:32 Mint-PMagic dbus-daemon[979]: [system] Successfully activated servi>
May 03 17:16:32 Mint-PMagic systemd[1]: Started Network Manager Script Dispatcher S>
May 03 17:16:34 Mint-PMagic NetworkManager[985]: <info> [1620058594.3796] manager:>
May 03 17:16:45 Mint-PMagic systemd[1]: NetworkManager-dispatcher.service: Succeede>


So a script started the process. To take that further seems to involve a scary amount of skills?

This is now way beyond my level, but gratitude. Interesting.

[rene]

The width of your terminal meant those lines being cut off before actually saying what was being launched, so I'm afraid I can't from this say anything more --- even though I probably also couldn't when I do see more as for now this is looking generic.