Having a NAS with mechanical disks and a door open to your bedroom because of the heatwave may be problematic during the night if the disks spin up and start crunching. In my case, the crunching noise happens every day at 8:00. Ok, maybe I like to sleep in and not hear crrrrr-crrrr-clack-clack as a wake-up call. Time to find the culprit. Since the NAS is running a vanilla Ubuntu and the disks are used only for cold storage, I kind-of know why they spin up each time they do. Most likely some cron process is running at 8:00 and interrogating the disks. Checking the crontab, all user's crontab, /etc/crontab, /etc/cron.d/* doesn't show anything obvious starting at 8:00. There could be some long-term running process which decides to index something at 8 o'clock, or there could be some external process on some other server that uses NFS or SSH to access some data on the NAS. I decided to learn something new and use auditd to monitor file access to my /media/wdc mountpoint at 8