Hi Rob,
You didn't say if you had checked
 /var/log/syslog
Is there anything indicative of the issue there?
The only indexing task I can think of is updatedb for locate, which I think is a cron.daily thing - haven't used Ubuntu for a few years so may be wrong.  
Which filesystem(s)?
Do you have anything like recoll installed?
Best wishes,
Gareth
> On 13 Mar 2023, at 08:03, rmluglist2--- via Hampshire <hampshire@???> wrote:
> 
> 
> Hi all
>  
> I have an Ubuntu box which is on 24/7/365.   It has ufw running allowing nothing from outside my lan.
>  
> A couple of times recently, I’ve come in to find the machine locked up with a lot of disk access (it can be ping’d but I can’t ssh into it and it doesn’t respond to mouse or keyboard on the console – only power cycling brings it back).   As I say, this has now happened twice in the last 3-4 nights.
>  
> It may have been hacked (but I doubt it looking at kern.log and auth.log – and I’m behind a NAT router with no ports open).   Does anyone know if Ubuntu (Jammy) does some indexing or some other regular task overnight?   The reason I ask is I’m wondering if it’s said indexing that’s crashed the (very old) system.   It’s fine for a file server but not really fit for anything else.   Incidentally, I’ve checked crontab and there’s nothing in there.
>  
> Anything else I should be checking?
>  
> Cheers
> Rob
>  
>  
> -- 
> Please post to: Hampshire@???
> Web Interface: https://mailman.lug.org.uk/mailman/listinfo/hampshire
> LUG URL: http://www.hantslug.org.uk
> --------------------------------------------------------------
-- 
Please post to: Hampshire@???
Web Interface: 
https://mailman.lug.org.uk/mailman/listinfo/hampshire
LUG URL: 
http://www.hantslug.org.uk
--------------------------------------------------------------