I can see high net traffic between internet and my pi box which run osmc. just do nothing . if I active the screen the traffic goes down .It can see data income and outcome over the internet (by sudo iftop ).
Someone access my local disk ???
How can I find which script run at the background ?
I will kill and remove it.
I suggest you enable debugging and provide logs. If the activity comes from within Kodi the log is the only way to see what’s happening as from a process point of view only Kodi will be visible.