Sometimes it seems like an incremental crawl can take forever. On our farm, an incremental crawl usually takes 1 to 3 hours, but yesterday it took over 26 hours to complete.
When I noticed that it had been running for about 10 hours, I got concerned and started investigating. Looking on the Search Administration screen showed no obvious problems. The crawl log had many successful entries from several hours earlier but nothing from the previous seven hours. The event logs and ULS logs turned up nothing. I started searching on the Internet and found a very helpful blog by Russ Maxwell at Microsoft that introduced me to the "Security-Only-Crawl".
A security-only-crawl is a crawl that takes place after members are added or removed from SharePoint groups. These ACL changes need to be propagated down through the affected documents in the index. In sites with a lot of content, this propagation can take hours.
Although there is no easy way to confirm that your "stuck" crawl is a security-only-crawl, being aware of the possibility can prevent you from taking a drastic measure like stopping the crawl.
Knowing that group membership changes had been recently made to sites with several gigabytes of content, I let the crawl continue and after 26 hours it was done.
If you are not sure whether group membership changes have been made, the linked blog entry describes how to find this information by querying the Eventcache table in the content database.
Many thanks to Russ Maxwell for saving me from killing by crawl and requiring an resource intensive full crawl.
