Theo Van Dinter wrote: > In short, it's usually very difficult unless your server has a way of > auditing the file operations. They usually keep track of op counts, > and potentially ops per client, but usually not file paths. > > At work, we ended up writing a pcap-based sniffer for NFS which would > watch the traffic and keep track of which files were being accessed. > The main issue, which I don't recall all the details of, was that > requests are largely based on file handles and not paths. The program > had to watch all the traffic and keep track of path->file handle. It > was further complicated by bonded NICs, and the large number of > ops/sec that had to be processed, though it worked well enough in the > end. > > So the important question is: what NFS server do you use? > Right now I'm using RedHat 5.3. I'm expecting a Sun 7210 in next week and I'll migrate to that which allegedly has the file level audit you're talking about. Alas, my performance sucks right now.
Alfred suggested lsof, which doesn't do it. My theory is that NFS is a kernel level service and therefore does not have file handles to list. Sean suggested iptraf, which looks cool but I don't see how it relates to individual paths. I was afraid I might have to do this as a sniffer. nfswatch is tantalizingly close -- it will tell me the % of traffic to each exported file systems (which, unfortunately, gives me very little) and if I had a top 10 list of files already it allegedly would tell me how much traffic they're getting (unfortunately I have 2800 or so files to watch). -- Dewey _______________________________________________ bblisa mailing list [email protected] http://www.bblisa.org/mailman/listinfo/bblisa
