lsof on linux claims to support it .. from the man page<div>:<div> NFS files wonât be listed unless -N is also specified;<br><br></div><div><div> or the local and remote mount point names of an NFS file;</div><div>etc</div>
<div><br></div><div><br></div></div><div>I am mostly running Centos 5.3 but no NFS anywhere to confirm or deny..</div><div><br></div><div><br><div class="gmail_quote">On Thu, May 14, 2009 at 2:45 PM, Dewey Sasser <span dir="ltr"><<a href="mailto:dewey@sasser.com">dewey@sasser.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div class="im">Theo Van Dinter wrote:<br>
> In short, it's usually very difficult unless your server has a way of<br>
> auditing the file operations. They usually keep track of op counts,<br>
> and potentially ops per client, but usually not file paths.<br>
><br>
> At work, we ended up writing a pcap-based sniffer for NFS which would<br>
> watch the traffic and keep track of which files were being accessed.<br>
> The main issue, which I don't recall all the details of, was that<br>
> requests are largely based on file handles and not paths. The program<br>
> had to watch all the traffic and keep track of path->file handle. It<br>
> was further complicated by bonded NICs, and the large number of<br>
> ops/sec that had to be processed, though it worked well enough in the<br>
> end.<br>
><br>
> So the important question is: what NFS server do you use?<br>
><br>
</div>Right now I'm using RedHat 5.3. I'm expecting a Sun 7210 in next week<br>
and I'll migrate to that which allegedly has the file level audit you're<br>
talking about. Alas, my performance sucks right now.<br>
<br>
Alfred suggested lsof, which doesn't do it. My theory is that NFS is a<br>
kernel level service and therefore does not have file handles to list.<br>
<br>
Sean suggested iptraf, which looks cool but I don't see how it relates<br>
to individual paths.<br>
<br>
I was afraid I might have to do this as a sniffer.<br>
<br>
nfswatch is tantalizingly close -- it will tell me the % of traffic to<br>
each exported file systems (which, unfortunately, gives me very little)<br>
and if I had a top 10 list of files already it allegedly would tell me<br>
how much traffic they're getting (unfortunately I have 2800 or so files<br>
to watch).<br>
<br>
<br>
--<br>
<font color="#888888">Dewey<br>
</font><div><div></div><div class="h5"><br>
_______________________________________________<br>
bblisa mailing list<br>
<a href="mailto:bblisa@bblisa.org">bblisa@bblisa.org</a><br>
<a href="http://www.bblisa.org/mailman/listinfo/bblisa" target="_blank">http://www.bblisa.org/mailman/listinfo/bblisa</a><br>
<br>
--<br>
This message has been scanned for viruses and<br>
dangerous content by MailScanner, and is<br>
believed to be clean.<br>
<br>
</div></div></blockquote></div><br></div></div>