On Mon, 9 Jun 2003, Steve Losen wrote:
To see detailed counts for a particular client, use
nfsstat -h hostname
This will show if the client is doing any writes. You still won't know which files are being written, though.
Yeah, that's what I'm doing right now... per-client NFS stats to see which one is obviously generating a lot of requests, then investigating the network traffic and processes on that client. This is pretty hit-and-miss though, especially on filers that service dozens or hundreds of clients. It also difficult to detect unlinks of large files that could cause snapshots to blow up (since the actual number of NFS ops can be extremely low).
I'd love to see an audit log that might looks like this:
2003:06:09:23:12:45.413 192.168.100.4 e3a getattr /vol/vol0/home/taob/.bashrc 32 2003:06:09:23:12:45.445 192.168.100.4 e3a read /vol/vol0/home/taob/.bashrc 4104
... etc. Timestamp, client IP, filer interface on which the request was received, NFS call, argument(s), size of request. Obviously, with filers hitting 30000+ ops/sec, there needs to be some sort of filtering mechanism to only log certain clients or certain interfaces or certain syscalls.