Brian> Have you tried using snoop on your Solaris clients?
Nope, just ethereal, which seems to be a superset of snoop. I could be wrong of course.
Brian> The output (run with no options) includes getattr calls with a Brian> filehandle number, and "LOOKUP3" calls sometimes include a FH# Brian> and a filename. It seems that with the right options, the data Brian> you want is available.
Ethereal gave if filehandle, I just didn't know how to use it. So it's really the LOOKUP() call I need to find/trace when this happens. With my luck, it will be a single file that get's hit a ba-zillion times and I'll only start tracing after the first ga-zillion. *grin*
Brian> You might try capturing packets for a few seconds into a file, Brian> and then using various options until you come across the one Brian> that works for you.
I've tried that with ethereal, capturing a few minutes of data access, but never found a LOOKUP call. But now that I know better to look explicitly for such calls, I can make a more concerted effort.
Thanks for the help.
John