What do people do to track NFS activity on their filers? Basically a real-time audit log on the filer showing NFS calls, file sizes, pathname info, uid, etc. I often run into situations where I can see a filer filling up very quickly (or the snapshot reserve doing the same thing), but no way of figuring who/what is doing it. I could sniff the network for NFS packets and decode them, but it seems the best place to look for this information is on the filer. It can probably make better sense of NFS streams than picking off individual packets.
On a related note, are there any utilities available for more granular reporting on snapshot usage? Like being able to tell which file or directory or uid is occupying what percentage of the snapshot reserve? This wasn't possible a few years ago, but I figure the smart Netapp engineers would have thought of something since then. ;-)