What do people do to track NFS activity on their filers?Basically a real-time audit log on the filer showing NFS calls, file sizes, pathname info, uid, etc. I often run into situations where I can see a filer filling up very quickly (or the snapshot reserve doing the same thing), but no way of figuring who/what is doing it. I could sniff the network for NFS packets and decode them, but it seems the best place to look for this information is on the filer. It can probably make better sense of NFS streams than picking off individual packets.
You can use nfsstat like this:
options nfs.per_client_stats.enable on nfsstat -z
This causes the filer to accumulate per client nfs statistics and nfsstat -z zeroes all counters. Now let the filer run for a little while and run
nfsstat -l
This will give you a summary of total nfs ops by each client since the nfsstat -z. This will allow you to determine which clients are "hot".
To see detailed counts for a particular client, use
nfsstat -h hostname
This will show if the client is doing any writes. You still won't know which files are being written, though.
Steve Losen scl@virginia.edu phone: 434-924-0640
University of Virginia ITC Unix Support