[BBLISA] NFS: How can I see which files are in use?

[Dewey Sasser]

Theo Van Dinter wrote:
> In short, it's usually very difficult unless your server has a way of
> auditing the file operations.  They usually keep track of op counts,
> and potentially ops per client, but usually not file paths.
>
> At work, we ended up writing a pcap-based sniffer for NFS which would
> watch the traffic and keep track of which files were being accessed.
> The main issue, which I don't recall all the details of, was that
> requests are largely based on file handles and not paths.  The program
> had to watch all the traffic and keep track of path->file handle.  It
> was further complicated by bonded NICs, and the large number of
> ops/sec that had to be processed, though it worked well enough in the
> end.
>
> So the important question is: what NFS server do you use?
>   
Right now I'm using RedHat 5.3.  I'm expecting a Sun 7210 in next week
and I'll migrate to that which allegedly has the file level audit you're
talking about.  Alas, my performance sucks right now.

Alfred suggested lsof, which doesn't do it.  My theory is that NFS is a
kernel level service and therefore does not have file handles to list.

Sean suggested iptraf, which looks cool but I don't see how it relates
to individual paths.

I was afraid I might have to do this as a sniffer.

nfswatch is tantalizingly close -- it will tell me the % of traffic to
each exported file systems (which, unfortunately, gives me very little)
and if I had a top 10 list of files already it allegedly would tell me
how much traffic they're getting (unfortunately I have 2800 or so files
to watch).


--
Dewey