[OmniOS-discuss] nfsv3rwsnoop.d lists NFS writes to <unknown> files

[Richard Skelton]

Hi Richard,
The nfsv3rwsnoop.d script shows to offset to the write as 0 is this then
not a new file?

TIME(us)         CLIENT             OP OFFSET    BYTES PATHNAME
20811423544560   xxx.xx.xxx.21       W 0           116 <unknown>
20811423525741   xxx.xx.xxx.50       W 0          5232 <unknown>
20811423528311   xxx.xx.xxx.50       W 0           304 <unknown>
20811423529251   xxx.xx.xxx.50       W 0           376 <unknown>
20811423555753   xxx.xx.xxx.18       R 0           685 <unknown>

If they are files which have been deleted they must be very short lived
files ?

Richard Elling wrote:
>
>> On Mar 21, 2017, at 3:54 PM, Richard Skelton <skeltonr at btconnect.com
>> <mailto:skeltonr at btconnect.com>> wrote:
>>
>> Hi,
>> I am using the dtrace script nfsv3rwsnoop.d to find file that are
>> accessed from my OmniOS r151020 filer and some file names are listed
>> as unknown :-(
>> I guess they are files that have been open for a long time and have
>> dropped out of some data structure.
>
> almost... they are files that were open prior to the dtrace script
> running or they are files
> which have been deleted (!), such that there is no mapping between the
> nfs file handle and
> the current file system
>
>> Is there any way to increase the persistence of the name stored.
>> I have lots on memory in this system and would be happy to sacrifice
>> some if I could see more file name :-)
>
> depending on what you wish to accomplish, dtrace might be the wrong
> tool and you might
> want auditing or NFS logging instead 
>  — richard
>
>>
>> root at filer:/scratch# /root/dtrace/nfsv3rwsnoop.d |more
>>
>> 1189849649391    xxx.xx.xxx.59       W 10500    138879 <unknown>
>> 1189849649582    xxx.xx.xxx.59       W 10500    137788 <unknown>
>> 1189849740621    xxx.xx.xxx.118      W 0          2404 <unknown>
>> 1189849781136    xxx.xx.xxx.109      W 19832    756675 /scratch/run.log
>> 1189849849301    xxx.xx.xxx.102      W 1096      57513
>> /scratch/avm_remote_job_f64ccf56-efa1-4605-8a48-874816779289_2.out
>>
>> Cheers
>> Richard
>>
>>
>> _______________________________________________
>> OmniOS-discuss mailing list
>> OmniOS-discuss at lists.omniti.com <mailto:OmniOS-discuss at lists.omniti.com>
>> http://lists.omniti.com/mailman/listinfo/omnios-discuss
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://omniosce.org/ml-archive/attachments/20170322/e3761dfe/attachment-0001.html>