[OmniOS-discuss] nfsv3rwsnoop.d lists NFS writes to <unknown> files

[Richard Elling]

> On Mar 22, 2017, at 12:54 AM, Richard Skelton <skeltonr at btconnect.com> wrote:
> 
> Hi Richard,
> The nfsv3rwsnoop.d script shows to offset to the write as 0 is this then not a new file?

not necessarily

> TIME(us)         CLIENT             OP OFFSET    BYTES PATHNAME
> 20811423544560   xxx.xx.xxx.21       W 0           116 <unknown>
> 20811423525741   xxx.xx.xxx.50       W 0          5232 <unknown>
> 20811423528311   xxx.xx.xxx.50       W 0           304 <unknown>
> 20811423529251   xxx.xx.xxx.50       W 0           376 <unknown>
> 20811423555753   xxx.xx.xxx.18       R 0           685 <unknown>
> If they are files which have been deleted they must be very short lived files ?

not necessarily

If you want auditing, you need auditing tools and dtrace is not the right tool
 -- richard

> 
> Richard Elling wrote:
>> 
>> 
>>> On Mar 21, 2017, at 3:54 PM, Richard Skelton <skeltonr at btconnect.com <mailto:skeltonr at btconnect.com>> wrote:
>>> 
>>> Hi,
>>> I am using the dtrace script nfsv3rwsnoop.d to find file that are accessed from my OmniOS r151020 filer and some file names are listed as unknown :-(
>>> I guess they are files that have been open for a long time and have dropped out of some data structure.
>> 
>> almost... they are files that were open prior to the dtrace script running or they are files
>> which have been deleted (!), such that there is no mapping between the nfs file handle and
>> the current file system
>> 
>>> Is there any way to increase the persistence of the name stored.
>>> I have lots on memory in this system and would be happy to sacrifice some if I could see more file name :-)
>> 
>> depending on what you wish to accomplish, dtrace might be the wrong tool and you might
>> want auditing or NFS logging instead 
>>  — richard
>> 
>>> 
>>> root at filer:/scratch# /root/dtrace/nfsv3rwsnoop.d |more
>>> 1189849649391    xxx.xx.xxx.59       W 10500    138879 <unknown>
>>> 1189849649582    xxx.xx.xxx.59       W 10500    137788 <unknown>
>>> 1189849740621    xxx.xx.xxx.118      W 0          2404 <unknown>
>>> 1189849781136    xxx.xx.xxx.109      W 19832    756675 /scratch/run.log
>>> 1189849849301    xxx.xx.xxx.102      W 1096      57513 /scratch/avm_remote_job_f64ccf56-efa1-4605-8a48-874816779289_2.out
>>> Cheers
>>> Richard
>>> 
>>> 
>>> _______________________________________________
>>> OmniOS-discuss mailing list
>>> OmniOS-discuss at lists.omniti.com <mailto:OmniOS-discuss at lists.omniti.com>
>>> http://lists.omniti.com/mailman/listinfo/omnios-discuss <http://lists.omniti.com/mailman/listinfo/omnios-discuss>
>> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://omniosce.org/ml-archive/attachments/20170322/88a8f8f8/attachment.html>