who's been writing to my NFS mount? - NFS

This is a discussion on who's been writing to my NFS mount? - NFS ; Senario: the same directory /production - mounted out to a 100 hpux boxes. The intention was to have this mount point be "read only", since it houses mainly binaries. Recently we found lots of cases of applications writing log files ...

+ Reply to Thread
Results 1 to 4 of 4

Thread: who's been writing to my NFS mount?

  1. who's been writing to my NFS mount?

    Senario: the same directory /production - mounted out to a 100 hpux
    boxes.
    The intention was to have this mount point be "read only", since it
    houses mainly binaries. Recently we found lots of cases of
    applications writing log files locally on the mount. But 95 GIGs on
    /production and a 100 boxes makes for a hard time tracking down the
    offending applications.

    Question: Is there any way to trace and find which files are created
    on the /production mount. Since each app has its own directory, the
    guilty will show itself purely by the filename. I do not really want
    to know who reads - that's the intended use .. I am trying to find the
    writers!

    PS: My real title is unix geek, but sometimes I reluctantly have to
    solve windows problems. Don't hold that against me - hold it against
    Bill. (as in www.sorrybill.com)

  2. Re: who's been writing to my NFS mount?

    gemors@change-it.com (reluctantwinadmin) wrote in message news:...
    > Senario: the same directory /production - mounted out to a 100 hpux
    > boxes.
    > The intention was to have this mount point be "read only", since it
    > houses mainly binaries. Recently we found lots of cases of
    > applications writing log files locally on the mount. But 95 GIGs on
    > /production and a 100 boxes makes for a hard time tracking down the
    > offending applications.
    >
    > Question: Is there any way to trace and find which files are created
    > on the /production mount. Since each app has its own directory, the
    > guilty will show itself purely by the filename. I do not really want
    > to know who reads - that's the intended use .. I am trying to find the
    > writers!


    There is tracing /logging in the
    Solaris NFS server. The NetApp NFS server will also
    let you display NFS statistics on a per NFS client
    basis ... that client that is issuing operations that
    write to the file system would be the give away.

    Also, most NFS servers allow you to export directories read-only,
    or to give some clients write access and the rest read-only.

    >
    > PS: My real title is unix geek, but sometimes I reluctantly have to
    > solve windows problems. Don't hold that against me - hold it against
    > Bill. (as in www.sorrybill.com)


  3. Re: who's been writing to my NFS mount?

    Unfortunately I'm on HPUX. We tried kernel logging, but that was not
    very useful. I read something somewhere about using tcpdump maybe, but
    I was hoping somebody here would have a better handle on what
    information can be obtained tracing where. I'm pretty much feeling
    around in the dark here.

  4. Re: who's been writing to my NFS mount?

    gemors@change-it.com (reluctantwinadmin) wrote in message news:...
    > Unfortunately I'm on HPUX. We tried kernel logging, but that was not


    HPUX has no way to export file systems read only?

    > very useful. I read something somewhere about using tcpdump maybe, but


    Use ethereal or tethereal. Chapter 13 of our book Managing NFs and
    NIS has a good overview of it with an NFS-centric view. There's
    lots free documentation on it as well.

    If your NFS clients are using TCP, then run netstat on the server
    to see which NFS client have connections to the serve'rs NFS port (2049).

    > I was hoping somebody here would have a better handle on what
    > information can be obtained tracing where. I'm pretty much feeling
    > around in the dark here.


+ Reply to Thread