Which files are being accessed? - NFS

This is a discussion on Which files are being accessed? - NFS ; Hello all, I'm seeing a continuous read via NFS from my Linux workstation. Could somebody tell me how to find out which files are being accessed? I monitor network packets and know which client is reading my files. Unfortunately, I ...

+ Reply to Thread
Results 1 to 6 of 6

Thread: Which files are being accessed?

  1. Which files are being accessed?

    Hello all,

    I'm seeing a continuous read via NFS from my Linux workstation.
    Could somebody tell me how to find out which files are being
    accessed?

    I monitor network packets and know which client is reading my
    files. Unfortunately, I don't have a root account on the
    client machine (a Sun workstation). I guess the i-node numbers
    or something of the files being accessed are contained in those
    NFS packets, but I don't know where to find them within the
    packets.

    Ryo


  2. Re: Which files are being accessed?


    "Ryo" wrote in message
    news:1141695298.549958.290090@e56g2000cwe.googlegr oups.com...
    > Hello all,
    >
    > I'm seeing a continuous read via NFS from my Linux workstation.
    > Could somebody tell me how to find out which files are being
    > accessed?
    >
    > I monitor network packets and know which client is reading my
    > files. Unfortunately, I don't have a root account on the
    > client machine (a Sun workstation). I guess the i-node numbers
    > or something of the files being accessed are contained in those
    > NFS packets, but I don't know where to find them within the
    > packets.
    >
    > Ryo
    >


    Ryo,

    On the server..

    1. ethereal... capture network activity.
    2. Find the NFS open of the file. Grab the filename here.
    3. Look back at the TCP information and find the IP
    address of the client.
    4. nslookup (or dig) the IP address, to find the client's name.

    Enjoy,
    Postmaster



  3. Re: Which files are being accessed?

    Begin <1141695298.549958.290090@e56g2000cwe.googlegroups. com>
    On 2006-03-07, Ryo wrote:
    > I'm seeing a continuous read via NFS from my Linux workstation.
    > Could somebody tell me how to find out which files are being
    > accessed?


    On some systems there's fstat. Your linux might have lsof instead.


    > I monitor network packets and know which client is reading my
    > files. Unfortunately, I don't have a root account on the
    > client machine (a Sun workstation).


    If you have root on your linux box, you could unexport the mount.
    If not, and the nfs traffic is causing you trouble, it's time to
    talk to whoever does have root.


    --
    j p d (at) d s b (dot) t u d e l f t (dot) n l .
    This message was originally posted on Usenet in plain text.
    Any other representation, additions, or changes do not have my
    consent and may be a violation of international copyright law.

  4. Re: Which files are being accessed?

    Postmaster wrote:
    [...]
    > On the server..
    >
    > 1. ethereal... capture network activity.
    > 2. Find the NFS open of the file. Grab the filename here.


    Thank you for your response! I tried a few times
    but I could only catch intermediate packets, not the initial
    "NFS open". So, all information I get from ethereal is
    something like

    Network File System, READ Call FH:0x03929da0 Offset:102088704
    Len:32768

    I think my problem will be solved if there is a way to find out
    the correspondence between files and filehandles (FH). Who has
    the information? nfsd?

    Cheers,
    Ryo


  5. Re: Which files are being accessed?

    jpd wrote:
    > Begin <1141695298.549958.290090@e56g2000cwe.googlegroups. com>
    > On 2006-03-07, Ryo wrote:
    > > I'm seeing a continuous read via NFS from my Linux workstation.
    > > Could somebody tell me how to find out which files are being
    > > accessed?

    >
    > On some systems there's fstat. Your linux might have lsof instead.


    Yes, I do find lsof, but I'm wondering how to use it. I tried

    # lsof -c nfs

    assuming that it's nfsd who opens the file to share with
    the NFS client(s). I seem to be wrong, as the above command shows
    that nfsd's don't open target files. . . .

    > > I monitor network packets and know which client is reading my
    > > files. Unfortunately, I don't have a root account on the
    > > client machine (a Sun workstation).

    >
    > If you have root on your linux box, you could unexport the mount.
    > If not, and the nfs traffic is causing you trouble, it's time to
    > talk to whoever does have root.


    Thanks for the advice. Currently, it's not a trouble. I just
    want to know which files are being read.

    Ryo


  6. Re: Which files are being accessed?

    The FH is opaque. There is no utilities to translate that to filename,
    afaik. And most NFS ops are done via FH unfortunately.

    There are a few appliances out there (one that comes to mind is NeoPath
    Networks) providing online file access info, plus ability to query past
    access frequency (who accessed what when).


+ Reply to Thread