You can turn on NFS auditing with the sharenfs option "rw=host1:host2,log". Audit logs are in /var/nfs. I believe there's a bit of setup in /etc/nfs/nfslog.conf and /etc/default/nfslogd, but I think I'm running fine off of defaults. This only works for NFSv3. NFSv4 won't log.
-- Cameron Hanover chano...@umich.edu "Giving money and power to the government is like giving whiskey and car keys to teenage boys." --P.J. O'Rourke On Jun 17, 2010, at 8:56 AM, Edward Ned Harvey wrote: > When somebody is hammering on the system, I want to be able to detect who's > doing it, and hopefully even what they're doing. > > > > I can't seem to find any way to do that. Any suggestions? > > > > Everything I can find ... iostat, nfsstat, etc ... AFAIK, just show me > performance statistics and so forth. I'm looking for something more > granular. Either *who* the activity belongs to, or *what* files are active > (which might indirectly let me figure out who) ... etc. > > > > If it makes the problem any easier (or harder) all the access is coming > across NFS. And maybe a little CIFS. > > > > _______________________________________________ > zfs-discuss mailing list > zfs-discuss@opensolaris.org > http://mail.opensolaris.org/mailman/listinfo/zfs-discuss _______________________________________________ zfs-discuss mailing list zfs-discuss@opensolaris.org http://mail.opensolaris.org/mailman/listinfo/zfs-discuss
