From owner-freebsd-isp@FreeBSD.ORG Wed Apr 12 17:39:18 2006 Return-Path: X-Original-To: freebsd-isp@freebsd.org Delivered-To: freebsd-isp@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 57EA816A403 for ; Wed, 12 Apr 2006 17:39:18 +0000 (UTC) (envelope-from anderson@centtech.com) Received: from mh1.centtech.com (moat3.centtech.com [207.200.51.50]) by mx1.FreeBSD.org (Postfix) with ESMTP id AD40D43D6D for ; Wed, 12 Apr 2006 17:39:15 +0000 (GMT) (envelope-from anderson@centtech.com) Received: from [10.177.171.220] (neutrino.centtech.com [10.177.171.220]) by mh1.centtech.com (8.13.1/8.13.1) with ESMTP id k3CHdDH1052386; Wed, 12 Apr 2006 12:39:14 -0500 (CDT) (envelope-from anderson@centtech.com) Message-ID: <443D3B35.4000906@centtech.com> Date: Wed, 12 Apr 2006 12:39:01 -0500 From: Eric Anderson User-Agent: Thunderbird 1.5 (X11/20060402) MIME-Version: 1.0 To: Francisco Reyes References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: ClamAV 0.87.1/1394/Wed Apr 12 08:45:54 2006 on mh1.centtech.com X-Virus-Status: Clean Cc: FreeBSD ISP Subject: Re: What machine connected to particular nfsd? X-BeenThere: freebsd-isp@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Internet Services Providers List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Apr 2006 17:39:18 -0000 Francisco Reyes wrote: > I had an nfsd proces which was using up all the I/O the machine could > handle. I could kill it, but another nfsd will again will just pickup > the process. > > I am basically trying to tie up the process ID from ps/top to a > particular machine connecting to that particular nfsd daemon. > > So.. figure I start out in top, then "m" to view I/O, then o "total" to > sort.. > > I see an nfsd with let's say a process ID (PID) 419 doing hundreds of > transactions per second.. and vmstat "b" column shows the HDs are > falling behind with nearly 200 transactions pending.. I now want to find > what machine is connected to the nfsd with PID 419 > > My guess is that a program was having problems and was doing lots of > transactions... at the client.. problem is that I don't know which > client machine. > > I tried tcpdump, but that pretty much showed me all the nfs clients. :-( > > Anyone else with NFS servers have had to deal with a rogue client? In > particular finding out which client it is. > > Running FreeBSD 6 Stable as of early january 06. Usually, a tcpdump tells me what I need to know. Usually a spinning nfsd from a client is easily spotted in tcpdump. I think, that since nfsd is using the kernel for all the file opens and such, that you won't get a good list of which files are open by whom, because the kernel owns them. I'm not sure if there is a way to find that information. Eric -- ------------------------------------------------------------------------ Eric Anderson Sr. Systems Administrator Centaur Technology Anything that works is better than anything that doesn't. ------------------------------------------------------------------------