Date: Mon, 24 Sep 2007 23:01:46 -0700 From: Martin Alejandro Paredes Sanchez <mapsware@prodigy.net.mx> To: freebsd-questions@freebsd.org Cc: Albert.Shih@obspm.fr Subject: Re: How to know who use NFS. Message-ID: <200709242301.47193.mapsware@prodigy.net.mx> In-Reply-To: <20070924132121.GG42088@pcjas.obspm.fr> References: <20070920172428.GA90565@pcjas.obspm.fr> <200709230027.15813.mapsware@prodigy.net.mx> <20070924132121.GG42088@pcjas.obspm.fr>
next in thread | previous in thread | raw e-mail | index | archive | help
El Lun 24 Sep 2007, Albert Shih escribi=F3:
> Le 23/09/2007 =E0 00:27:15-0700, Martin Alejandro Paredes Sanchez a =E9c=
rit
> I've two servers :
>
> Server A (NFS) --- NFS -- Server B
>
> On server A there one service is NFS, and server B is it's client.
>
> On server B I've lot of users, some users make very huge transfert throug=
ht
> NFS (what I don't want), huge =3D ~ 10-100 Go in one time (big file).
>
> I want to known who did this, because I've lot of users it's not easy to
> known when I'm using top/ps to known who did this (sometime it's the outp=
ut
> of some scientifique software).
>
> The solution you give me can tell me the name of server B, but this thing=
I
> known it ;-), what I want to known is WHO on server B.
>
Ok, that change the problem, but I think tcpdump is still usefull, only if =
the=20
the problem is caused when a user copy one huge file in one time, this=20
because I assume 1 socket is created for each file copied (I am not an expe=
rt=20
in NFS)
In computer B run this command (piped) as root
tcpdump -c 100 -nq dst port nfs and dst host serverB
nawk 'BEGIN {FS=3D"[ .]"}{print $8}'
nawk '{packets[$1]++} END{for (ip in packets){print packets[ip], ip}}'
sort -rn
In the last line will appear socket number that generate more packets,=20
something like this:
59891
To know who has that socket, run
# sockstat -4c | grep ":59891"
USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS
martin kdeinit 1173 9 tcp4 192.168.45.25:59891 192.168.45.43:2049
The first column is the user, lets see what is doing
# ps -wxU martin
>
> Do you think I need to use dark side of the force....I known it's not more
> powerful, but it's more easy ;-)
>
You mean windows (for the easy), NNOOOO.
If the problem is caused, because the user is copying a folder
cp ~/MySmallFiles/* /serverB/dest/
maybe, each file will create a different socket, because of that, you will=
=20
need to translate each socket to a user before counting the packets, I thin=
k=20
that is a job for perl, phyton or something like that.
maps
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200709242301.47193.mapsware>