Who mounted a specific nfs export?

[cschnidr]

Is it somehow possible to see (on the controller) who mounted a specific export?

I looked already into client stats (nfsstats), File auditing (using an NTFS qtree) and locks. None of it is providing the simple information of: who/what machine mounted a specific export.

Thanks

[ekashpureff]

Take a look at your syslog for command line authentication.

(/etc/messages)

You'd get mount traces in /etc/messages if you enable:

nfs.mountd.trace on

But it's turned off by default.

Also take a look at your audit log - /etc/log/auditlog

(grep for 'exportfs' commands or API calls)

Ooops - who mounted ?

see:

/etc/rmtab

(that's what I get for answerring too quickly!)

Hope this has been helpful.

At your service,

Eugene E Kashpureff

Message was edited by: Eugene Kashpureff

[lovik_netapp]

Thanks Eugene, I was looking for this answer since a long time. Can you please suggest what is the format of this rmtab is? I mean when I look inside it,

First, it doesn't list all my exports (might be not all of them are mounted)

Second, It's not in proper readable format, see the sample below.

test01> rdfile /etc/rmtab

ootQtreevol/CME2_VOT_RAC1/RootQtree10.21.246.20:/vol/CME2_DataKenn_RAC1/RootQtreeRootQtreeDT_VMTb/RootQtreevol/CME_DT_VMTb/RootQtreeb/RootQtreeT_VMCore2/RootQtree:/vol/CME_DT_VMTb/RootQtree1.246.12:/vol/CME_DT_VMTb/RootQtreeootQtreeMCore1/RootQtreeCME_DT_VMCore2/RootQtree28:/vol/CME_DT_VMCore2/RootQtree

test01>

[ekashpureff]

'rmtab' isn't meant to be in a very readable format, it's for the system to know what mounts are current.

You may get a better view of it by using 'cat from a Unix host. You could just run 'showmount' from a unix host:

[root@localhost ~]# showmount -a sim1
All mount points on sim1:
192.168.222.138:/vol/vol0
simhost:/vol/vol0

I had been uder the impression that nfs.mountd.trace would log to syslog, but it doesn't:

nfs.mountd.trace
When enabled, all mount requests are logged. This option is intended to help debug denied mount requests.    Valid values for this option are on (enabled) or off (disabled). The default value for this option is off to avoid too many messages. The output is stored in /mountd_trace.log and can be translated by the mountd_trace.pl program. This program can be found on the NOW site. Turning the option on clears the log file and starts the logging process. Since the logs are kept in memory, the option needs to be turned off to flush the logs to the file.

Hrrrm, that could chew through some memory fast with a lot mounting going on ...

Hope this has been helpful.

At your service,

Eugene Kashpureff

[alexandernow]

1.
Use the nfsstat -l command to view a list of clients.
Enable NFS per client statistics collecting:

options nfs.per_client_stats.enable on

Note:
As do other statistics gathering tools, the nfs.per_client_ stats.enable usually causes an unnoticable performance reduction, however if you do experience an unacceptable performance reduction,
simply disable the option:
options nfs.per_client_stats.enable off

Enter nfsstat -l to view all NFS clients connected to the filer.

Use nfsstat -z to zero the statistics if you prefer.
         
When finished viewing/collecting statistics enter options nfs.per_client_stats.enable off.

2.
Use the NTAPTOP script. The following link has instructions for downloading and using NTAPTOP:

http://now.netapp.com/NOW/download/tools/ntaptop/

  
3.
From most UNIX hosts, you can run the command showmount [-a] [filer_name]

[Damian_Bento]

Hello Guys !!
Just in case, whether nfsstat -l doesn't work, that because you're not pointing to the vfiler!!

Enable the NFS statics

options nfs.per_client_stats.enable on

NOTE:

Usually this options Should not remain ON , because causes an performance reduction, Please change it to OFF when you finish.

options nfs.per_client_stats.enable off

In order to reset counters:
houston>vfiler run vfiler0 nfsstat -Z

check the counters

houston>vfiler run vfiler0 nfsstat -l

===== vfiler0
10.10.39.94    <hostname unknown>              NFSOPS = 7619495490 ( 6%)
10.10.39.87    <hostname unknown>              NFSOPS = 6584754022 ( 6%)
10.10.39.132   <hostname unknown>              NFSOPS = 6237180171 ( 5%)
10.10.39.133   <hostname unknown>              NFSOPS = 6042870027 ( 5%)
10.10.39.109   <hostname unknown>              NFSOPS = 5908596906 ( 5%)
10.10.39.95    <hostname unknown>              NFSOPS = 5642469887 ( 5%)
10.10.75.14    <hostname unknown>              NFSOPS = 5443117694 ( 5%)
10.10.75.83    <hostname unknown>              NFSOPS = 5266907492 ( 4%)
10.10.39.86    <hostname unknown>              NFSOPS = 5106117937 ( 4%)
10.10.39.113   <hostname unknown>              NFSOPS = 4827791858 ( 4%)
10.10.75.12    <hostname unknown>              NFSOPS = 4165148144 ( 4%)
10.10.75.10    <hostname unknown>              NFSOPS = 3855743298 ( 3%)
10.10.39.112   <hostname unknown>              NFSOPS = 3717911586 ( 3%)
10.10.39.111   <hostname unknown>              NFSOPS = 3023359968 ( 3%)
10.10.75.17    <hostname unknown>              NFSOPS = 3011651246 ( 3%)
10.10.39.127   <hostname unknown>              NFSOPS = 2038641973 ( 2%)

Regards