<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Mar 22, 2017, at 12:54 AM, Richard Skelton <<a href="mailto:skeltonr@btconnect.com" class="">skeltonr@btconnect.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type" class="">
<div bgcolor="#ffffff" text="#000000" class="">
Hi Richard,<br class="">
The nfsv3rwsnoop.d script shows to offset to the write as 0 is this
then not a new file?<br class=""></div></div></blockquote><div><br class=""></div><div>not necessarily</div><br class=""><blockquote type="cite" class=""><div class=""><div bgcolor="#ffffff" text="#000000" class=""><p class="MsoNormal"><span style="font-family: "Courier New";" class="">TIME(us)
CLIENT OP OFFSET BYTES PATHNAME<o:p class=""></o:p><br class="">
20811423544560 xxx.xx.xxx.21 W 0 116 <unknown><o:p class=""></o:p><br class="">
20811423525741 </span><span style="font-family: "Courier New";" class="">xxx.xx.xxx</span><span style="font-family: "Courier New";" class="">.50 W 0 5232
<unknown><o:p class=""></o:p><br class="">
20811423528311 </span><span style="font-family: "Courier New";" class="">xxx.xx.xxx</span><span style="font-family: "Courier New";" class="">.50 W 0 304
<unknown><o:p class=""></o:p><br class="">
20811423529251 </span><span style="font-family: "Courier New";" class="">xxx.xx.xxx</span><span style="font-family: "Courier New";" class="">.50 W 0 376
<unknown><o:p class=""></o:p></span><span style="font-family: "Courier New";" class=""><br class="">
20811423555753 </span><span style="font-family: "Courier New";" class="">xxx.xx.xxx</span><span style="font-family: "Courier New";" class="">.18 R 0 685
<unknown></span><br class="">
</p>
If they are files which have been deleted they must be very short lived
files ?<br class=""></div></div></blockquote><div><br class=""></div><div>not necessarily</div><div><br class=""></div><div>If you want auditing, you need auditing tools and dtrace is not the right tool</div><div> -- richard</div><br class=""><blockquote type="cite" class=""><div class=""><div bgcolor="#ffffff" text="#000000" class="">
<br class="">
Richard Elling wrote:
<blockquote cite="mid:224F2FDE-E0F2-468C-B42E-D17B59C0B584@richardelling.com" type="cite" class="">
<meta http-equiv="Content-Type" content="text/html " class="">
<br class="">
<div class="">
<blockquote type="cite" class="">
<div class="">On Mar 21, 2017, at 3:54 PM, Richard Skelton <<a moz-do-not-send="true" href="mailto:skeltonr@btconnect.com" class="">skeltonr@btconnect.com</a>>
wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div bgcolor="#ffffff" text="#000000" class="">Hi,<br class="">
I am using the dtrace script nfsv3rwsnoop.d to find file that are
accessed from my OmniOS r151020 filer and some file names are listed as
unknown :-(<br class="">
I guess they are files that have been open for a long time and have
dropped out of some data structure.<br class="">
</div>
</div>
</blockquote>
<div class=""><br class="">
</div>
<div class="">almost... they are files that were open prior to the dtrace
script running or they are files</div>
<div class="">which have been deleted (!), such that there is no mapping
between the nfs file handle and</div>
<div class="">the current file system</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div bgcolor="#ffffff" text="#000000" class="">Is there any way to
increase the persistence of the name stored.<br class="">
I have lots on memory in this system and would be happy to sacrifice
some if I could see more file name :-)<br class="">
</div>
</div>
</blockquote>
<div class=""><br class="">
</div>
<div class="">depending on what you wish to accomplish, dtrace might be the
wrong tool and you might</div>
<div class="">want auditing or NFS logging instead </div>
<div class=""> — richard</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div bgcolor="#ffffff" text="#000000" class=""><br class="">
root@filer:/scratch# /root/dtrace/nfsv3rwsnoop.d |more<br class=""><p class="MsoNormal"><o:p class=""></o:p>1189849649391
xxx.xx.xxx.59 W
10500 138879 <unknown><o:p class=""></o:p><br class="">
1189849649582 xxx.xx.xxx.59 W 10500 137788 <unknown><o:p class=""></o:p><br class="">
1189849740621 xxx.xx.xxx.118 W 0 2404 <unknown><o:p class=""></o:p><br class="">
1189849781136 xxx.xx.xxx.109 W 19832
756675
/scratch/run.log<o:p class=""></o:p><br class="">
1189849849301 xxx.xx.xxx.102 W 1096
57513
/scratch/avm_remote_job_f64ccf56-efa1-4605-8a48-874816779289_2.out<br class="">
</p><p class="MsoNormal">Cheers<br class="">
Richard<br class="">
<o:p class=""></o:p></p>
<br class="">
</div>
_______________________________________________<br class="">
OmniOS-discuss mailing list<br class="">
<a moz-do-not-send="true" href="mailto:OmniOS-discuss@lists.omniti.com" class="">OmniOS-discuss@lists.omniti.com</a><br class="">
<a class="moz-txt-link-freetext" href="http://lists.omniti.com/mailman/listinfo/omnios-discuss">http://lists.omniti.com/mailman/listinfo/omnios-discuss</a><br class="">
</div>
</blockquote>
</div>
<br class="">
</blockquote>
</div>
</div></blockquote></div><br class=""></body></html>