<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi Richard,<br>
The nfsv3rwsnoop.d script shows to offset to the write as 0 is this
then not a new file?<br>
<p class="MsoNormal"><span style="font-family: "Courier New";">TIME(us)
CLIENT OP OFFSET BYTES PATHNAME<o:p></o:p><br>
20811423544560 xxx.xx.xxx.21 W 0 116 <unknown><o:p></o:p><br>
20811423525741 </span><span style="font-family: "Courier New";">xxx.xx.xxx</span><span
style="font-family: "Courier New";">.50 W 0 5232
<unknown><o:p></o:p><br>
20811423528311 </span><span style="font-family: "Courier New";">xxx.xx.xxx</span><span
style="font-family: "Courier New";">.50 W 0 304
<unknown><o:p></o:p><br>
20811423529251 </span><span style="font-family: "Courier New";">xxx.xx.xxx</span><span
style="font-family: "Courier New";">.50 W 0 376
<unknown><o:p></o:p></span><span
style="font-family: "Courier New";"><br>
20811423555753 </span><span style="font-family: "Courier New";">xxx.xx.xxx</span><span
style="font-family: "Courier New";">.18 R 0 685
<unknown></span><br>
</p>
If they are files which have been deleted they must be very short lived
files ?<br>
<br>
Richard Elling wrote:
<blockquote
cite="mid:224F2FDE-E0F2-468C-B42E-D17B59C0B584@richardelling.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html ">
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Mar 21, 2017, at 3:54 PM, Richard Skelton <<a
moz-do-not-send="true" href="mailto:skeltonr@btconnect.com" class="">skeltonr@btconnect.com</a>>
wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div bgcolor="#ffffff" text="#000000" class="">Hi,<br class="">
I am using the dtrace script nfsv3rwsnoop.d to find file that are
accessed from my OmniOS r151020 filer and some file names are listed as
unknown :-(<br class="">
I guess they are files that have been open for a long time and have
dropped out of some data structure.<br class="">
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>almost... they are files that were open prior to the dtrace
script running or they are files</div>
<div>which have been deleted (!), such that there is no mapping
between the nfs file handle and</div>
<div>the current file system</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div bgcolor="#ffffff" text="#000000" class="">Is there any way to
increase the persistence of the name stored.<br class="">
I have lots on memory in this system and would be happy to sacrifice
some if I could see more file name :-)<br class="">
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>depending on what you wish to accomplish, dtrace might be the
wrong tool and you might</div>
<div>want auditing or NFS logging instead </div>
<div> — richard</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div bgcolor="#ffffff" text="#000000" class=""><br class="">
root@filer:/scratch# /root/dtrace/nfsv3rwsnoop.d |more<br class="">
<p class="MsoNormal"><o:p class=""></o:p>1189849649391
xxx.xx.xxx.59 W
10500 138879 <unknown><o:p class=""></o:p><br class="">
1189849649582 xxx.xx.xxx.59 W 10500 137788 <unknown><o:p
class=""></o:p><br class="">
1189849740621 xxx.xx.xxx.118 W 0 2404 <unknown><o:p
class=""></o:p><br class="">
1189849781136 xxx.xx.xxx.109 W 19832
756675
/scratch/run.log<o:p class=""></o:p><br class="">
1189849849301 xxx.xx.xxx.102 W 1096
57513
/scratch/avm_remote_job_f64ccf56-efa1-4605-8a48-874816779289_2.out<br
class="">
</p>
<p class="MsoNormal">Cheers<br class="">
Richard<br class="">
<o:p class=""></o:p></p>
<br class="">
</div>
_______________________________________________<br class="">
OmniOS-discuss mailing list<br class="">
<a moz-do-not-send="true"
href="mailto:OmniOS-discuss@lists.omniti.com" class="">OmniOS-discuss@lists.omniti.com</a><br
class="">
<a class="moz-txt-link-freetext" href="http://lists.omniti.com/mailman/listinfo/omnios-discuss">http://lists.omniti.com/mailman/listinfo/omnios-discuss</a><br class="">
</div>
</blockquote>
</div>
<br class="">
</blockquote>
</body>
</html>