1nfslogd(1M) System Administration Commands nfslogd(1M)
2
6 nfslogd - nfs logging daemon
7
9 /usr/lib/nfs/nfslogd
10
13 The nfslogd daemon provides operational logging to the Solaris NFS
14 server. It is the nfslogd daemon's job to generate the activity log by
15 analyzing the RPC operations processed by the NFS server. The log will
16 only be generated for file systems exported with logging enabled. This
17 is specified at file system export time by means of the share_nfs(1M)
18 command.
19 NFS server logging is not supported on Solaris machines that are using
22 NFS Version 4.
23 Each record in the log file includes a time stamp, the IP address (or
26 hostname if it can be resolved) of the client system, the file or
27 directory name the operation was performed on, and the type of opera‐
28 tion. In the basic format, the operation can either be an input (i) or
29 output (o) operation. The basic format of the NFS server log is compat‐
30 ible with the log format generated by the Washington University FTPd
31 daemon. The log format can be extended to include directory modifica‐
32 tion operations, such as mkdir, rmdir, and remove. The extended format
33 is not compatible with the Washington University FTPd daemon format.
34 See nfslog.conf(4) for details.
35 The NFS server logging mechanism is divided in two phases. The first
38 phase is performed by the NFS kernel module, which records raw RPC
39 requests and their results in work buffers backed by permanent storage.
40 The location of the work buffers is specified in the /etc/nfs/nfs‐
41 log.conf file. Refer to nfslog.conf(4) for more information. The second
42 phase involves the nfslogd user-level daemon, which periodically reads
43 the work buffers, interprets the raw RPC information, groups related
44 RPC operations into single transaction records, and generates the out‐
45 put log. The nfslogd daemon then sleeps waiting for more information to
46 be logged to the work buffers. The amount of time that the daemon
47 sleeps can be configured by modifying the IDLE_TIME parameter in
48 /etc/default/nfslogd. The work buffers are intended for internal con‐
49 sumption of the nfslogd daemon.
50 NFS operations use file handles as arguments instead of path names. For
53 this reason the nfslogd daemon needs to maintain a database of file
54 handle to path mappings in order to log the path name associated with
55 an operation instead of the corresponding file handle. A file handle
56 entry is added to the database when a client performs a lookup or other
57 NFS operation that returns a file handle to the client.
58 Once an NFS client obtains a file handle from a server, it can hold on
61 to it for an indefinite time, and later use it as an argument for an
62 NFS operation on the file or directory. The NFS client can use the file
63 handle even after the server reboots. Because the database needs to
64 survive server reboots, it is backed by permanent storage. The location
65 of the database is specified by the fhtable parameter in the
66 /etc/nfs/nfslog.conf file. This database is intended for the internal
67 use of the nfslogd daemon.
68 In order to keep the size of the file handle mapping database manage‐
71 able, nfslogd prunes the database periodically. It removes file handle
72 entries that have not been accessed in more than a specified amount of
73 time. The PRUNE_TIMEOUT configurable parameter in /etc/default/nfslogd
74 specifies the interval length between successive runs of the pruning
75 process. A file handle record will be removed if it has not been used
76 since the last time the pruning process was executed. Pruning of the
77 database can effectively be disabled by setting the PRUNE_TIMEOUT as
78 high as INT_MAX.
79 When pruning is enabled, there is always a risk that a client may have
82 held on to a file handle longer than the PRUNE_TIMEOUT and perform an
83 NFS operation on the file handle after the matching record in the map‐
84 ping database had been removed. In such case, the pathname for the file
85 handle will not be resolved, and the log will include the file handle
86 instead of the pathname.
87 There are various configurable parameters that affect the behavior of
90 the nfslogd daemon. These parameters are found in /etc/default/nfslogd
91 and are described below:
92 UMASK Sets the file mode for the log files, work
94 buffer files and file handle mapping data‐
95 base.
96 MIN_PROCESSING_SIZE Specifies the minimum size, in bytes, that
99 the buffer file must reach before process‐
100 ing the work information and writing to the
101 log file. The value of MIN_PROCESSING_SIZE
102 must be between 1 and ulimit.
103 IDLE_TIME Specifies the amount of time, in seconds,
106 the daemon should sleep while waiting for
107 more information to be placed in the buffer
108 file. IDLE_TIME also determines how often
109 the configuration file will be reread. The
110 value of IDLE_TIME must be between 1 and
111 INT_MAX.
112 MAX_LOGS_PRESERVE The nfslogd periodically cycles its logs.
115 MAX_LOGS_PRESERVE specifies the maximum num‐
116 ber of log files to save. When MAX_LOGS_PRE‐
117 SERVE is reached, the oldest files will be
118 overwritten as new log files are created.
119 These files will be saved with a numbered
120 extension, beginning with filename.0. The
121 oldest file will have the highest numbered
122 extension up to the value configured for
123 MAX_LOGS_PRESERVE. The value of
124 MAX_LOGS_PRESERVE must be between 1 and
125 INT_MAX.
126 CYCLE_FREQUENCY Specifies how often, in hours, the log files
129 are cycled. CYCLE_FREQUENCY is used to
130 insure that the log files do not get too
131 large. The value of CYCLE_FREQUENCY must be
132 between 1 and INT_MAX.
133 MAPPING_UPDATE_INTERVAL Specifies the time interval, in seconds,
136 between updates of the records in the file
137 handle to path mapping tables. Instead of
138 updating the atime of a record each time
139 that record is accessed, it is only updated
140 if it has aged based on this parameter. The
141 record access time is used by the pruning
142 routine to determine whether the record
143 should be removed from the database. The
144 value of this parameter must be between 1
145 and INT_MAX.
146 PRUNE_TIMEOUT Specifies when a database record times out,
149 in hours. If the time that elapsed since the
150 record was last accessed is greater than
151 PRUNE_TIMEOUT then the record can be pruned
152 from the database. The default value for
153 PRUNE_TIMEOUT is 168 hours (7 days). The
154 value of PRUNE_TIMEOUT must be between 1
155 and INT_MAX.
156
159 The following exit values are returned:
160 0 Daemon started successfully.
162 1 Daemon failed to start.
165
168 /etc/nfs/nfslogtab
169 /etc/nfs/nfslog.conf
172 /etc/default/nfslogd
175
178 See attributes(5) for descriptions of the following attributes:
179 ┌─────────────────────────────┬─────────────────────────────┐
184 │ ATTRIBUTE TYPE │ ATTRIBUTE VALUE │
185 ├─────────────────────────────┼─────────────────────────────┤
186 │Availability │SUNWnfssu │
187 └─────────────────────────────┴─────────────────────────────┘
188
190 share_nfs(1M), nfslog.conf(4), attributes(5)
191SunOS 5.11 2 Dec 2004 nfslogd(1M)