[nycbug-talk] What client connected to nfsd?

[Marc Spitzer]

On 4/16/06, Francisco Reyes <lists at stringsutils.com> wrote:
> Marc Spitzer writes:
>
> > yes it will, if you run it on the server you will get the pid of the
> > server proceess connected to client ip:port.  I get the following
> > fields:
> > user
> > command
> > pid
> > fd
> > proto
> > local address
> > foreign address
>
> I must be missing something. :-(
>
> I do
> sockstat | egrep "416|415|....|427"|less

try "sockstat|less" and see what happens.  If I remember correctly nfs
mostly goes over udp not tcp

>
> Where the dots represent the PIDs of the most heavily used nfsd processes.
> Only one that comes up is:
>
> root     nfsd       415   3  tcp4   *:2049                *:*
>
> I also tried
> sockstat |grep "2049" and get exactly the same line.
>
> However tcpdump returns lines such as:
> 15:36:.. IP <IP>.1759450495 > <IP>.nfs: 176 lookup [|nfs]
>
> I am a tcpdump newbie.. Am I missing a port in that line?
>

Well I have not used it much recently my self.  But here is what I
would suggest:

1: capture data when the system has problems in a binary tcpdump file
2: capture a series of sockstat  during the same time, no grep capture
everything
3: look at both, write some scripts to summarize data
4: reread the tcpdump man page, -n is handy.


> It seems as if sockstat doesn't report the communication going on in nfs.

sockstat does not report communication going on, all it does is report
the state of the sockets at the time it is run.

marc


--
"We trained very hard, but it seemed that every time we were beginning to
form into teams we would be reorganized. I was to learn later in life that
we tend to meet any new situation by reorganizing, and a wonderful method it
can be for creating the illusion of progress, while producing confusion,
inefficiency and demoralization."
-Gaius Petronius, 1st Century AD