unixdev.net


Switch to SpeakEasy.net DSL

The Modular Manual Browser

Home Page
Manual: (OSF1-V5.1-alpha)
Page:
Section:
Apropos / Subsearch:
optional field



nfswatch(8)							  nfswatch(8)



NAME

  nfswatch - Monitor an	NFS server

SYNOPSIS

  /usr/sbin/nfswatch [options]

OPTIONS

  The nfswatch command can usually be run without options and will produce
  useful results. However, for those occasions when the	defaults are not suf-
  ficient, the following options are provided:

  -dst dsthost
      Monitors packets destined	for dsthost instead of the local host.

  -src srchost
      Restricts	packets	being counted to those sent by srchost.

  -server serverhost
      Restricts	packets	being counted to those sent to or from serverhost.

  -all
      Specifies	to monitor packets to and from all NFS servers on the local
      network.

  -dev device
      Specifies	the packet filter interface from which to read packets.	 You
      can specify interfaces either by their actual names (such	as ln0)	or by
      their generic packet filter interface names (pfn,	where n	is an
      integer).	 By default, pf0 (the first configured interface that sup-
      ports the	packet filter) is used.

  -allif
      Reads packets from all configured	network	interfaces, instead of a sin-
      gle device. The first ten	pf devices (0-9) are checked, and if config-
      ured, will be monitored.

  -f filelist
      Reads a list of file names (one per line)	from filelist and monitors
      the NFS traffic to these files in	addition to the	normal monitoring of
      exported file systems.

  -lf logfile
      When logging, writes information to the file logfile.  The default is
      nfswatch.log.

  -sf snapfile
      Writes snapshots to the file snapfile.  The default is nfswatch.snap.

  -map mapfile
      Reads a list of device names and file system names (one pair per line)
      from mapfile and translates from one to the other	when displaying	file
      system names.

  -T maxtime
      Terminates execution after running for maxtime seconds. This is pri-
      marily for use with the -bg option.

  -t timeout
      Sets the cycle time (interval length) to timeout seconds.	 The default
      is 10. The cycle time may	also be	adjusted from the command prompt.

  -fs Displays the file	system NFS monitoring data instead of the individual
      file data. This option is	meaningful only	if specified with the -f
      filelist option. The display may also be controlled from the command
      prompt.

  -if Displays the individual file NFS monitoring data instead of the file
      system data.  This option	is meaningful only if specified	with the -f
      filelist option. The display may also be controlled from the command
      prompt.

  -auth
      Displays statistics on authentication packets (individual	users).

  -procs
      Displays statistics on NFS procedures (RPC calls)	instead	of per-file
      or per-file system data.

  -clients
      Displays statistics on NFS client	operation rates	instead	of per-file
      or per-filesystem	data.

  -usage
      Sets file	system,	procedure, or client display to	be sorted in declin-
      ing order	of percent usage. By default, the display is sorted alphabet-
      ically.  This may	also be	toggled	from the command prompt.

  -l  Turns on logging at startup time.	Logging	is turned off by default, but
      may be enabled from the command prompt.

  -bg Starts as	a daemon, running in the background. No	screen updates will
      be performed; all	data will be written to	the log	file only. When
      started with this	option,	nfswatch will print the	process	id of the
      daemon process. To terminate nfswatch, send the process a	SIGTERM	sig-
      nal, or use the -T option	to set the maximum execution time.

DESCRIPTION

  The nfswatch program monitors	all incoming network traffic to	an NFS file
  server and divides it	into several categories. The number and	percentage of
  packets received in each category is displayed on the	screen in a continu-
  ously	updated	display. The screen is updated every ten seconds by default;
  this time period is called an	interval.

  Your kernel must be configured with the packetfilter option. (See packet-
  filter(7).) After kernel configuration, any user can invoke nfswatch once
  the superuser	has enabled promiscuous-mode operation using the following
  pfconfig command:

       # pfconfig +p +c	interface

  By default, nfswatch monitors	all packets destined for the current host. An
  alternate destination	host to	watch for may be specified using the -dst
  option. If a source host is specified	with the -src option, then only	pack-
  ets arriving at the destination host which were sent by the source host are
  monitored. Traffic between a specific	server and its clients may be watched
  by specifying	the name of the	server with the	-server	option.	 If the	-all
  option is given, then	all NFS	traffic	on the network is monitored. It	is
  usually desirable to specify the -all	option whenever	using the -server
  option.


  The nfswatch screen is divided into the following three parts:

    +  The first part, at the top of the screen, is made up of three lines.
       The first line displays the name	of the host being monitored, the
       current date and	time, and the time elapsed since the start of moni-
       toring.

       The second line displays	the total number of packets received during
       the most	recent interval.

       The third line displays the total number	of packets received since
       monitoring started.

       The second and third lines display three	numbers	each: the total
       number of packets on the	network, the total number of packets received
       by the destination host (possibly subject to being only from the
       specified source	host), and the number of packets dropped by the	moni-
       toring interface	due to buffer space limitations. Dropped packets are
       not included in the packet monitoring totals.

    +  The second part of the screen divides the received packets into 16
       categories. Each	category is displayed with three numbers:

	 -- The	number of packets received this	interval.

	 -- The	percentage this	represents of all packets received by the
	    host during	this interval.

	 -- The	total number of	packets	received since monitoring started.

	    The	packet categories are not mutually exclusive; some packets
	    may	be counted in more than	one category (for example, NFS pack-
	    ets	are also UDP packets).

	    The	categories in this section and their meanings are:

	    ND Read
		Sun Network Disk read requests.	Only servers which serve
		clients	running	SunOS 3.5 or less should display nonzero
		counts in this section.	This field is only counted when
		nfswatch is run	on a SunOS 4.x system; other versions of
		nfswatch count these packets as	"other."

	    ND Write
		Sun Network Disk write requests. Only servers which serve
		clients	running	SunOS 3.5 or less should display nonzero
		counts in this section.	 This field is only counted when
		nfswatch is run	on a SunOS 4.x system; other versions of
		nfswatch count these packets as	"other."

	    NFS	Read
		NFS requests which primarily result in a file system read
		being performed	(read file, read directory, and	so on).

	    NFS	Write
		NFS requests which primarily result in a file system write
		being performed	(write file, rename file, create file, delete
		file, and so on).

	    NFS	Mount
		NFS mount requests.

	    YP/NIS/NIS+
		Sun NIS	(Yellow	Pages) and NIS+	requests.

	    RPC	Authorization
		All RPC	reply packets fall into	this category, because RPC
		replies	do not contain the protocol number, and	thus cannot
		be classified as anything else.	(If the	-all option is given,
		then you will see all the RPC replies on the network in	this
		category.)

	    Other RPC Packets
		All RPC	requests which do not fall into	one of the above
		categories.

	    TCP	Packets
		Packets	sent using the Transmission Control Protocol (TCP).

	    UDP	Packets
		Packets	sent using the User Datagram Protocol (UDP).

	    ICMP Packets
		Packets	sent using the Internet	Control	Message	Protocol
		(ICMP).

	    Routing Control
		Routing	Information Protocol (RIP) packets.

	    Address Resolution
		Address	Resolution Protocol (ARP) packets. These packets are
		not counted on System V	Release	4 systems (except for SunOS
		5.x), due to limitations of the	dlpi(7)	interface.

	    Reverse Addr Resol
		Reverse	Address	Resolution Protocol (RARP) packets. These
		packets	are not	counted	on System V Release 4 systems (except
		for SunOS 5.x),	due to limitations of the dlpi(7) interface.

	    Ethernet/FDDI Bdcst
		Ethernet (or FDDI) broadcast packets. These packets are	des-
		tined for and received by all hosts on the local network.
		These packets are not counted on System	V Release 4 systems
		(except	for SunOS 5.x),	due to limitations of the dlpi(7)
		interface.

	    Other Packets
		A catch-all for	any packets not	counted	in any of the above
		categories.

    +  The third part of the display shows the mounted file systems exported
       by the file server for mounting through NFS. If nfswatch	is monitoring
       the same	host it	is being run on, these file systems are	listed by
       path name. Otherwise, the program attempts to decode the	server's
       major and minor device numbers for the file system, and displays	them
       in parentheses.	(If the	-all option is given, the name of the server
       is also shown.) With each file system, three numbers are	displayed:

	 -- The	number of NFS requests for this	file system received during
	    the	interval.

	 -- The	percentage this	represents of all NFS requests received	by
	    the	host.

	 -- The	total number of	NFS requests for this file system received
	    since monitoring started. Up to 256	file systems will be
	    monitored by nfswatch and recorded in the log file,	but only as
	    many as will fit (2	* (LINES - 16))	will be	displayed on the
	    screen.

       If the -map mapfile option is specified,	nfswatch will read pairs of
       file system device specifications (as described above) and the proper
       names of	the file systems from mapfile. Each line should	contain	a
       string representing what	nfswatch would normally	print, and then
       separated from that by whitespace, the name that	is preferred. For
       example:


	    myhost(7,24)     /homedirs

       If the -f filelist option is specified, a list of file names (one per
       line) is	read from filelist, and	the traffic to these individual	files
       is also monitored. The files must reside	in file	systems	exported by
       the file	server.	 When this option is specified,	the third section of
       the screen will display counters	for these files, instead of for	the
       mounted file systems. Up	to 256 individual files	will be	monitored by
       nfswatch	and recorded in	the log	file, but only as many as will fit (2
       * (LINES	- 16)) will be displayed on the	screen.

       If the -procs option is specified, instead of showing per-file or
       per-file	system statistics, nfswatch shows the frequency	of each	NFS
       procedure (RPC call) (or	as many	as will	fit on the screen). For	each
       procedure, some timing statistics are also displayed; these include
       the number of completed operations (request and response	seen) during
       the interval, the average response time during the interval, the	stan-
       dard deviation from the average during the interval, and	the maximum
       response	time over all time.

       If the -clients option is specified, instead of showing per-file	or
       per-file	system statistics, nfswatch shows the operation	rate of	each
       NFS client of the specified server or servers (or as many as will fit
       on the screen).

       It should be noted here that only NFS requests, made by client
       machines, are counted in	the NFS	packet monitoring area.	The NFS
       traffic generated by the	server in response to these requests is	not
       counted.

       If the -auth option is specified, the display will show packet counts
       divided up by user name (or user	id, if the login name is not in	the
       local password file). This information is decoded from the AUTH_UNIX
       authentication part of each RPC packet. The nfswatch utility only
       decodes AUTH_UNIX authenticators, the other types of authentication
       (for example, AUTH_DES) are lumped into a single	bucket for each
       authentication type.

LOGFILE

  When logging is on, nfswatch writes one entry	to the log file	each inter-
  val. The information printed to the log file is easily readable, and basi-
  cally	contains a copy	of all information on the screen.  Additionally, any
  NFS traffic to file systems or individual files which	was not	printed	on
  the screen (due to space limitations)	is printed in the log file. Finally,
  in the log file, the NFS traffic to file systems and individual files	is
  further broken down into counts of how many times each specific NFS pro-
  cedure was called.

  The information in the nfswatch log file can be summarized easily using the
  nfslogsum program.




COMMANDS

  The nfswatch utility also allows several commands to be entered at its
  prompt during	execution. The prompt is displayed on the last line of the
  screen. For most commands, feedback describing the effect of the command is
  printed on the same line as the prompt. The commands are:

  ^L  Clears and redraws the screen.

  a   Switches the display to show statistics on individual users.

  c   Switches the display to show statistics on NFS client hosts instead of
      per-file or per-filesystem information.

  f   Toggles the display of mounted file systems and the display of indivi-
      dual files in the	NFS packet monitoring area. This command is only
      meaningful if the	-f filelist option was specified on the	command	line.
      (If the display is showing NFS procedures	or clients, then this command
      switches the display to show file	systems.)

  p   Switches the display to show statistics on NFS procedures	instead	of
      per-file or per-filesystem information.

  l   Toggles the logging feature. If logging is off it	is started; if log-
      ging is on, it is	turned off.

  n   Toggles display of host names or host numbers in client mode.  By
      default, client mode displays host names.	However, this may not be suf-
      ficient for determining the names	of unknown remote hosts, since domain
      names are	not displayed. This command tells nfswatch to display host
      numbers instead, enabling	each host to be	uniquely identified.

  s   Takes a snapshot of the current screen and saves it to a file.  This is
      useful to	record occasional copies of the	data when the log file is not
      needed.

  u   Toggles the sort key for the display of mounted file systems in the NFS
      packet monitoring	area. By default, these	are sorted by file system
      name, but	they can also be sorted	in declining order of percent usage.

  -   Decreases	the cycle time (interval length) by ten	seconds.  This takes
      effect after the next screen update.

  +   Increases	the cycle time (interval length) by ten	seconds.  This takes
      effect after the next screen update.

  <&lt;   Decreases	the cycle time (interval length) by one	second.	 This takes
      effect after the next screen update.

  >&gt;   Increases	the cycle time (interval length) by one	second.	 This takes
      effect after the next screen update.

  ]   Scrolls forward through the bottom part of the display, if there are
      files/file systems/clients/procedures not	being displayed	due to lack
      of space.

  [   Scrolls backward.

  q   Exits nfswatch. Using the	interrupt key will also	cause nfswatch to
      exit.

  Typing any other character will cause	a help screen to be displayed.




SEE ALSO

  Commands: pfstat(1), nfslogsum(8), pfconfig(8), tcpdump(8)


  Networking: bpf(7), packetfilter(7)