nfswatch(8) — Unsupported
Name
nfswatch − monitor an NFS server
Syntax
/usr/etc/nfswatch [ −dst dsthost ] [ −src srchost ] [ −dev device ] [ −allif ] [ −f filelist ] [ −lf logfile ]
[ −sf snapshotfile ] [ −t timeout ] [ −fs ] [ −if ] [ −procs ] [ −clients ] [ −all ] [ −usage ] [ −l ]
Description
The nfswatch command monitors all incoming ethernet traffic to an NFS file server and divides it into several categories. The number and percentage of packets received in each category is displayed on the screen in a continuously updated display. The screen is updated every ten seconds by default; this time period is called an interval.
On SunOS : You must be the super-user to invoke nfswatch or it must be installed setuid to “root.” On ULTRIX : Any user can invoke nfswatch once the super-user has enabled promiscuous-mode operation using pfconfig() or (less desirable) ifconfig(.).
By default, nfswatch monitors all packets destined for the current host. An alternate destination host to watch for may be specified using the −dst argument. If a source host is specified with the −src argument, then only packets arriving at the destination host which were sent by the source host are monitored. If the −all argument is given, then all NFS traffic on the network is monitored.
The nfswatch screen is divided into three parts. The first part, at the top of the screen, is made up of three lines. The first line displays the name of the host being monitored, the current date and time, and the time elapsed since the start of monitoring. The second line displays the total number of packets received during the most recent interval, and the third line displays the total number of packets received since monitoring started. These two lines display three numbers each: the total number of packets on the network, the total number of packets received by the destination host (possibly subject to being only from the specified source host), and the number of packets dropped by the monitoring interface due to buffer space limitations. Dropped packets are not included in the packet monitoring totals.
The second part of the screen divides the received packets into 16 categories. Each category is displayed with three numbers: the number of packets received this interval, the percentage this represents of all packets received by the host during this interval, and the total number of packets received since monitoring started. The packet categories are not mutually exclusive; some packets may be counted in more than one category (for example, NFS packets are also UDP packets). The categories in this section and their meanings are:
ND Read
Sun Network Disk read requests. Only servers which serve clients running SunOS 3.5 or less should display non-zero counts in this section.
ND Write
Sun Network Disk write requests. Only servers which serve clients running SunOS 3.5 or less should display non-zero counts in this section.
NFS Read
NFS requests which primarily result in a file system read being performed (for example, read file, read directory).
NFS Write
NFS requests which primarily result in a file system write being performed (for example, write file, rename file, create file, delete file).
NFS Mount
NFS mount requests.
Yellow Pages/NIS
Sun Yellow Pages (NIS) requests.
RPC Authorization
All RPC reply packets fall into this category, because RPC replies do not contain the protocol number, and thus cannot be classified as anything else. (If the −all argument is given, then you will see all the RPC replies on the network in this category.)
Other RPC Packets
All RPC requests which do not fall into one of the above categories.
TCP Packets
Packets sent using the Transmission Control Protocol.
UDP Packets
Packets sent using the User Datagram Protocol.
ICMP Packets
Packets sent using the Internet Control Message Protocol.
Routing Control
Routing Information Protocol (RIP) packets.
Address Resolution
Address Resolution Protocol (ARP) packets.
Reverse Addr Resol
Reverse Address Resolution Protocol (RARP) packets.
Ethernet Broadcast
Ethernet broadcast packets. These packets are destined for and received by all hosts on the local ethernet.
Other Packets
A catch-all for any packets not counted in any of the above categories.
The third part of the display shows the mounted file systems exported by the file server for mounting through NFS. If nfswatch is monitoring the same host it is being run on, these file systems are listed by path name. Otherwise, the program attempts to decode the server’s major and minor device numbers for the file system, and displays them in parentheses. (If the −all argument is given, the name of the server is also shown.) With each file system, three numbers are displayed: the number of NFS requests for this file system received during the interval, the percentage this represents of all NFS requests received by the host, and the total number of NFS requests for this file system received since monitoring started. Up to 256 file systems are monitored by nfswatch and recorded in the log file, but only as many as will fit (2 * (LINES − 16)) are displayed on the screen.
If the −f filelist option is specified, a list of file names (one per line) is read from filelist, and the traffic to these individual files is also monitored. The files must reside in file systems exported by the file server. When this option is specified, the third section of the screen will display counters for these files, instead of for the mounted file systems. Up to 256 individual files are monitored by nfswatch and recorded in the log file, but only as many as will fit (2 * (LINES − 16)) are displayed on the screen.
If the −procs option is specified, then instead of showing per-file or per-file system statistics, nfswatch shows the frequency of each NFS procedure (RPC call) (or as many as will fit on the screen).
If the −clients option is specified, then instead of showing per-file or per-file system statistics, nfswatch shows the operation rate of each NFS client of the specified server(s) (or as many as will fit on the screen).
Note that only NFS requests, made by client machines, are counted in the NFS packet monitoring area. The NFS traffic generated by the server in response to these requests is not counted.
Options
The nfswatch command can usually be run without arguments and obtains useful results. However, for those occasions when the defaults are not good enough, the following options are provided:
−dst dsthost
Monitors packets destined for dsthost instead of the local host.
−src srchost
Restricts packets being counted to those sent by srchost.
−allMonitors packets to and from all NFS servers on the local network.
−dev device
On SunOS : Uses network interface device device to read packets from. By default, nfswatch uses the system’s default network device for an Internet datagram. On ULTRIX : device specifies the packet filter interface from which to read packets. You can specify interfaces either by their actual names (such as ln0) or by their generic packet filter interface names ( pfN) for N a small integer). By default, pf0 (the first configured interface that supports the packet filter) is used.
−allifRead packets from all configured network interfaces, instead of a single device. On SunOS : The first five le (0-4) and the first five ie (0-4) devices (a total of ten devices) are checked, and if configured, are monitored. On ULTRIX : The first ten pf devices (0-9) are checked, and if configured, are monitored.
−f filelist
Reads a list of file names (one per line) from filelist and monitors the NFS traffic to these files in addition to the normal monitoring of exported file systems.
−lf logfile
When logging, writes information to the file logfile. The default is nfswatch.log.
−sf snapshotfile
Writes snapshots to the file snapshotfile. The default is nfswatch.snap.
−t timeout
Sets the cycle time (interval length) to timeout seconds. The default is 10. The cycle time may also be adjusted from the command prompt.
−fsDisplays the file system NFS monitoring data instead of the individual file data. This option is only meaningful if the −f filelist option was specified. The display may also be controlled from the command prompt.
−ifDisplays the individual file NFS monitoring data instead of the file system data. This option is only meaningful if the −f filelist option was specified. The display may also be controlled from the command prompt.
−procs
Displays statistics on NFS procedures (RPC calls) instead of per-file or per-filesystem data.
−client
Displays statistics on NFS client operation rates instead of per-file or per-filesystem data.
−usage
Sets file system, procedure, or client display to be sorted in declining order of percent usage. By default, the display is sorted alphabetically. This may also be toggled from the command prompt.
−lTurns logging on at startup time. Logging is turned off by default, but may be enabled from the command prompt.
Restrictions
To monitor NFS traffic to files and file systems, nfswatch must extract information from the NFS file handle. The file handle is a server-specific item, and its contents vary from vendor to vendor and operating system to operating system. Unfortunately, there is no machine-independent way to extract information from a file handle. The nfswatch command understands the file handle format used by SunOS 4.1 SPARC and ULTRIX systems (depending on how it was compiled); the program must be modified to understand other formats.
The nfswatch command uses the Network Interface Tap under SunOS 4.x, and the Packet Filter ( packetfilter())) under ULTRIX 4.0 or later. To run on other systems, including pre-4.x SunOS, code must be written to read packets from the network in promiscuous mode.
Logfile
When logging is on, nfswatch writes one entry to the log file each interval. The information printed to the log file is easily readable, and basically contains a copy of all information on the screen. Additionally, any NFS traffic to file systems or individual files which was not printed on the screen (due to space limitations) is printed in the log file. Finally, in the log file, the NFS traffic to file systems and individual files is further broken down into counts of how many times each specific NFS procedure was called.
The information in the nfswatch log file can be summarized easily using the nfslogsum() program.
Commands
The nfswatch command also allows a small set of commands to be entered at its prompt during execution. The prompt is displayed on the last line of the screen. For most commands, feedback describing the effect of the command is printed on the same line as the prompt. The commands are:
^LClears and redraws the screen.
cSwitches the display to show statistics on NFS client hosts instead of per-file or per-filesystem information.
fToggles the display of mounted file systems and the display of individual files in the NFS packet monitoring area. This command is only meaningful if the −f filelist option was specified on the command line. (If the display is showing NFS procedures or clients, then this command switches the display to show file systems.)
pSwitches the display to show statistics on NFS procedures instead of per-file or per-filesystem information.
lToggles the logging feature. If logging is off it is (re)started; if logging is on, it is turned off.
sTakes a “snapshot” of the current screen and saves it to a file. This is useful to record occasional copies of the data when the logfile is not needed.
uToggles the sort key for the display of mounted file systems in the NFS packet monitoring area. By default, these are sorted by file system name, but they can also be sorted in declining order of percent usage.
−Decreases the cycle time (interval length) by ten seconds. This takes effect after the next screen update.
+Increases the cycle time (interval length) by ten seconds. This takes effect after the next screen update.
<Decreases the cycle time (interval length) by one second. This takes effect after the next screen update.
>Increases the cycle time (interval length) by one second. This takes effect after the next screen update.
]Scrolls forward through the bottom part of the display, if there are files/file systems/clients/procedures not being displayed due to lack of space.
[Scrolls back.
qExits nfswatch. Using the interrupt key also causes nfswatch to exit.
Typing any other character causes a help screen to be displayed.