nfslogd.1m (2010 09)

ManualsBrandsHP ManualsSoftwareHP-UX Manpages

nfslogd(1M) nfslogd(1M)

NAME

nfslogd - nfs logging daemon

SYNOPSIS

/usr/sbin/nfslogd

DESCRIPTION

The nfslogd daemon provides operational logging to the HP-UX NFS server. It is the

nfslogd

daemon’s job to generate the activity log by analyzing RPC operations processed by the NFS server. The

log will only be generated for ﬁle systems exported with logging enabled. This is speciﬁed at ﬁle system

export time by means of the share_nfs (1M) command.

Each record in the log ﬁle includes a time stamp, the IP address (or hostname if it can be resolved) of the

client system, the ﬁle or directory name the operation was performed on, and the type of operation.

In the basic format, the operation can either be an input (i) or output (o) operation. The basic format of

the NFS server log is compatible with the log format generated by the Washington University

FTPd dae-

mon. The log format can be extended to include directory modiﬁcation operations, such as

mkdir,

rmdir, and remove. The extended format is not compatible with the Washington University

FTPd

dae-

mon format. See nfslog.conf (4) for details.

The NFS server logging mechanism is divided in two phases. The ﬁrst phase is performed by the NFS

kernel module, which records raw RPC requests and their results in work buffers backed by permanent

storage. The location of the work buffers is speciﬁed in the

/etc/nfs/nfslog.conf

ﬁle. Refer to

nfslog.conf (4) for more information.

The second phase involves the

nfslogd user-level daemon, which periodically reads the work buffers,

interprets the raw RPC information, groups related RPC operations into single transaction records, and

generates the output log. The nfslogd daemon then sleeps waiting for more information to be logged to

the work buffers. The amount of time that the daemon sleeps can be conﬁgured by modifying the

IDLE_TIME parameter in /etc/default/nfslogd

. The work buffers are intended for internal con-

sumption of the

nfslogd daemon.

NFS operations use ﬁle handles as arguments instead of path names. For this reason the

nfslogd dae-

mon needs to maintain a database of ﬁle handle to path mappings in order to log the path name associ-

ated with an operation instead of the corresponding ﬁle handle. A ﬁle handle entry is added to the data-

base when a client performs a lookup or other NFS operation that returns a ﬁle handle to the client.

Once an NFS client obtains a ﬁle handle from a server, it can hold on to it for an indeﬁnite time, and

later use it as an argument for an NFS operation on the ﬁle or directory. The NFS client can use the ﬁle

handle even after the server reboots. Because the database needs to survive server reboots, it is backed

by permanent storage. The location of the database is speciﬁed by the

fhtable parameter in the

/etc/nfs/nfslog.conf

ﬁle. This database is intended for the internal use of the nfslogd daemon.

In order to keep the size of the ﬁle handle mapping database manageable,

nfslogd prunes the database

periodically. It removes ﬁle handle entries that have not been accessed in more than a speciﬁed amount

of time.

The

PRUNE_TIMEOUT conﬁgurable parameter in /etc/default/nfslogd

speciﬁes the interval

length between successive runs of the pruning process. A ﬁle handle record will be removed if it has not

been used since the last time the pruning process was executed. Pruning of the database can effectively

be disabled by setting the

PRUNE_TIMEOUT as high as INT_MAX.

When pruning is enabled, there is always a risk that a client may have held on to a ﬁle handle longer

than the

PRUNE_TIMEOUT and perform an NFS operation on the ﬁle handle after the matching record in

the mapping database had been removed. In such case, the pathname for the ﬁle handle will not be

resolved, and the log will include the ﬁle handle instead of the pathname.

There are various conﬁgurable parameters that affect the behavior of the

nfslogd daemon. These

parameters are found in /etc/default/nfslogd and are described below:

UMASK Sets the ﬁle mode for the log ﬁles, work buffer ﬁles and ﬁle handle mapping

database.

MIN_PROCESSING_SIZE

Speciﬁes the minimum size, in bytes, that the buffer ﬁle must reach before

processing the work information and writing to the log ﬁle. The value of

MIN_PROCESSING_SIZE must be between 1 and the maximum ﬁle size that

is supported by the ﬁle system where the buffer ﬁle resides.

HP-UX 11i Version 3: September 2010 − 1 − Hewlett-Packard Company 1

Summary of content (2 pages)

PAGE 1
nfslogd(1M) nfslogd(1M) NAME nfslogd - nfs logging daemon SYNOPSIS /usr/sbin/nfslogd DESCRIPTION The nfslogd daemon provides operational logging to the HP-UX NFS server. It is the nfslogd daemon’s job to generate the activity log by analyzing RPC operations processed by the NFS server. The log will only be generated for file systems exported with logging enabled. This is specified at file system export time by means of the share_nfs (1M) command.
PAGE 2
nfslogd(1M) nfslogd(1M) IDLE_TIME Specifies the amount of time, in seconds, the daemon should sleep while waiting for more information to be placed in the buffer file. IDLE_TIME also determines how often the configuration file will be reread. The value of IDLE_TIME must be between 1 and INT_MAX. MAX_LOGS_PRESERVE The nfslogd periodically cycles its logs. MAX_LOGS_PRESERVE specifies the maximum number of log files to save.