Tille's Site

Issues with NFS logging

Sometimes, you want logging on your NFS file systems, especially when exporting them in read/write mode.

On Solaris 9, it says in /etc/init.d/nfs.server

if [ -s /etc/nfs/nfslogtab ]; then
                /usr/lib/nfs/nfslogd &
        fi

It tells us nowhere what should initially be in this status file. If it does not exist or if it is empty, the nfslogd daemon is not started.

Normally, after some time, this file gets entries of the form

/var/nfs/nfslog_workbuffer	/export/home	global	1

The nfslogtab file was missing on the automatically installed systems I usually work with, and neither did it exist on a Solaris 9 installed on an Intel PC. What worked for me was just redirecting the output of a simple command into this file, so that it existed and would not be empty.

Apart from the non-empty /etc/nfs/nfslogtab file, there are a couple of other things that need to be arranged:

• Check that the logfiles exist in the directories defined in /etc/nfs/nfslog.conf.
• Partitions holding NFS shares should have the logging option enabled in /etc/vfstab
• NFS shares should have the log option enabled.

To trick the script into starting the daemon anyway, I create the nfslogtab file, perhaps holding a commented line or today's date. It does not really matter what you put in the file, this happens with it (from /var/adm/messages):

Nov 25 11:42:40 armadillo /usr/lib/nfs/nfslogd[7273]: [ID 821538 daemon.error] Removed entry    "Tue    Nov     11" from /etc/nfs/nfslogtab

This is an example configuration file enabling global logging (all log entries for different shares are collected into one file), expect log entries for the /export/video share:

global	defaultdir=/var/nfs \
	log=nfslog fhtable=fhtable buffer=nfslog_workbuffer
video	defaultdir=/var/nfs \
	log=videolog fhtable=video_fhtable buffer=video_buffer

In the /etc/dfs/dfstab file, you need to specify the log tag so as the nfslogd knows where to log:

share -F nfs -o rw,anon=0,log=global /export/home
share -F nfs -o rw,anon=0,log=global /export/projects
share -F nfs -o ro,log=video /export/video

tille@slowy ~> grep export /etc/vfstab
/dev/dsk/c0t0d0s5	/dev/rdsk/c0t0d0s5	/export	ufs	2	yes	logging

When everything is checked, stop and start the NFS server:

root@slowy ~> /etc/init.d/nfs.server stop

root@slowy ~> /etc/init.d/nfs.server start

root@slowy ~> ps -ef | grep nfs
    root   231     1  0   Nov 21 ?        0:00 /usr/lib/nfs/lockd
  daemon   230     1  0   Nov 21 ?        0:00 /usr/lib/nfs/statd
    root  7272     1  0 11:42:40 ?        0:00 /usr/lib/nfs/mountd
    root  7273     1  0 11:42:40 ?        0:06 /usr/lib/nfs/nfslogd
    root  7275     1  0 11:42:40 ?        0:31 /usr/lib/nfs/nfsd

You will now see the /var/nfs directory growing. The NFS log files are very useful to find out about who used which shares at what point in time.