[ale] Who's pounding on my NFS server?

John Heim john at johnheim.net
Thu Sep 22 17:50:34 EDT 2011


Okay, I wrote a perl script to parse the output from ngrep (I was already 
familiar with ngrep), count how many packets were coming from each machine, 
and print percentages. So now I have a real nice command to show me who's 
pounding my file server.

So far so good. I wish I had a solution for the gvfs problem.  But at least 
if it rears its ugly head again I'll be able to deal with it.

My perl script showed me another problem... NFS mouting home directories on 
a Mac also causes problems. It tries to create files for finder to use 
(DS_Store) at the root level of the filesystem. But even if you disable 
that, when a user logs into a Mac with and gets his home directory mounted, 
it creates a heavy load on the file server. I think its just plain old 
inefficiency though, not a bug.

From: "Scott McBrien" <smcbrien at gmail.com>
To: "Atlanta Linux Enthusiasts" <ale at ale.org>
Sent: Thursday, September 22, 2011 1:59 PM
Subject: Re: [ale] Who's pounding on my NFS server?


Maybe use tcpdump looking for traffic on port 2 0 4 9, then doing a cut or 
awk to grab the ip s, followed by a sort piped to uniq - c ?  Then you'll 
have a count of the connecting IP s, and how many packets you've received 
from each?

-Scott



On Sep 22, 2011, at 2:39 PM, Andrew Wade <andrewiwade at gmail.com> wrote:

> I'd run wireshark on the server and filter by NFS write requests and look 
> at what source IP keeps showing up:
>
>
> http://wiki.wireshark.org/NFS_Preferences
>
> On Thu, Sep 22, 2011 at 2:29 PM, Erik Mathis <erik at mathists.com> wrote:
> You might can try using ntop and looking top talkers. iirc, you can
> group by protocol. ntop gives you the ability to enlarge the text
> using CTRL + in your browser.
>
> -Erik-
>
>
> On Thu, Sep 22, 2011 at 1:55 PM, John Heim <john at johnheim.net> wrote:
> > How can I tell which machines are pounding my NFS server?
> >
> > There's a bug in gvfs that causes it to do bocu writes on NFS mounted 
> > home
> > directories. This is what's been causing the slowness problem I've been
> > asking about on this list for the past couple of weeks. So I now know 
> > its
> > caused by the bug in gvfs but I don't have a good way to tell which 
> > machine
> > is currently doing all the NFS writes.
> >
> > Well, I should add that I'm blind and if I run netstat or ngrep, I have 
> > a
> > hard time with the output. I'm looking for something like top or iotop 
> > only
> > for nfs.
> >
> >
> >
> > _______________________________________________
> > Ale mailing list
> > Ale at ale.org
> > http://mail.ale.org/mailman/listinfo/ale
> > See JOBS, ANNOUNCE and SCHOOLS lists at
> > http://mail.ale.org/mailman/listinfo
> >
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://mail.ale.org/mailman/listinfo/ale
> See JOBS, ANNOUNCE and SCHOOLS lists at
> http://mail.ale.org/mailman/listinfo
>
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://mail.ale.org/mailman/listinfo/ale
> See JOBS, ANNOUNCE and SCHOOLS lists at
> http://mail.ale.org/mailman/listinfo



--------------------------------------------------------------------------------


> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://mail.ale.org/mailman/listinfo/ale
> See JOBS, ANNOUNCE and SCHOOLS lists at
> http://mail.ale.org/mailman/listinfo
> 



More information about the Ale mailing list