'\" te .\" Copyright (c) 1999, Sun Microsystems, Inc. .\" All Rights Reserved. .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License. .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License. .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner] .TH NFSLOGD 1M "Dec 2, 2004" .SH NAME nfslogd \- nfs logging daemon .SH SYNOPSIS .LP .nf \fB/usr/lib/nfs/nfslogd\fR .fi .SH DESCRIPTION .sp .LP The \fBnfslogd\fR daemon provides operational logging to the Solaris \fBNFS\fR server. It is the \fBnfslogd\fR daemon's job to generate the activity log by analyzing the \fBRPC\fR operations processed by the \fBNFS\fR server. The log will only be generated for file systems exported with logging enabled. This is specified at file system export time by means of the \fBshare_nfs\fR(1M) command. .sp .LP NFS server logging is not supported on Solaris machines that are using NFS Version 4. .sp .LP Each record in the log file includes a time stamp, the \fBIP\fR address (or hostname if it can be resolved) of the client system, the file or directory name the operation was performed on, and the type of operation. In the basic format, the operation can either be an input (i) or output (o) operation. The basic format of the \fBNFS\fR server log is compatible with the log format generated by the Washington University \fBFTPd\fR daemon. The log format can be extended to include directory modification operations, such as \fBmkdir\fR, \fBrmdir\fR, and \fBremove\fR. The extended format is not compatible with the Washington University \fBFTPd\fR daemon format. See \fBnfslog.conf\fR(4) for details. .sp .LP The \fBNFS\fR server logging mechanism is divided in two phases. The first phase is performed by the \fBNFS\fR kernel module, which records raw \fBRPC\fR requests and their results in work buffers backed by permanent storage. The location of the work buffers is specified in the /\fBetc/nfs/nfslog.conf\fR file. Refer to \fBnfslog.conf\fR(4) for more information. The second phase involves the \fBnfslogd\fR user-level daemon, which periodically reads the work buffers, interprets the raw \fBRPC\fR information, groups related \fBRPC\fR operations into single transaction records, and generates the output log. The \fBnfslogd\fR daemon then sleeps waiting for more information to be logged to the work buffers. The amount of time that the daemon sleeps can be configured by modifying the \fBIDLE_TIME\fR parameter in \fB/etc/default/nfslogd\fR. The work buffers are intended for internal consumption of the \fBnfslogd\fR daemon. .sp .LP \fBNFS\fR operations use file handles as arguments instead of path names. For this reason the \fBnfslogd\fR daemon needs to maintain a database of file handle to path mappings in order to log the path name associated with an operation instead of the corresponding file handle. A file handle entry is added to the database when a client performs a lookup or other \fBNFS\fR operation that returns a file handle to the client. .sp .LP Once an \fBNFS\fR client obtains a file handle from a server, it can hold on to it for an indefinite time, and later use it as an argument for an \fBNFS\fR operation on the file or directory. The \fBNFS\fR client can use the file handle even after the server reboots. Because the database needs to survive server reboots, it is backed by permanent storage. The location of the database is specified by the \fIfhtable\fR parameter in the \fB/etc/nfs/nfslog.conf\fR file. This database is intended for the internal use of the \fBnfslogd\fR daemon. .sp .LP In order to keep the size of the file handle mapping database manageable, \fBnfslogd\fR prunes the database periodically. It removes file handle entries that have not been accessed in more than a specified amount of time. The \fBPRUNE_TIMEOUT\fR configurable parameter in \fB/etc/default/nfslogd\fR specifies the interval length between successive runs of the pruning process. A file handle record will be removed if it has not been used since the last time the pruning process was executed. Pruning of the database can effectively be disabled by setting the \fBPRUNE_TIMEOUT\fR as high as \fBINT_MAX\fR. .sp .LP When pruning is enabled, there is always a risk that a client may have held on to a file handle longer than the \fBPRUNE_TIMEOUT\fR and perform an \fBNFS\fR operation on the file handle after the matching record in the mapping database had been removed. In such case, the pathname for the file handle will not be resolved, and the log will include the file handle instead of the pathname. .sp .LP There are various configurable parameters that affect the behavior of the \fBnfslogd\fR daemon. These parameters are found in \fB/etc/default/nfslogd\fR and are described below: .sp .ne 2 .na \fB\fBUMASK\fR\fR .ad .RS 27n Sets the file mode for the log files, work buffer files and file handle mapping database. .RE .sp .ne 2 .na \fB\fBMIN_PROCESSING_SIZE\fR\fR .ad .RS 27n Specifies the minimum size, in bytes, that the buffer file must reach before processing the work information and writing to the log file. The value of \fBMIN_PROCESSING_SIZE\fR must be between 1 and \fBulimit\fR. .RE .sp .ne 2 .na \fB\fBIDLE_TIME\fR\fR .ad .RS 27n Specifies the amount of time, in seconds, the daemon should sleep while waiting for more information to be placed in the buffer file. \fBIDLE_TIME\fR also determines how often the configuration file will be reread. The value of \fBIDLE_TIME\fR must be between 1 and \fBINT_MAX\fR. .RE .sp .ne 2 .na \fB\fBMAX_LOGS_PRESERVE\fR\fR .ad .RS 27n The \fBnfslogd\fR periodically cycles its logs. \fBMAX_LOGS_PRESERVE\fR specifies the maximum number of log files to save. When \fBMAX_LOGS_PRESERVE\fR is reached, the oldest files will be overwritten as new log files are created. These files will be saved with a numbered extension, beginning with \fBfilename.0\fR. The oldest file will have the highest numbered extension up to the value configured for \fBMAX_LOGS_PRESERVE\fR. The value of \fBMAX_LOGS_PRESERVE\fR must be between 1 and \fBINT_MAX\fR. .RE .sp .ne 2 .na \fB\fBCYCLE_FREQUENCY\fR\fR .ad .RS 27n Specifies how often, in hours, the log files are cycled. \fBCYCLE_FREQUENCY\fR is used to insure that the log files do not get too large. The value of \fBCYCLE_FREQUENCY\fR must be between 1 and \fBINT_MAX\fR. .RE .sp .ne 2 .na \fB\fBMAPPING_UPDATE_INTERVAL\fR\fR .ad .RS 27n Specifies the time interval, in seconds, between updates of the records in the file handle to path mapping tables. Instead of updating the \fBatime\fR of a record each time that record is accessed, it is only updated if it has aged based on this parameter. The record access time is used by the pruning routine to determine whether the record should be removed from the database. The value of this parameter must be between 1 and \fBINT_MAX\fR. .RE .sp .ne 2 .na \fB\fBPRUNE_TIMEOUT\fR\fR .ad .RS 27n Specifies when a database record times out, in hours. If the time that elapsed since the record was last accessed is greater than \fBPRUNE_TIMEOUT\fR then the record can be pruned from the database. The default value for \fBPRUNE_TIMEOUT\fR is 168 hours (7 days). The value of \fBPRUNE_TIMEOUT\fR must be between 1 and \fBINT_MAX\fR. .RE .SH EXIT STATUS .sp .LP The following exit values are returned: .sp .ne 2 .na \fB\fB0\fR\fR .ad .RS 5n Daemon started successfully. .RE .sp .ne 2 .na \fB\fB1\fR\fR .ad .RS 5n Daemon failed to start. .RE .SH FILES .sp .ne 2 .na \fB\fB/etc/nfs/nfslogtab\fR \fR .ad .RS 24n .RE .sp .ne 2 .na \fB\fB/etc/nfs/nfslog.conf\fR\fR .ad .RS 24n .RE .sp .ne 2 .na \fB\fB/etc/default/nfslogd\fR\fR .ad .RS 24n .RE .SH SEE ALSO .sp .LP \fBshare_nfs\fR(1M), \fBnfslog.conf\fR(4), \fBattributes\fR(5)