Managing NFS and NIS, 2nd Edition - Mike Eisler [219]
PathName
Absolute pathname of the object accessed on the server. This pathname is always reported from the server's namespace point of view. It is possible for the server to be unable to map NFS filehandles to pathnames. In such a case, the NFS filehandle is printed instead of the component name. See Section 14.6.5 for details. In the previous example, the PathName is /export/foo. The client may have mounted the pathname on /mnt or /net/zeus, but the pathname reported is always the server's absolute pathname.
DataType
Indicates the type of data transfer, ASCII transfers are denoted with a and binary transfers are denoted with b. NFS transfers are always binary; therefore, this field will always have a value of b.
TransferOption
Indicates any special processing performed by the service. For FTP logs, it indicates if the WU-ftpd daemon performed any kind of compression (denoted with C ), or if the file was tarred (denoted by T ), or if the file was uncompressed (denoted with U ). For NFS transfers this field will always have a value of `_', since no special action is performed by the NFS server.
Operation
The operation performed by the server, by default this is either i for incoming (upload) or o for outgoing (download). Note that this is always relative to the server. If the extended log format is in use, the operation is reported in extended format (i.e., read, write, create, setattr, mkdir, etc.). Note that this is incompatible with the WU-ftpd log format and existing unmodified tools that process these type of logs will not be able to process the extended NFS log. In the previous example the client read the file, which means it was downloaded from the server, therefore the log denotes this with an o.
AccessMode
Indicates the type of the user accessing the file. For FTP transfers, a guest user is denoted as g, an anonymous user is denoted as a and the real user is denoted as r. All NFS transfers report the real user identifier contained in the RPC; therefore, this field will alway be r.
UserID
User identifier (UID) used for the NFS operations. Note that the logging utility makes no attempt to map the uid to the user name. Doing this could lead to incorrect mappings when the request arrives from a different name service domain than the one the server belongs to. Different name service domains do not necessarily share the same user name space. UID 32721 on the Eng domain may map to a very different user on the Corp domain. In the previous example it is 32721.
Service
Type of service accessed by the client. The basic log format entry reports nfs. The extended log format entry reports the NFS version and protocol as well. NFS Version 3 over TCP is reported as nfs3-tcp in the extended log format, and as nfs in the basic log format.
Authenticated
Indicates whether the user is authenticated or not. A value of 0 indicates that the user is not authenticated, or using the AUTH_SYS RPC authentication. A value of 1 means that the user is authenticated via extended methods (such as AUTH_DES) and the next field will include the user's principle name. In the previous example the client is using AUTH_SYS, therefore the field is 0.
PrincipleName
The user's principle name if authenticated; otherwise, the field will be `*'.
NFS server logging mechanics
There are three main components involved in the logging process. First, the share command is used to enable NFS Logging on the filesystem. Second, the kernel stores enough information about each RPC operation in a temporary work buffer file. Third, the nfslogd daemon processes the RPC information stored in the temporary work buffer file, consolidates the operations into file transfer operations and generates the final NFS log file.
Table 14-2 lists the various files involved in the logging process, the information contained in them, who or what program creates and modifies them and who consumes their contents. The /var/nfs/nfslog file contains the actual NFS transaction log records.