Managing NFS and NIS, 2nd Edition - Mike Eisler [225]
NFS log cycling
The nfslogd daemon periodically cycles the logs to prevent an individual file from becoming extremely large. By default, the ten most current NFS log files are located in /var/nfs and named nfslog, nfslog.0, through nfslog.9. The file nfslog being the most recent, followed by nfslog.1 and nfslog.9 being the oldest. The log files are cycled every 24 hours, saving up to 10 days worth of logs. The number of logs saved can be increased by setting MAX_LOGS_PRESERVE in /etc/default/nfslogd. The cycle frequency can be modified by setting CYCLE_FREQUENCY in the same file.
Manipulating NFS log files
Sometimes it may be desirable to have the nfslogd daemon close the current file, and log to a fresh new file. The daemon holds an open file descriptor to the log file, so renaming it or copying it somewhere else may not achieve the desired effect. Make sure to first shut down the daemon before manipulating the log files. To shut down the daemon, send it a SIGHUP signal. This will give the daemon enough time to flush pending transactions to the log file. You can use the Solaris pkill command to send the signal to the daemon. Note that the daemon can take a few seconds to flush the information:
# pkill -HUP -x -u 0 nfslogd
Sending it a SIGTERM signal will simply close the buffer files, but pending transactions will not be logged to the file and will be discarded.
Other configuration parameters
The configuration parameters in the /etc/default/nfslogd tune the behavior of the nfslogd daemon. The nfslogd daemon reads the configuration parameters when it starts, therefore any changes to the parameters will take effect the next time the daemon is started. Here is a list of the parameters:
UMASK
Used to set the file mode used to create the log files, work buffer files, and filehandle mapping tables. Needless to say one has to be extremely careful setting this value, as it could open the doors for unathorized access to the log and work files. The default is 0x137, which gives read/write access to root, read access to the group that started the nfslogd daemon, and no access to other.
MIN_PROCESSING_SIZE
The nfslogd daemon waits until MIN_PROCESSING_SIZE bytes are gathered in the work buffer file before it starts processing any information. The idea is to wait long enough for information to gather to make the processing worth while. Note that the nfslogd daemon will process the work buffer regardless of the size after an implementation timer fires indicating that the work buffer has been ignored for too long. The default value is 512 Kb.
IDLE_TIME
The nfslogd daemon sleeps up to IDLE_TIME seconds waiting for information to be gathered in the work buffer files. This value indirectly affects the frequency with which the nfslogd daemon checks updates of the file /etc/nfs/nfslog.conf. Increasing this value too much will cause the temporary work buffer files to become large, potentially using more disk space than desired. Making this value too short will cause the nfslogd daemon to wake up frequently and potentially have nothing to do since the MIN_PROCESSING_SIZE of its buffers may not have been reached.
MAX_LOGS_PRESERVE
The nfslogd daemon periodically cycles the logs in order to keep their size manageable. This value specifies the maximum number of logs to save in the log directory. When this value is reached, the oldest log is discarded to make room for a new log. The logs are saved with a numbered extension, beginning with .0 through .MAX_LOGS_PRESERVE-1. The oldest log will be the one with the highest numbered extension.
Consider the following three tags:
Excerpt from