Filesystem monitoring question

Daniel Ellard ellard at
Fri Nov 18 14:55:42 GMT 2005

There are many possible answers to this question.  Can you explain
more about exactly what you need?

Depending on what you can and cannot access, one method is to sniff
the network or the network interface.  This will tell you when write
requests come to the server, but can require a great deal of careful
bookkeeping to know which write was to what file, etc.  And it also
doesn't tell you what the file system is doing, because these writes
might be delayed/clustered/die in the cache.  But it's a technique you
can do on a machine for which you don't even have a login.

If you were on Solaris, the answer is DTrace.  But then you wouldn't
be posting to this group...

IIRC some of folks at SUNY Stony Brook (Erez Zadok's students, I
think) have a VFS shim that traces calls through the VFS layer.  If
everything you're doing goes through VFS, that would work.  But if
it's a production server, you might not be able to get permission to
fiddle with the kernel.

ktrace might do everything you need, but I understand that it has an
impact on system performance under load.  I don't know if that matters
to you at all.  It also might be awkward if the SMB and NFS servers
are kernel processes.  (I just don't know; I've only used ktrace on
ordinary user-land processes, and not even much of that.)


More information about the freebsd-hackers mailing list