2002-06-14 21:31:57

by Roberto Nibali

[permalink] [raw]
Subject: NFS (vfs-related) syscall logging

--- /usr/src/linux/fs/nfsd/vfs.c Wed May 8 14:25:38 2002
+++ vfs.c Fri Jun 14 15:24:05 2002
@@ -77,6 +77,15 @@
static struct raparms * raparml;
static struct raparms * raparm_cache;

+static void print_dirname(struct dentry *getdentry) {
+ if ((getdentry != NULL) && !IS_ROOT(getdentry)){
+ print_dirname(getdentry->d_parent);
+ }
+ if (!IS_ROOT(getdentry)) {
+ printk("/%s", getdentry->d_name.name);
+ }
+}
+
/*
* Look up one component of a pathname.
* N.B. After this call _both_ fhp and resfh need an fh_put
@@ -490,6 +499,13 @@
*/
atomic_dec(&filp->f_count);
}
+ printk(KERN_INFO "NFSLOG UID=%d GID=%d FILE=",
+ rqstp->rq_cred.cr_uid,
+ rqstp->rq_cred.cr_gid);
+ print_dirname(dentry);
+ printk(" OP=%s IP=%d.%d.%d.%d\n",
+ __FUNCTION__,
+ NIPQUAD(rqstp->rq_addr.sin_addr.s_addr));
}
out_nfserr:
if (err)
@@ -648,6 +664,14 @@
err = 0;
} else
err = nfserrno(err);
+
+ printk(KERN_INFO "NFSLOG UID=%d GID=%d FILE=",
+ rqstp->rq_cred.cr_uid,
+ rqstp->rq_cred.cr_gid);
+ print_dirname(fhp->fh_dentry);
+ printk(" OP=%s IP=%d.%d.%d.%d\n",
+ __FUNCTION__,
+ NIPQUAD(rqstp->rq_addr.sin_addr.s_addr));
out_close:
nfsd_close(&file);
out:
@@ -769,6 +793,14 @@
err = 0;
else
err = nfserrno(err);
+
+ printk(KERN_INFO "NFSLOG UID=%d GID=%d FILE=",
+ rqstp->rq_cred.cr_uid,
+ rqstp->rq_cred.cr_gid);
+ print_dirname(fhp->fh_dentry);
+ printk(" OP=%s IP=%d.%d.%d.%d\n",
+ __FUNCTION__,
+ NIPQUAD(rqstp->rq_addr.sin_addr.s_addr));
out_close:
nfsd_close(&file);
out:
@@ -925,6 +957,14 @@
*/
if (!err)
err = fh_update(resfhp);
+ printk(KERN_INFO "NFSLOG UID=%d GID=%d FILE=",
+ rqstp->rq_cred.cr_uid,
+ rqstp->rq_cred.cr_gid);
+ print_dirname(dentry);
+ printk("/%s", fname);
+ printk(KERN_INFO " OP=%s IP=%d.%d.%d.%d\n",
+ __FUNCTION__,
+ NIPQUAD(rqstp->rq_addr.sin_addr.s_addr));
out:
return err;

@@ -1036,6 +1076,15 @@
if (err)
goto out;

+ printk(KERN_INFO "NFSLOG UID=%d GID=%d FILE=",
+ rqstp->rq_cred.cr_uid,
+ rqstp->rq_cred.cr_gid);
+ print_dirname(dentry);
+ printk("/%s", fname);
+ printk(" OP=%s IP=%d.%d.%d.%d\n",
+ __FUNCTION__,
+ NIPQUAD(rqstp->rq_addr.sin_addr.s_addr));
+
if (createmode == NFS3_CREATE_EXCLUSIVE) {
/* Cram the verifier into atime/mtime/mode */
iap->ia_valid = ATTR_MTIME|ATTR_ATIME
@@ -1103,6 +1152,13 @@
goto out_nfserr;
*lenp = err;
err = 0;
+ printk(KERN_INFO "NFSLOG UID=%d GID=%d FILE=",
+ rqstp->rq_cred.cr_uid,
+ rqstp->rq_cred.cr_gid);
+ print_dirname(dentry);
+ printk(" OP=%s IP=%d.%d.%d.%d\n",
+ __FUNCTION__,
+ NIPQUAD(rqstp->rq_addr.sin_addr.s_addr));
out:
return err;

@@ -1163,6 +1219,13 @@

/* Compose the fh so the dentry will be freed ... */
cerr = fh_compose(resfhp, fhp->fh_export, dnew, fhp);
+ printk(KERN_INFO "NFSLOG UID=%d GID=%d FILE=",
+ rqstp->rq_cred.cr_uid,
+ rqstp->rq_cred.cr_gid);
+ print_dirname(dentry);
+ printk(" OP=%s IP=%d.%d.%d.%d\n",
+ __FUNCTION__,
+ NIPQUAD(rqstp->rq_addr.sin_addr.s_addr));
if (err==0) err = cerr;
out:
return err;
@@ -1302,6 +1365,14 @@
}
dput(ndentry);

+ printk(KERN_INFO "NFSLOG UID=%d GID=%d FILE=",
+ rqstp->rq_cred.cr_uid,
+ rqstp->rq_cred.cr_gid);
+ print_dirname(fdentry);
+ printk(" OP=%s IP=%d.%d.%d.%d\n",
+ __FUNCTION__,
+ NIPQUAD(rqstp->rq_addr.sin_addr.s_addr));
+
out_dput_old:
dput(odentry);
out_nfserr:
@@ -1373,6 +1444,15 @@
goto out_nfserr;
if (EX_ISSYNC(fhp->fh_export))
nfsd_sync_dir(dentry);
+
+ printk(KERN_INFO "NFSLOG UID=%d GID=%d FILE=",
+ rqstp->rq_cred.cr_uid,
+ rqstp->rq_cred.cr_gid);
+ print_dirname(dentry);
+ printk("/%s", fname);
+ printk(" OP=%s IP=%d.%d.%d.%d\n",
+ __FUNCTION__,
+ NIPQUAD(rqstp->rq_addr.sin_addr.s_addr)); //ratz

out:
return err;


Attachments:
nfslog-2.4.19p10-3.diff (3.66 kB)

2002-06-16 20:44:04

by Trond Myklebust

[permalink] [raw]
Subject: Re: NFS (vfs-related) syscall logging

>>>>> " " == Roberto Nibali <[email protected]> writes:

> I will extend it and add yet another proc-fs variable in
> /proc/sys/sunrpc/ which will represent a bitmask to selectively
> enable/disable which syscalls should be logged.


Ugh...

The volume of information you propose to log is going to be seriously
huge and *will* affect performance. It would probably be a lot more
efficient to log using 'tcpdump' (and the libpcap binary format)
instead of all those printks.

Cheers,
Trond