[OpenAFS] Is anyone else seeing this:

[Kim Kimball]

> Audit logs can be written to files or pipes.  You can write the output
> to a filter application that does whatever you want with it. 
We're using the FIFO/named pipe with great success since Jeffrey 
implemented it a couple of years ago.

The only things we've run into is that 1) the FIFO (in Solaris, 
'mkfifo') must exist before the fileserver is started, and 2) the 
process reading the pipe must start reading the pipe before the writer 
(fileserver) starts writing.  (Solaris 5.9)

The FIFO is static -- once it's created it's not renamed to .OLD as the 
other log files are -- the audit log is a separate entity and not 
handled by the .OLD code.  IOW it gets created once and unless someone 
clobbers it you're done.

To ensure correct behavior I modified the AFS startup script such that 
it checks for the existence of the FIFO and then starts the pipereader 
before the bosserver is started.  IIRC I also sleep for 3 seconds, 
probably out of superstition. In any case it works fine.

We set up the pipe reader to close the output file and open a new one 
every minute, using a timestamp as part of the name.  I also set up a 
cron job to control the number of piperead log files that are retained.  
Since the output files are not in use (the motivation for the 60 second 
close/open new) the cron job can rm the output files without creating 
orphaned/hidden files that are still being written to. 

The output from a busy fileserver is copious over the course of the day. 

Have fun!

Kim


Jeffrey Altman wrote:
> Steve Devine wrote:
>> Jeffrey Altman wrote:
>>> If you are interested in knowing where the files are coming from turn
>>> on audit logs on the file servers.  That will erase all doubts.
>> Ok does this require a fileserver restart?
>
> Yes.
>
>> I also worry about the size of the logs.
>
> Audit logs can be written to files or pipes.  You can write the output
> to a filter application that does whatever you want with it.
>
> Audit logs generate data for every request that arrives at the file
> server.  If you have busy file servers, you will generate a lot of data.
>
>
> _______________________________________________
> OpenAFS-info mailing list
> OpenAFS-info@openafs.org
> https://lists.openafs.org/mailman/listinfo/openafs-info
>
>
>