Identifying writes to NFS

Alexander Viro aviro at redhat.com
Wed May 30 17:56:34 UTC 2007


On Wed, May 30, 2007 at 05:35:28PM +0100, Matthew Booth wrote:
> I'd like to be able to reliably recognise a PATH record which refers to
> an NFS mount. It seems that dev=00:xx would be related to the answer.
> However, each mount seems to have its own value of xx, and other mounts
> not backed by a block device, eg /proc and /dev, also have dev=00:xx. 
> 
> The answer can't be related to a single system, as the solution has to
> be rolled out across a large estate with a variety of nfs mounts on
> particular servers.
> 
> Any ideas? Thanks,

man statfs, look at f_type field there.




More information about the Linux-audit mailing list