Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a Linux server (Red Hat Enterprise Linux AS release 4) that is running nfsd. Is there a way to find out which file(s) are currently in use on the server?

Occasionally the server CPU usage spikes to over 100% and the only thing using a nontrivial amount of CPU time is nfsd. I'm curious to find out what is causing that activity.

share|improve this question
I posted a similar question here:… but never really got a satisfactory answer. – Kamil Kisiel Nov 9 '09 at 22:21

I was able to get an idea of what files were being accessed using an indirect method:

tcpdump -s 192 port nfs

Among a serious amount of chaff, there are "lookup" packets that contain the filename that is being opened. This doesn't include the full pathname so it's still a bit of a guessing game, but it's better than nothing.

share|improve this answer

man lsof

E.g., if the nfsd has the pid 2645, then do:

lsof -p 2645
share|improve this answer
nsfd seems to do something different from normal file access. First, there are several instances of nfsd. Second, lsof only shows three open files, two / (root directory) and one /proc/2833/exe (the process binary). No other files are shown. – Greg Hewgill Nov 9 '09 at 22:45
lsof may work for a user mode NFS server like unfsd, but it may not work for the kernel nfs server. – Suppressingfire Nov 11 '09 at 16:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.