I've got a Linux server (Red Hat Enterprise Linux AS release 4) that is running nfsd. Is there a way to find out which file(s) are currently in use on the server?

Occasionally the server CPU usage spikes to over 100% and the only thing using a nontrivial amount of CPU time is nfsd. I'm curious to find out what is causing that activity.


I was able to get an idea of what files were being accessed using an indirect method:

tcpdump -s 192 port nfs

Among a serious amount of chaff, there are "lookup" packets that contain the filename that is being opened. This doesn't include the full pathname so it's still a bit of a guessing game, but it's better than nothing.


man lsof

E.g., if the nfsd has the pid 2645, then do:

lsof -p 2645
  • 1
    nsfd seems to do something different from normal file access. First, there are several instances of nfsd. Second, lsof only shows three open files, two / (root directory) and one /proc/2833/exe (the process binary). No other files are shown. – Greg Hewgill Nov 9 '09 at 22:45
  • 3
    lsof may work for a user mode NFS server like unfsd, but it may not work for the kernel nfs server. – Suppressingfire Nov 11 '09 at 16:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.