mjhjmtu

I'm auditing the files in a nfs share. When I look at the audit logs using the command ausearch -f /var/nfs/general , I get some logs that looks like this:

time->Tue Jun 12 16:23:34 2018
type=PROCTITLE msg=audit(1528800814.660:2782): proctitle=636174002F7661722F6E66732F67656E6572616C2F6E6673312E747874
type=PATH msg=audit(1528800814.660:2782): item=0 name="/var/nfs/general/nfs1.txt" inode=4063539 dev=08:01 mode=0100664 ouid=1001 ogid=1001 rdev=00:00 nametype=NORMAL
type=CWD msg=audit(1528800814.660:2782): cwd="/home/test"
type=SYSCALL msg=audit(1528800814.660:2782): arch=c000003e syscall=2 success=yes exit=3 a0=7ffc2c53c824 a1=0 a2=20000 a3=69d items=1 ppid=31104 pid=7295 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts18 ses=4294967295 comm="cat" exe="/bin/cat" key=(null)

Now how can I get the IP address and the host name of the client who accessed the nfs share files?

Is there any other way to find those details?

I want to gather the details such as time, date, IP address of the client, client host name, event occurred (like read, write, rename, change ownership to the file, delete or create a file in the nfs folder).

The gathered details are to be put in a separate file which can be used for further purposes.

How can I do this?

I'm a linux newbie. Please help me.

Thank You. :)

I'm afraid you can't do that with the standard in-kernel NFS server. The audit subsystem audits system calls (calls from userspace to the kernel) and no such syscalls for I/O operations are done by NFS as the NFS server runs directly inside the kernel.

Some possible ways to get a log of NFS operations could be:

• Enable NFS debug logging using rpcdebug and process the resulting logs.


• Trace the interesting NFS operations using the ftrace framework.


• Switch to an userspace NFS server such as Ganesha. (I'm not sure if it can log accesses. If not, you'd have to implement it yourself.)

In case you're wondering, the audit record you mentioned has nothing to do with NFS, that's just someone running cat /var/nfs/general/nfs1.txt locally.