Our CentOS6 NFS export is near 100% capacity. We've turned off NFS for now and are trying to move data around. I temporarily turned it back on with logging on and was surprised to see data roaring back into the NFS directories. There's no information in the log about who is doing the writing. I'd like to find out where these writes are coming from, who is doing them, and which directory they're writing to. Unfortunately, the logs don't really show me the identities of who/where they are coming from. Any hints on how to get that information?

Thanks in advance!

  • There really isn't any way to find out who is writing to the export unless you're going to monitor processes on every machine that has the exports mounted. You can du /path/to/export | sort -rn > outputfile on the machine which will output the largest file sizes to a file and you can review it to see what's taking up the space. Perhaps that will give you a better idea of what's happening. – Nasir Riley May 8 '18 at 23:52
  • re-enable but firewall off and look for connection attempts in the fw logs? if a small enough ip pool, re-allow small blocks at a time until writes start flooding in... – ivanivan May 8 '18 at 23:55

I found some good answers in this AskUbuntu question.

I would stress the answer that uses:

iftop -P -i <interface name (e.g. enp1s0)>

to show traffic sorted by volume on a port and then uses:

sudo netstat -tup <port number>

to identify which PID is using which port.

Once you have the PID, you're home free.


I would suggest to use 'wireshark' tool to monitor network traffic. With filters set to show only NFS traffic you will be able to identify network hosts writing to your NFS server.

  • Wireshark is good. Maybe too good for this job. Don't misunderstand me, I mean well, but that program is a little complex to me at least. – LinuxSecurityFreak May 9 '18 at 11:06
  • Wireshark is very easy to use: Launch wireshark GUI. Select network card. Start capturing traffic. Select line marked with NFS. From context menu select apply it as filter. Write down displayed IP address, from context menu add it as exclude filter. Repeat it until list gets empy. – John Doe May 9 '18 at 11:29
  • Put that to your answer. – LinuxSecurityFreak May 9 '18 at 11:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.