ANALYZE.CIFS.SERVER(1)ANALYZE.CIFS.SERVER(1)NAMEanalyze.cifs.server - CIFS server (Samba) log file analysis utility,
designed to report useage statistics on type, frequency and duration of
SMB requests.
SYNOPSISanalyze.cifs.server [-c] [-h] [-D] <filename>
DESCRIPTION
Utility for analyzing the contents of a CIFS server log file for the
quantity of different SMB requests handled by a CIFS Server SMBD
process. Also provides the:
- average, minimum and maximum response time for each SMB re‐
quest
- total summary of the most frequently seen request
- the request using the most time as measured in total number of
seconds of processing time
- # of requests processed
- # of different types of requests
- total logfile duration
OPTIONS-c Output for use as a Comma Separated Values (CSV) file
-D Outputs debug information during analysis (for use by developer
of script only)
<filename>
Filename to be analysed. This is a required parameter.
DEPENDENCIESanalyze.cifs.server is a Perl script and requires a Perl interpreter to
be installed on the system where it is being run. To run on a Windows
or Linux based system use the ActiveState Perl interpreter from
http://www.activestate.com/Products/ActivePerl/.
log file: The CIFS server log file needs to be collected with the fol‐
lowing characteristics:
- a debug level of at least 3, but using 6 or above will provide
a more accurate statement of the time consumed during each CIFS
requests.
- high resolution timestamps enabled to collect time information
accurately
- correct logging defined to provide a separate log file per us‐
er or machine as opposed to one log file for all users / ma‐
chines.
- log file large enough to collect the full client transaction
being assessed
CONFIGURATION
Details for log file configuration: CIFS server logging should be set
to level 3 or above using one of the following two techniques:
- Add the line "log level = #" to the smb.conf configuration
file contained in /etc/opt/samba where # = 3 or greater. NOTE:
This will turn up this level of logging for ALL CIFS server SMBD
processes. Please be aware of the quantity of disk space that
turning on logging for all processes may create.
- To analyse an individual CIFS SMBD process you can increase
the level of logging for that process using the command: "kill
-USR1 <PID>" where PID = process ID of the SMBD being moni‐
tored. Each time this command is run the logging level is in‐
creased by one, so if the default log level defined in smb.conf
is "log level = 1", then you will need to execute this command 5
times to increase the logging level to 6. To decrease logging
again use the corresponding command: "kill -USR2 <PID>", and
repeat the required number of times to decrease the loggin back
to the default value. This method is supported for HP CIFS
Server version A.01.11.04 and below.
For HP Cifs Server A.02.01 and above, change the debug level of
a single smbd process using the /opt/samba/bin/smbcontrol pro‐
gram:
smbcontrol <PID> debug [3|6]
High resolution timestamps should be enabled by adding the following
line to the smb.conf configuration file: "debug hires timestamp =
yes", and "debug timestamp - yes"
Separate log files should be created by using one of the standard macro
definitions available in the smb.conf file such as:
%m gives per client machine logging as defined by the NetBIOS name
of the machine.
%U gives per user logging
%I gives per client IP address logging
The macro is simply appended to the standard debug log location in the
line in the configuration file: log file = <folder loca‐
tion>/log.<macro>
eg. log file = /var/opt/samba/log.%m
Samba log files are created in pairs: <logfile> and <logfile>.old
When the first log is full it is copied to <logfile>.old and then log‐
ging continues to <logfile>, so if a logfile size of 5000 kB is defined
using:
max log size = 5000 (default: 1000kBytes = 1Mbyte)
then this will log a total of 10 Mbytes of data into the two files and
they can then be concatenated together to create a single large file
for analysis. Remember that for higher levels of debugging a log file
will fill more rapidly and will contain less individual CIFS requests
for analysis.
EXAMPLES
This was done using the command:
$ analyze.cifs.server log.johnc2
Debug level found: 3
SMBchkpth:
Total time consumed: 0.00398199998744531
Average time consumed: 0.00132733332914844
Minimum time consumed: 0.00129199999355478
Maximum time consumed: 0.0013589999944088
Number of times called: 3 SMBclose:
Total time consumed: 0.0270230000387528
Average time consumed: 0.00142226315993436
Minimum time consumed: 0.000444000004790723
Maximum time consumed: 0.00352700000075856
Number of times called: 19 SMBecho:
Total time consumed: 0.00100700000621146
Average time consumed: 0.00100700000621146
Minimum time consumed: 0.00100700000621146
Maximum time consumed: 0.00100700000621146
Number of times called: 1 SMBfindclose:
Total time consumed: 0.00623400000040419
Average time consumed: 0.000890571428629171
Minimum time consumed: 0.000854999998409767
Maximum time consumed: 0.000976999996055383
Number of times called: 7 SMBntcancel:
Total time consumed: 0.00974499999574618
Average time consumed: 0.00121812499946827
Minimum time consumed: 0.000905000000784639
Maximum time consumed: 0.00158399999781977
Number of times called: 8 SMBntcreateX:
Total time consumed: 0.0432750000036322
Average time consumed: 0.00196704545471055
Minimum time consumed: 0.000905000000784639
Maximum time consumed: 0.00464900000224588
Number of times called: 22 SMBnttrans:
Total time consumed: 0.0375030000141123
Average time consumed: 0.00129320689703836
Minimum time consumed: 0.00044000000343658
Maximum time consumed: 0.00436300000001211
Number of times called: 29 SMBreadX:
Total time consumed: 0.156680000000051
Average time consumed: 0.0120523076923116
Minimum time consumed: 0.000504000003274996
Maximum time consumed: 0.0470169999971404
Number of times called: 13 SMBtconX:
Total time consumed: 0.0493899999928544
Average time consumed: 0.0164633333309515
Minimum time consumed: 0.00961699999606935
Maximum time consumed: 0.0266389999960666
Number of times called: 3 SMBtrans:
Total time consumed: 0.0419080000065151
Average time consumed: 0.00419080000065151
Minimum time consumed: 0.00228200000128709
Maximum time consumed: 0.0189600000012433
Number of times called: 10 SMBtrans2:
Total time consumed: 0.149197999984608
Average time consumed: 0.00198930666646144
Minimum time consumed: 0.00046699999802513
Maximum time consumed: 0.00641999999788823
Number of times called: 75 SMBwrite:
Total time consumed: 0.0249350000012782
Average time consumed: 0.0124675000006391
Minimum time consumed: 0.0123209999946994
Maximum time consumed: 0.0126140000065789
Number of times called: 2 SMBwriteX:
Total time consumed: 0.00630800000362797
Average time consumed: 0.00105133333393799
Minimum time consumed: 0.000908000001800247
Maximum time consumed: 0.0012669999996433
Number of times called: 6
Summary:
Lines processed: 2068
Total CIFS requests made: 198
Unique CIFS requests: 13
Most called CIFS request: SMBtrans2
CIFS request taking longest time:
SMBreadX taking 0.0470169999971404 seconds
CIFS request using most total time:
SMBreadX taking 0.156680000000051 seconds
CIFS log duration(seconds): 80.5596299999961
AUTHORanalyze.cifs.server was written by Ian Jespersen and John Cheney of the
WTEC NOS Support Team.
ANALYZE.CIFS.SERVER(1)
