Automount lookup request tracing

Question

Hello all,
I am getting lots of entries in my messages file for some process that is trying to access a nfs automount directory that doesn't exist.
Is there a way I can track down what program is trying to access this.
May  5 20:12:09 server1 automountd[22775]: [ID 801587 daemon.error] mynfsserver:/home/lib: No such file or directory
May  5 20:12:09 server1 last message repeated 5 times
May  5 20:15:58 server1 automountd[22775]: [ID 801587 daemon.error] mynfsserver:/home/lib: No such file or directory
May  5 20:17:09 server1 last message repeated 17 times
May  5 20:22:09 server1 automountd[22775]: [ID 801587 daemon.error] mynfsserver:/home/lib: No such file or directoryWe do have autofs and nfs on and do share some things under the /home share, but nothing under /home/lib. So something is trying to access that repeatedly.
I turned on some automount debugging, but it doesn't show me what process or program is causing it.
I ran a "ls -l /net/=9" to turn on debugging. Then I looked at "/var/svc/log/system-filesystem-autofs:default.log" logs and it shows some information:
t14     LOOKUP REQUEST: Tue May  5 20:15:58 2009
t14       name=lib[] map=auto_home opts=nobrowse path=/home direct=0
t14       PUSH /etc/auto_home
t14     getmapent_ldap called
t14     getmapent_ldap: key=[ lib ]
t14     ldap_match called
t14     ldap_match: key =[ lib ]
t14     ldap_match: ldapkey =[ lib ]
t14       ldap_match: Requesting list for (&(objectClass=automount)(automountKey=lib)) in auto_home
t14       ldap_match: __ns_ldap_list FAILED (2)
t14       ldap_match: no entries found
t14     ldap_match called
t14     ldap_match: key =[ \2a ]
t14     ldap_match: ldapkey =[ \2a ]
t14       ldap_match: Requesting list for (&(objectClass=automount)(automountKey=\2a)) in auto_home
t14       ldap_match: __ns_ldap_list OK
t14       ldap_match: found: mynfsserver:/home/&
t14     getmapent_ldap: exiting ...
t14       POP /etc/auto_home
t14       mapline: mynfsserver:/home/&
t14
        mapline_to_mapent:
t14       (,)    /lib -
t14             me->map_fsw=mynfsserver:/home/lib
t14              mntlevel=-1    modify=FALSE    faked=FALSE err=0
t14
        hierarchical_sort:
        (, -1, )
t14
        push_options (return)
        default options=nobrowse
        (, -1, nobrowse)
t14
        parse_fsinfo:
t14       (nfs,nfs)      /lib -nobrowse
                mynfsserver:/home/lib
t14             me->map_fsw=
t14              mntlevel=-1    modify=FALSE    faked=FALSE err=0
t14       node mountpoint        travpath=
t14
        set_and_fake_mapent_mntlevel
        (, 0, nobrowse)
t14
        modify_mapents:
t14       (nfs,nfs)      /lib -nobrowse
                mynfsserver:/home/lib
t14             me->map_fsw=
t14              mntlevel=0     modify=FALSE    faked=FALSE err=0
t14       do_lookup1: action=0 wildcard=TRUE error=0
t14     LOOKUP REPLY    : status=0But I really need to track down and stop the process or program from doing it.
Thanks
Steve

Answer 1

Seems like a good target for dtrace. I'd start with the dtrace toolkit and take a look at 'opensnoop'. I'm hoping that your process is actually trying to open the file and not just stat it or something. Grep for your filesystem. I don't think you can pass the unmountable directory to the snoop because it'll want the full path to the file, and you don't know that.
Darren