I've got a Linux server (Red Hat Enterprise Linux AS release 4) that is running nfsd. Is there a way to find out which file(s) are currently in use on the server?
Occasionally the server CPU usage spikes to over 100% and the only thing using a nontrivial amount of CPU time is nfsd. I'm curious to find out what is causing that activity.
I was able to get an idea of what files were being accessed using an indirect method:
Among a serious amount of chaff, there are "lookup" packets that contain the filename that is being opened. This doesn't include the full pathname so it's still a bit of a guessing game, but it's better than nothing.
man lsof
E.g., if the nfsd has the pid 2645, then do: