FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
mbenvenuti
Staff
Staff
Article Id 317169
Description This articles describes how to check NFS compatibility.
Scope FortiSIEM.
Solution

Before adding an NFS server as Online or Archive storage in the FortiSIEM or after some NFS server configuration change, it can be useful to check if it is compliant by running basic commands that FortiSIEM will perform. Follow these steps:

  • Copy the attached script (with winscp) in the FortiSIEM node to check in the /tmp/ folder.
  • From the super or the worker CLI as root, run:

 

cd /tmp

chmod +x nfs_checker.sh

nfs_checker.sh <nfs_server_ip> <nfs_shared_folder>

 

  • This script will execute basic commands and create an error if one test cannot be performed successfully.
    Example:

 

nfs_checker.sh 10.5.8.5 /Share/archive

=======================================================
Creating local mount point...
=======================================================
Done
=======================================================
Checking NFS server shares...
=======================================================
/Share/archive 10.5.8.0/24
=======================================================
Mounting in NFS V3...
=======================================================
Filesystem Size Used Avail Use% Mounted on
10.5.8.5:/Share/archive 47T 7.5T 37T 18% /tmp/nfs_test
Done
=======================================================
Testing file creation, owner and permissions changes...
=======================================================
630726468 4 drwx------ 2 admin admin 4096 May 29 09:57 /tmp/nfs_test/testDir
630726469 4 -rw-r--r-- 1 admin admin 6 May 29 09:57 /tmp/nfs_test/testDir/test1.txt
630726470 4 -rw-r--r-- 1 admin admin 6 May 29 09:57 /tmp/nfs_test/testDir/test2.txt
removed '/tmp/nfs_test/testDir/test1.txt'
removed '/tmp/nfs_test/testDir/test2.txt'
removed directory '/tmp/nfs_test/testDir'
Done
=======================================================
Testing hard link creation...
=======================================================
removed '/tmp/nfs_test/test1.txt'
removed '/tmp/nfs_test/test2.txt'
Done
=======================================================
nfsiostat results...
=======================================================

10.5.8.5:/Share/archive mounted on /tmp/nfs_test:

ops/s rpc bklog
64.000 0.000

lookup: ops/s kB/s kB/op retrans avg RTT (ms) avg exe (ms) avg queue (ms) errors
5.000 1.305 0.261 0 (0.0%) 0.200 0.400 0.000 4 (80.0%)
readdir: ops/s kB/s kB/op retrans avg RTT (ms) avg exe (ms) avg queue (ms) errors
0.000 0.000 0.000 0 (0.0%) 0.000 0.000 0.000 0 (0.0%)
readdirplus: ops/s kB/s kB/op retrans avg RTT (ms) avg exe (ms) avg queue (ms) errors
3.000 2.762 0.921 0 (0.0%) 0.000 0.000 0.000 0 (0.0%)

12 open operations (pathname lookups)
48 dentry revalidates and 5 vfs lookup requests
resulted in 5 LOOKUPs on the wire
9 vfs getdents calls resulted in 3 READDIRs on the wire

10.5.8.5:/Share/archive mounted on /tmp/nfs_test:

ops/s rpc bklog
0.000 0.000

lookup: ops/s kB/s kB/op retrans avg RTT (ms) avg exe (ms) avg queue (ms) errors
0.000 0.000 0.000 0 (0.0%) 0.000 0.000 0.000 0 (0.0%)
readdir: ops/s kB/s kB/op retrans avg RTT (ms) avg exe (ms) avg queue (ms) errors
0.000 0.000 0.000 0 (0.0%) 0.000 0.000 0.000 0 (0.0%)
readdirplus: ops/s kB/s kB/op retrans avg RTT (ms) avg exe (ms) avg queue (ms) errors
0.000 0.000 0.000 0 (0.0%) 0.000 0.000 0.000 0 (0.0%)

0 open operations (pathname lookups)
0 dentry revalidates and 0 vfs lookup requests
resulted in 0 LOOKUPs on the wire
0 vfs getdents calls resulted in 0 READDIRs on the wire

10.5.8.5:/Share/archive mounted on /tmp/nfs_test:

ops/s rpc bklog
0.000 0.000

lookup: ops/s kB/s kB/op retrans avg RTT (ms) avg exe (ms) avg queue (ms) errors
0.000 0.000 0.000 0 (0.0%) 0.000 0.000 0.000 0 (0.0%)
readdir: ops/s kB/s kB/op retrans avg RTT (ms) avg exe (ms) avg queue (ms) errors
0.000 0.000 0.000 0 (0.0%) 0.000 0.000 0.000 0 (0.0%)
readdirplus: ops/s kB/s kB/op retrans avg RTT (ms) avg exe (ms) avg queue (ms) errors
0.000 0.000 0.000 0 (0.0%) 0.000 0.000 0.000 0 (0.0%)

0 open operations (pathname lookups)
0 dentry revalidates and 0 vfs lookup requests
resulted in 0 LOOKUPs on the wire
0 vfs getdents calls resulted in 0 READDIRs on the wire
=======================================================
Testing writing rates...
=======================================================
2000+0 records in
2000+0 records out
2097152000 bytes (2.1 GB, 2.0 GiB) copied, 4.67198 s, 449 MB/s
=======================================================
Testing reading rates...
=======================================================
4096000+0 records in
4096000+0 records out
2097152000 bytes (2.1 GB, 2.0 GiB) copied, 11.5811 s, 181 MB/s
removed '/tmp/nfs_test/test_file.bin'
Done
=======================================================
Mounting in NFS V4...
=======================================================
Filesystem Size Used Avail Use% Mounted on
10.5.8.5:/Share/archive 47T 7.5T 37T 18% /tmp/nfs_test
Done
=======================================================
Testing file creation, owner and permissions changes...
=======================================================
630726468 4 drwx------ 2 admin admin 4096 May 29 09:57 /tmp/nfs_test/testDir
630726469 4 -rw-r--r-- 1 admin admin 6 May 29 09:57 /tmp/nfs_test/testDir/test1.txt
630726470 4 -rw-r--r-- 1 admin admin 6 May 29 09:57 /tmp/nfs_test/testDir/test2.txt
removed '/tmp/nfs_test/testDir/test1.txt'
removed '/tmp/nfs_test/testDir/test2.txt'
removed directory '/tmp/nfs_test/testDir'
Done
=======================================================
Testing hard link creation...
=======================================================
removed '/tmp/nfs_test/test1.txt'
removed '/tmp/nfs_test/test2.txt'
Done
=======================================================
nfsiostat results...
=======================================================

10.5.8.5:/Share/archive mounted on /tmp/nfs_test:

ops/s rpc bklog
2.864 0.000

lookup: ops/s kB/s kB/op retrans avg RTT (ms) avg exe (ms) avg queue (ms) errors
0.000 0.000 0.440 0 (0.0%) 0.957 1.000 0.006 57 (17.5%)
readdir: ops/s kB/s kB/op retrans avg RTT (ms) avg exe (ms) avg queue (ms) errors
0.002 0.006 2.631 0 (0.0%) 7.187 7.273 0.007 4 (0.0%)

5555849 open operations (pathname lookups)
148060201 dentry revalidates and 108 vfs lookup requests
resulted in 326 LOOKUPs on the wire
11111615 vfs getdents calls resulted in 9623 READDIRs on the wire

10.5.8.5:/Share/archive mounted on /tmp/nfs_test:

ops/s rpc bklog
2.000 0.000

lookup: ops/s kB/s kB/op retrans avg RTT (ms) avg exe (ms) avg queue (ms) errors
0.000 0.000 0.000 0 (0.0%) 0.000 0.000 0.000 0 (0.0%)
readdir: ops/s kB/s kB/op retrans avg RTT (ms) avg exe (ms) avg queue (ms) errors
0.000 0.000 0.000 0 (0.0%) 0.000 0.000 0.000 0 (0.0%)

3 open operations (pathname lookups)
94 dentry revalidates and 0 vfs lookup requests
resulted in 0 LOOKUPs on the wire
6 vfs getdents calls resulted in 0 READDIRs on the wire

10.5.8.5:/Share/archive mounted on /tmp/nfs_test:

ops/s rpc bklog
0.000 0.000

lookup: ops/s kB/s kB/op retrans avg RTT (ms) avg exe (ms) avg queue (ms) errors
0.000 0.000 0.000 0 (0.0%) 0.000 0.000 0.000 0 (0.0%)
readdir: ops/s kB/s kB/op retrans avg RTT (ms) avg exe (ms) avg queue (ms) errors
0.000 0.000 0.000 0 (0.0%) 0.000 0.000 0.000 0 (0.0%)

0 open operations (pathname lookups)
0 dentry revalidates and 0 vfs lookup requests
resulted in 0 LOOKUPs on the wire
0 vfs getdents calls resulted in 0 READDIRs on the wire
=======================================================
Testing writing rates...
=======================================================
2000+0 records in
2000+0 records out
2097152000 bytes (2.1 GB, 2.0 GiB) copied, 4.44081 s, 472 MB/s
=======================================================
Testing reading rates...
=======================================================
4096000+0 records in
4096000+0 records out
2097152000 bytes (2.1 GB, 2.0 GiB) copied, 6.14068 s, 342 MB/s
removed '/tmp/nfs_test/test_file.bin'
Done