Symantec logo

File Change Log administrative interface

The FCL can be set up and tuned through the VxFS administrative commands fcladm(1M) and vxtunefs(1M).

set 

Enables the recording of the audit, open, close, and stats events to the File Change Log. Setting the audit option enables all events to be recorded to the FCL, when the command is issued. This also lists the struct fcl_accessinfo identifier which shows the user ID. The open option enables all files opened (when the command is issued) along with the command names to be recorded to the FCL. The close option allows the recording of all files that are closed to the FCL. The stats option enables the statistics of all events to be recorded to the FCL.  

clear 

Disables the recording of the audit, open, close, and stats events after it has been set. 

The FCL set parameters are for fcladm(1M):

The FCL tunable parameters for vxtunefs(1M) are:

fcl_keeptime 

Specifies the duration in seconds that FCL records stay in the FCL file before they can be purged. The first records to be purged are the oldest ones, which are located at the beginning of the file. Additionally, records at the beginning of the file can be purged if allocation to the FCL file exceeds fcl_maxalloc bytes. The default value is 0. Note that fcl_keeptime takes precedence over fcl_maxalloc. No hole is punched if the FCL file exceeds fcl_maxalloc bytes but the life of the oldest record has not reached fcl_keeptime seconds. 

fcl_maxalloc 

Specifies the maximum number of spaces in bytes to be allocated to the FCL file. When the space allocated exceeds fcl_maxalloc, a hole is punched at the beginning of the file. As a result, records are purged and the first valid offset (fc_foff) is updated. In addition, the fcl_maxalloc may be violated, if the oldest record has not reached fcl_keeptime. 

The minimum value of fcl_maxalloc is 4MB. The default value is fs_size/33. 

fcl_winterval  

Specifies the time in seconds that must elapse before the FCL records an overwrite, extending write, or a truncate. This helps to reduce the number of repetitive records in the FCL. fcl_winterval time-out is per inode. If an inode happens to go out of cache and returns, its write interval is reset. As a result, there could be more than one write record for that file in the same write interval. The default value is 3600 seconds. 

fcl_ointerval 

The time interval in seconds within which subsequent opens of a file do not produce an additional FCL record. This helps to reduce the number of repetitive records logged in the FCL. Note: If the tracking of access information is also enabled, a subsequent file open even within the fcl_ointerval may produce a record, if it is opened by a different user. Similarly, if the inode is bumped out of cache, this may also produce more than one record within the same open interval. 

The default value is 600 sec.  

Either or both fcl_maxalloc and fcl_keeptime must be set to activate the FCL. The following are examples of using the FCL administration command.

To activate the FCL for a mounted file system, enter:

# fcladm on mount_point

To deactivate the FCL for a mounted file system, enter:

# fcladm off mount_point

To remove the FCL file for a mounted file system (the FCL must be OFF before it can be removed), enter:

# fcladm rm mount_point

To obtain the current FCL state for a mounted file system, enter:

# fcladm state mount_point

Print the on-disk FCL super-block in text format to obtain information about the FCL by using offset 0. Because the FCL on-disk super-block occupies the first block of the FCL file, the first and last valid offsets into the FCL file can be determined by reading the FCL super-block and checking the fc_foff field. Enter:

# fcladm print 0 mount_point

To print the contents of the FCL in text format (the offset used must be 32-byte aligned), enter:

# fcladm print offset mount_point