filling up UDP socket buffers like mad

[Michael W. Lucas]

Hi,

Running FreeBSD 6.1-PRERELEASE as a DNS, dhcp, and syslog server.

I'm having trouble with DNS, DHCP, and syslogd locking up, and I think
I've found what they all share in common.

During the lockups, the box starts dropping UDP due to full socket
buffers.  I have a dumb little script to capture the rate of drops
over 5 seconds, and it's about 45 a second.

168725 dropped due to full socket buffers
168958 dropped due to full socket buffers

Right now, named and syslogd are in cron to restart every 15 minutes.
Once they restart, everything works fine.  Immediately after the
reload, the UDP drops cease.  The script reveals no change in the
number of drops... for a few minutes.

I've turned kern.ipc.maxsockbuf to increase the number of UDP buffers,
which Google tells me is correct.  Mind you, I'd previously tuned it
to 8388608.  I've now doubled that again, to 16777216.  I really don't
want to just keep doubling this resource when something happens.

The best thing to do here is to identify what's using all these
sockets, but I'm stumped on how to do that.  My bowels tell me it's
syslogd, because that's the program that is most resistant to
restarting, but that's a pretty crappy reason.  Any thoughts?

Thanks,
==ml

-- 
Michael W. Lucas	mwlucas at FreeBSD.org, mwlucas at BlackHelicopters.org
		http://www.BlackHelicopters.org/~mwlucas/

"The cloak of anonymity protects me from the nuisance of caring." -Non Sequitur