filling up UDP socket buffers like mad
youshi10 at u.washington.edu
Sat Mar 25 00:22:46 UTC 2006
Michael W. Lucas wrote:
>Running FreeBSD 6.1-PRERELEASE as a DNS, dhcp, and syslog server.
>I'm having trouble with DNS, DHCP, and syslogd locking up, and I think
>I've found what they all share in common.
>During the lockups, the box starts dropping UDP due to full socket
>buffers. I have a dumb little script to capture the rate of drops
>over 5 seconds, and it's about 45 a second.
>168725 dropped due to full socket buffers
>168958 dropped due to full socket buffers
>Right now, named and syslogd are in cron to restart every 15 minutes.
>Once they restart, everything works fine. Immediately after the
>reload, the UDP drops cease. The script reveals no change in the
>number of drops... for a few minutes.
>I've turned kern.ipc.maxsockbuf to increase the number of UDP buffers,
>which Google tells me is correct. Mind you, I'd previously tuned it
>to 8388608. I've now doubled that again, to 16777216. I really don't
>want to just keep doubling this resource when something happens.
>The best thing to do here is to identify what's using all these
>sockets, but I'm stumped on how to do that. My bowels tell me it's
>syslogd, because that's the program that is most resistant to
>restarting, but that's a pretty crappy reason. Any thoughts?
Have you run netstat to determine what the culprit is? Try running
netstat -f inet | grep udp | less; this will print out everything with a
udp socket to a buffered screen, and maybe you can find out one of the
socket file descriptors, then take lsof, for instance, and find out what
the program/service is that is causing the issue with your system.
More information about the freebsd-questions