sonewconn issue?
Navdeep Parhar
np at FreeBSD.org
Fri Dec 11 21:00:30 UTC 2015
On Fri, Dec 11, 2015 at 11:30:34AM -0800, Steve Kargl wrote:
> On Fri, Dec 11, 2015 at 09:24:00AM -0800, Navdeep Parhar wrote:
> > On 12/11/2015 08:03, Steve Kargl wrote:
> > > Last night my system became wedged. Inspection of/var/log/messages
> > > revealed 290 messages of the form
> > >
> > > Dec 10 19:27:49 troutmask kernel: sonewconn: pcb 0xfffff8000a76c4b0:
> > > Listen queue overflow: 16 already in queue awaiting
> > > acceptance (1 occurrences)
> > >
> > > During this time, I could connect to the webserver on the system.
> > > ssh into the box would connect, but I never got an actaul session.
> > > This morning I found the console unresponse.
> > >
> > > Any suggestions for identifying the rogue process?
> > >
> >
> > Try "netstat -aLnp tcp" and look at the "Listen" column to see which
> > sockets are backlogged. Then "sockstat -4l" to identify the process
> > that owns the socket.
> >
>
> Thanks for the suggestions. I'll keep this in mind if the
> problem re-appears. Unfortunately, I had no access to the
> box. ssh didn't work. console was unresponse. No serial
> console.
If you can get into ddb after this happens then you can look up the 4
tuple from the inpcb (its address is in the message displayed by
sonewconn). The local port is probably the interesting part if it's
a server.
db> show inpcb <addr>
db> show tcpcb <inp_pcb from above>
Regards,
Navdeep
>
> I forgot to mention that this is FreeBSD-current circa
> Nov 9th, 2015. The box gets updated about once a month
> or so.
>
> --
> Steve
More information about the freebsd-hackers
mailing list