filling up UDP socket buffers like mad

[Garrett Cooper]

Michael W. Lucas wrote:

>Hi,
>
>Running FreeBSD 6.1-PRERELEASE as a DNS, dhcp, and syslog server.
>
>I'm having trouble with DNS, DHCP, and syslogd locking up, and I think
>I've found what they all share in common.
>
>During the lockups, the box starts dropping UDP due to full socket
>buffers.  I have a dumb little script to capture the rate of drops
>over 5 seconds, and it's about 45 a second.
>
>168725 dropped due to full socket buffers
>168958 dropped due to full socket buffers
>
>Right now, named and syslogd are in cron to restart every 15 minutes.
>Once they restart, everything works fine.  Immediately after the
>reload, the UDP drops cease.  The script reveals no change in the
>number of drops... for a few minutes.
>
>I've turned kern.ipc.maxsockbuf to increase the number of UDP buffers,
>which Google tells me is correct.  Mind you, I'd previously tuned it
>to 8388608.  I've now doubled that again, to 16777216.  I really don't
>want to just keep doubling this resource when something happens.
>
>The best thing to do here is to identify what's using all these
>sockets, but I'm stumped on how to do that.  My bowels tell me it's
>syslogd, because that's the program that is most resistant to
>restarting, but that's a pretty crappy reason.  Any thoughts?
>
>Thanks,
>==ml
>
Have you run netstat to determine what the culprit is? Try running 
netstat -f inet | grep udp | less; this will print out everything with a 
udp socket to a buffered screen, and maybe you can find out one of the 
socket file descriptors, then take lsof, for instance, and find out what 
the program/service is that is causing the issue with your system.
-Garrett