From owner-freebsd-questions@FreeBSD.ORG Fri Mar 24 21:17:43 2006 Return-Path: X-Original-To: questions@freebsd.org Delivered-To: freebsd-questions@FreeBSD.ORG Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 2391C16A400 for ; Fri, 24 Mar 2006 21:17:43 +0000 (UTC) (envelope-from mwlucas@bewilderbeast.blackhelicopters.org) Received: from bewilderbeast.blackhelicopters.org (bewilderbeast.blackhelicopters.org [198.22.63.43]) by mx1.FreeBSD.org (Postfix) with ESMTP id A5C7043D49 for ; Fri, 24 Mar 2006 21:17:42 +0000 (GMT) (envelope-from mwlucas@bewilderbeast.blackhelicopters.org) Received: from bewilderbeast.blackhelicopters.org (mwlucas@localhost [127.0.0.1]) by bewilderbeast.blackhelicopters.org (8.12.10/8.12.10) with ESMTP id k2OLHfWG040928 for ; Fri, 24 Mar 2006 16:17:41 -0500 (EST) (envelope-from mwlucas@bewilderbeast.blackhelicopters.org) Received: (from mwlucas@localhost) by bewilderbeast.blackhelicopters.org (8.12.10/8.12.10/Submit) id k2OLHfhs040927 for questions@freebsd.org; Fri, 24 Mar 2006 16:17:41 -0500 (EST) (envelope-from mwlucas) Date: Fri, 24 Mar 2006 16:17:41 -0500 From: "Michael W. Lucas" To: questions@freebsd.org Message-ID: <20060324211741.GA40819@bewilderbeast.blackhelicopters.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.4.1i X-Spam-Score: (0) X-Scanned-By: MIMEDefang 2.39 Cc: Subject: filling up UDP socket buffers like mad X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Mar 2006 21:17:43 -0000 Hi, Running FreeBSD 6.1-PRERELEASE as a DNS, dhcp, and syslog server. I'm having trouble with DNS, DHCP, and syslogd locking up, and I think I've found what they all share in common. During the lockups, the box starts dropping UDP due to full socket buffers. I have a dumb little script to capture the rate of drops over 5 seconds, and it's about 45 a second. 168725 dropped due to full socket buffers 168958 dropped due to full socket buffers Right now, named and syslogd are in cron to restart every 15 minutes. Once they restart, everything works fine. Immediately after the reload, the UDP drops cease. The script reveals no change in the number of drops... for a few minutes. I've turned kern.ipc.maxsockbuf to increase the number of UDP buffers, which Google tells me is correct. Mind you, I'd previously tuned it to 8388608. I've now doubled that again, to 16777216. I really don't want to just keep doubling this resource when something happens. The best thing to do here is to identify what's using all these sockets, but I'm stumped on how to do that. My bowels tell me it's syslogd, because that's the program that is most resistant to restarting, but that's a pretty crappy reason. Any thoughts? Thanks, ==ml -- Michael W. Lucas mwlucas@FreeBSD.org, mwlucas@BlackHelicopters.org http://www.BlackHelicopters.org/~mwlucas/ "The cloak of anonymity protects me from the nuisance of caring." -Non Sequitur