From owner-freebsd-questions@FreeBSD.ORG Sat Mar 25 00:22:46 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 6F81F16A400 for ; Sat, 25 Mar 2006 00:22:46 +0000 (UTC) (envelope-from youshi10@u.washington.edu) Received: from mxout1.cac.washington.edu (mxout1.cac.washington.edu [140.142.32.134]) by mx1.FreeBSD.org (Postfix) with ESMTP id 11FC943D45 for ; Sat, 25 Mar 2006 00:22:46 +0000 (GMT) (envelope-from youshi10@u.washington.edu) Received: from smtp.washington.edu (smtp.washington.edu [140.142.33.9]) by mxout1.cac.washington.edu (8.13.5+UW05.10/8.13.5+UW06.03) with ESMTP id k2P0MjYg017826 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Fri, 24 Mar 2006 16:22:45 -0800 X-Auth-Received: from [128.208.4.242] (nilakantha.cs.washington.edu [128.208.4.242]) (authenticated authid=youshi10) by smtp.washington.edu (8.13.5+UW05.10/8.13.5+UW06.03) with ESMTP id k2P0Mj3C013930 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for ; Fri, 24 Mar 2006 16:22:45 -0800 Message-ID: <44248D54.80304@u.washington.edu> Date: Fri, 24 Mar 2006 16:22:44 -0800 From: Garrett Cooper User-Agent: Mozilla Thunderbird 1.0.6 (Windows/20050716) X-Accept-Language: en-us, en MIME-Version: 1.0 To: freebsd-questions@freebsd.org References: <20060324211741.GA40819@bewilderbeast.blackhelicopters.org> In-Reply-To: <20060324211741.GA40819@bewilderbeast.blackhelicopters.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Uwash-Spam: Gauge=IIIIIII, Probability=7%, Report='__CT 0, __CTE 0, __CT_TEXT_PLAIN 0, __HAS_MSGID 0, __MIME_TEXT_ONLY 0, __MIME_VERSION 0, __SANE_MSGID 0, __USER_AGENT 0' Subject: Re: filling up UDP socket buffers like mad X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Mar 2006 00:22:46 -0000 Michael W. Lucas wrote: >Hi, > >Running FreeBSD 6.1-PRERELEASE as a DNS, dhcp, and syslog server. > >I'm having trouble with DNS, DHCP, and syslogd locking up, and I think >I've found what they all share in common. > >During the lockups, the box starts dropping UDP due to full socket >buffers. I have a dumb little script to capture the rate of drops >over 5 seconds, and it's about 45 a second. > >168725 dropped due to full socket buffers >168958 dropped due to full socket buffers > >Right now, named and syslogd are in cron to restart every 15 minutes. >Once they restart, everything works fine. Immediately after the >reload, the UDP drops cease. The script reveals no change in the >number of drops... for a few minutes. > >I've turned kern.ipc.maxsockbuf to increase the number of UDP buffers, >which Google tells me is correct. Mind you, I'd previously tuned it >to 8388608. I've now doubled that again, to 16777216. I really don't >want to just keep doubling this resource when something happens. > >The best thing to do here is to identify what's using all these >sockets, but I'm stumped on how to do that. My bowels tell me it's >syslogd, because that's the program that is most resistant to >restarting, but that's a pretty crappy reason. Any thoughts? > >Thanks, >==ml > Have you run netstat to determine what the culprit is? Try running netstat -f inet | grep udp | less; this will print out everything with a udp socket to a buffered screen, and maybe you can find out one of the socket file descriptors, then take lsof, for instance, and find out what the program/service is that is causing the issue with your system. -Garrett