From owner-freebsd-questions@FreeBSD.ORG  Tue Sep 23 08:11:20 2003
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 784FF16A4B3
	for <freebsd-questions@FreeBSD.org>;
	Tue, 23 Sep 2003 08:11:20 -0700 (PDT)
Received: from axl.seasidesoftware.co.za (axl.seasidesoftware.co.za
	[196.31.7.201])	by mx1.FreeBSD.org (Postfix) with ESMTP id 3205D43F75
	for <freebsd-questions@FreeBSD.org>;
	Tue, 23 Sep 2003 08:11:19 -0700 (PDT)
	(envelope-from sheldonh@starjuice.net)
Received: from sheldonh by axl.seasidesoftware.co.za with local (Exim 4.22)
	id 1A1oou-00034U-PR
	for freebsd-questions@FreeBSD.org; Tue, 23 Sep 2003 17:11:16 +0200
Date: Tue, 23 Sep 2003 17:11:16 +0200
From: Sheldon Hearn <sheldonh@starjuice.net>
To: freebsd-questions@FreeBSD.org
Message-ID: <20030923151116.GM36958@starjuice.net>
Mail-Followup-To: freebsd-questions@FreeBSD.org
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.4i
Sender: Sheldon Hearn <sheldonh@starjuice.net>
Subject: kern.openfiles doesn't agree with fstat
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 23 Sep 2003 15:11:20 -0000

Hi folks,

I've got an ipfilter-enabled RELENG_4 firewall that acts as a DHCP and
SMB server for our office LAN.

It's running into its upper limit of files, as reported by
kern.openfiles.  However, when I try to use fstat to report on processes
that hold open file handles, the numbers disagree:

kern.maxfiles: 9992
kern.maxfilesperproc: 4496
kern.openfiles: 8265

# fstat | awk '$5 ~ /^\// {print $2}' | sort | uniq -c | sort -nr
  99 httpd
  63 mysqld
  50 smbd
  48 getty
  45 screen
  37 sshd
  35 bash
  30 nfsd
  27 sh
  24 nfsiod
  ...

The total number of filehandles reported in this way is about 600.

Why would these two tools disagree in this way?

Ciao,
Sheldon.