Assuming you could find a way to dump the array, doesn't this just give
you a list of port whose connections are currently in CLOSE_WAIT?
Wouldn't netstat give you the same info?
Instead of setting the array value to 1, you could set it to the value
of walltimestamp. That way when you dumped it out, you would have the
time it went into CLOSE_WAIT, which would give you an indication of
which ones were in the state the longest. I wonder if you could get an
aggregation to work here? Hmm.
On 06/23/11 16:48, Brian Ruthven wrote:
> On 23/06/2011 18:56, Vladimir Kotal wrote:
>>
>> Hi all,
>>
>> Does anyone have a dtrace script for observing connection/socket leaks
>> ? I.e. when application does not do shutdown()/close() on a socket
>> which it previously accept()'ed ? Ideally with IP address/port pairs
>> printed in the output.
>>
>
> I've looked to do this kind of thing with dtrace in the past, and
> concluded that it couldn't be done (which could well be incorrect!). The
> problem with leaked stuff is that whilst capturing data, you can pair up
> and eliminate the symmetric events, but the stuff you're interested in
> is the bit left over.
>
> It's fairly trivial to pair up the opens and closes, something like this
> (pseudo-d-code):
>
> transition-to-close-wait:entry
> {
> array[port] = 1;
> }
>
> delete-tcp-or-close-socket:entry
> /array[port]/
> {
> array[port] = 0;
> }
>
>
> Thus at the end of the script, "array" will contain the list of keys
> indicating which ports transitioned to CLOSE_WAIT, but not yet closed by
> the app. However, I couldn't spot a way of extracting this (via the END
> probe), so I abandoned the idea.
>
>
> On the other hand, if you suspect a process of leaking sockets in this
> state, they could show up in pfiles, but only if you know or suspect you
> know the process(es) involved. You may be able to guess the process
> based on the port number.
>
> Just a few thoughts.
>
> Regards,
> Brian
>
--
blu
Always code as if the guy who ends up maintaining your code will be a
violent psychopath who knows where you live. - Martin Golding
-----------------------------------------------------------------------|
Brian Utterback - Solaris RPE, Oracle Corporation.
Ph:603-262-3916, Em:brian.utterb...@oracle.com
_______________________________________________
networking-discuss mailing list
networking-discuss@opensolaris.org
