[Vm-dev] unix SqueakSource socket 'too many open files' problem

[K K Subbu]

On 02/03/21 9:38 am, tim Rowledge wrote:
>> If this shows a monotonic growth, then a leak can be suspected.
> I'm pretty sure there is a slow leak; but slow. It's climbed from 19 to 30 over three days
Tim,

Ugh! slow leaks can be really annoying to diagnose. You may narrow down 
the specific leak with ss (socket stats)

$ ss -s

to get a breakdown by tcp/udp ipv4/ipv6 etc. or

$ ss state close-wait

to catch all sockets in close-wait state. The arguments is a filter 
condition and the man page gives examples of various filter expressions.

You may also use the watch command to sample it every day (-n 86400) and 
highlight the difference (-d):

$ watch -n 86400 -d ss state close-wait

BTW, an early trick I learned is to keep a small terminal running such 
commands in a corner (or second monitor these days). This lets me use 
the center of the screen for all active work. Any gross changes in shape 
(char graphs ;-)) or highlight will catch the corner of the eye.

HTH .. Subbu