Linux – Sar: what does totsck stand for

linuxsarsocket

I'm looking for an explanation of the totsck column for the "sar -n SOCK" output

09:44:06 PM    totsck    tcpsck    udpsck    rawsck   ip-frag    tcp-tw
09:44:09 PM       580        18         5         0         0         1
09:44:10 PM       580        18         5         0         0         0
09:44:11 PM       580        18         5         0         0         0
Average:          580        18         5         0         0         1

It's obviously not the sum of the tcp/udp/raw sockets. The only other explanation I've come around is that it's sockets plus

 sysctl fs.file-nr

but on my test box that's

fs.file-nr = 5632   0   803168

Precise explanation much appreciated.

Thanks

Edit 2:
So apparently totsck is equivalent to 

cat /proc/net/sockstat

which leads to the question what is counted there. I found this but in the end it only recommends asking the guys who wrote that particular piece of kernel code.

Edit (for domain socket accounting):

[root@fedora16 fs]# netstat --protocol unix| wc -l
413
[root@fedora16 fs]# sar -n SOCK 1 1
Linux 3.3.1-5.fc16.x86_64 (fedora16)    06/21/2012  _x86_64_    (4 CPU)

10:03:25 PM    totsck    tcpsck    udpsck    rawsck   ip-frag    tcp-tw
10:03:26 PM       598         6         5         0         0         3
Average:          598         6         5         0         0         3

Best Answer

There's also UNIX domain sockets (STREAM and DGRAM) that are accounted for in total number of sockets used by the system as it seems. UNIX domain sockets are referenced by processes as inodes in the file system. There's a lot of stuff that still uses UNIX domain sockets for various purposes so sar picks that up. Check that output of netstat -a to see how many UNIX domain sockets are open on your system.

fs.file-nr is the number of maximum file handles and while important has nothing to with what you are seeing there on the sar output.

Edit: Please consider that sar basically reads /proc/net/sockstat and makes an average over that count or reports historical values. It seems that /proc/net/sockstat gets the data from two places (kernel source for 2.6.27) and the locations are net/socket.c line: 2324 and net/ipv4/proc.c line 54 and following and the total number comes from the first locations while the rest is from the second. Going through the net structure also reveals what sockets are counted/accounted for and printed into the proc file system.

 79  * @SOCK_STREAM: stream (connection) socket
 80  * @SOCK_DGRAM: datagram (conn.less) socket>  
 81  * @SOCK_RAW: raw socket
 82  * @SOCK_RDM: reliably-delivered message>
 83  * @SOCK_SEQPACKET: sequential packet socket
 84  * @SOCK_DCCP: Datagram Congestion Control Protocol socket
Related Topic