+sonewconn: pcb 0xfffff800463fc000: Listen queue overflow

[tier1]

Hi, every day root nightly mail reports the following:

+sonewconn: pcb 0xfffff800463fc000: Listen queue overflow: 8 already in queue awaiting acceptance (4 occurrences)

many times.

I have tried some diagnostics but they all produce no result:

# netstat -Aan | grep 0xfffff800463fc000
#

# lsof -iTCP -sTCP:LISTEN -P | grep 0xfffff800463fc000
#

How then to find out what is causing this??

Thanks!

 

[SirDice]

You'll only be able to find out exactly which process when it happens. The process that caused the error is long gone now so you can't match the address any more.

But in general these errors happen when a listening service gets more connections than it's able to handle (the process itself might be too slow due to other issues). Every (TCP) listening socket has a queue where connections are parked until the process is able to handle them. This message is telling you that this queue is too small and has started to overflow. You can increase the size of this queue by setting kern.ipc.soacceptqueue. Note that increasing this system-wide may not increase the queue for this particular process. Some network services set their own queue size and you would need to adjust it in their configuration too.

11.11.1.2. kern.ipc.soacceptqueue

 

[Tim L]

You can use

netstat -aL

to show the queue lengths. You will need to try to catch the problem occuring to see which service is close to/at its max.

Quick update: the error plus output from netstat should give you a clue. The actual max listen queue is actually 1.5 times the number passed to listen(2). Since sonewconn reports the overflow at 8 it means the max listen queue is probably 5. So check services where the netstat -aL reports a max listen queue of 4 or 5.

I had this issue with Samba. It set the listen queue to 50 instead of using the system default. I ended up having to both increase kern.ipc.soacceptqueue and edit the Samba local.h file.