How can I monitor the length of the accept queue?
To check if your queue is overflowing use either netstat or nstat
[centos ~]$ nstat -az | grep -i listen
TcpExtListenOverflows 3518352 0.0
TcpExtListenDrops 3518388 0.0
TcpExtTCPFastOpenListenOverflow 0 0.0
[centos ~]$ netstat -s | grep -i LISTEN
3518352 times the listen queue of a socket overflowed
3518388 SYNs to LISTEN sockets dropped
Reference: https://perfchron.com/2015/12/26/investigating-linux-network-issues-with-netstat-and-nstat/
To monitor your queue sizes, use the ss command and look for SYN-RECV sockets.
$ ss -n state syn-recv sport = :80 | wc -l
119
Reference: https://blog.cloudflare.com/syn-packet-handling-in-the-wild/
Sysdig will provide some of this information at the end of each accept
syscall, as the queuelen
argument. It also shows the length of the queue as queuemax
.
7598971 21:05:30.322229280 1 gunicorn (6451) < accept fd=13(<4t>127.0.0.1:45882->127.0.0.1:8003) tuple=127.0.0.1:45882->127.0.0.1:8003 queuepct=0 queuelen=0 queuemax=10
As far as I'm aware, it provides no mechanism to know exactly when or how many times the queue has overflowed. And it would be cumbersome to integrate this with periodic monitoring by collectd
or similar.