How can I monitor the length of the accept queue?

To check if your queue is overflowing use either netstat or nstat

[centos ~]$ nstat -az | grep -i listen
TcpExtListenOverflows           3518352            0.0
TcpExtListenDrops               3518388            0.0
TcpExtTCPFastOpenListenOverflow 0  0.0

[centos ~]$ netstat -s | grep -i LISTEN
    3518352 times the listen queue of a socket overflowed
    3518388 SYNs to LISTEN sockets dropped

Reference: https://perfchron.com/2015/12/26/investigating-linux-network-issues-with-netstat-and-nstat/

To monitor your queue sizes, use the ss command and look for SYN-RECV sockets.

$ ss -n state syn-recv sport = :80 | wc -l
119

Reference: https://blog.cloudflare.com/syn-packet-handling-in-the-wild/


Sysdig will provide some of this information at the end of each accept syscall, as the queuelen argument. It also shows the length of the queue as queuemax.

7598971 21:05:30.322229280 1 gunicorn (6451) < accept fd=13(<4t>127.0.0.1:45882->127.0.0.1:8003) tuple=127.0.0.1:45882->127.0.0.1:8003 queuepct=0 queuelen=0 queuemax=10

As far as I'm aware, it provides no mechanism to know exactly when or how many times the queue has overflowed. And it would be cumbersome to integrate this with periodic monitoring by collectd or similar.