sar command output strange socket information about totsck and tcpsck

Question

my nginx web server sits on a linux virtual machine running cent os 6.4. when using sar command to check socket info ,it output mistake socket count like this :

05:00:01 PM    totsck    tcpsck    udpsck    rawsck   ip-frag    tcp-tw
05:10:01 PM     16436     16944         9         0         0      4625
05:20:01 PM     16457     16844         9         0         0      2881
05:30:01 PM     16501     16835         9         0         0      2917
05:40:01 PM     16486     16842         9         0         0      3083
05:50:02 PM     16436     16885         9         0         0      2962

pay attention to the totsck and tcpsck,the later is more than the former, this is suppose to be less than the former, why ?

score 0 · Answer 1 · answered Apr 07 '16 at 10:06

0

I suppose that's due to tcp-tw. that correspond to the Number of TCP sockets in TIME_WAIT state.

http://linux.die.net/man/1/sar

answered Apr 07 '16 at 10:06

Samuel LEMAITRE

1,041
7
8

so,you mean totsck=tcpsck+udpsck+rawsck-tcp-tw ? – junfei wang Apr 08 '16 at 10:34
Yes something like this, but i don't know if some socket already open (tcpsck) can pass to TIME_WAIT (tcp-tw) – Samuel LEMAITRE Apr 08 '16 at 20:52

sar command output strange socket information about totsck and tcpsck

1 Answers1