sonewconn issue?

[Navdeep Parhar]

On 12/11/2015 08:03, Steve Kargl wrote:
> Last night my system became wedged.  Inspection of/var/log/messages
> revealed 290 messages of the form
>
> Dec 10 19:27:49 troutmask kernel: sonewconn: pcb 0xfffff8000a76c4b0:
>     Listen queue overflow: 16 already in queue awaiting
>     acceptance (1 occurrences)
> Dec 10 19:28:55 troutmask kernel: sonewconn: pcb 0xfffff8000a76c4b0:
>     Listen queue overflow: 16 already in queue awaiting
>     acceptance (9 occurrences)
> Dec 10 19:37:40 troutmask kernel: sonewconn: pcb 0xfffff8000a76c4b0:
>     Listen queue overflow: 16 already in queue awaiting
>     acceptance (27 occurrences)
>
> ...
>
> Dec 11 07:40:46 troutmask kernel: sonewconn: pcb 0xfffff8000a76c4b0:
>     Listen queue overflow: 16 already in queue awaiting
>     acceptance (1 occurrences)
>
> During this time, I could connect to the webserver on the system.
> ssh into the box would connect, but I never got an actaul session.
> This morning I found the console unresponse.
>
> Any suggestions for identifying the rogue process?
>

Try "netstat -aLnp tcp" and look at the "Listen" column to see which 
sockets are backlogged.  Then "sockstat -4l" to identify the process 
that owns the socket.

Regards,
Navdeep