I'm looking for an explanation of the totsck column for the "sar -n SOCK" output
09:44:06 PM totsck tcpsck udpsck rawsck ip-frag tcp-tw
09:44:09 PM 580 18 5 0 0 1
09:44:10 PM 580 18 5 0 0 0
09:44:11 PM 580 18 5 0 0 0
Average: 580 18 5 0 0 1
It's obviously not the sum of the tcp/udp/raw sockets. The only other explanation I've come around is that it's sockets plus
sysctl fs.file-nr
but on my test box that's
fs.file-nr = 5632 0 803168
Precise explanation much appreciated.
Thanks
Edit 2: So apparently totsck is equivalent to
cat /proc/net/sockstat
which leads to the question what is counted there. I found this but in the end it only recommends asking the guys who wrote that particular piece of kernel code.
Edit (for domain socket accounting):
[root@fedora16 fs]# netstat --protocol unix| wc -l
413
[root@fedora16 fs]# sar -n SOCK 1 1
Linux 3.3.1-5.fc16.x86_64 (fedora16) 06/21/2012 _x86_64_ (4 CPU)
10:03:25 PM totsck tcpsck udpsck rawsck ip-frag tcp-tw
10:03:26 PM 598 6 5 0 0 3
Average: 598 6 5 0 0 3