Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking for an explanation of the totsck column for the "sar -n SOCK" output

09:44:06 PM    totsck    tcpsck    udpsck    rawsck   ip-frag    tcp-tw
09:44:09 PM       580        18         5         0         0         1
09:44:10 PM       580        18         5         0         0         0
09:44:11 PM       580        18         5         0         0         0
Average:          580        18         5         0         0         1

It's obviously not the sum of the tcp/udp/raw sockets. The only other explanation I've come around is that it's sockets plus

 sysctl fs.file-nr 

but on my test box that's

fs.file-nr = 5632   0   803168

Precise explanation much appreciated.


Edit 2: So apparently totsck is equivalent to

cat /proc/net/sockstat

which leads to the question what is counted there. I found this but in the end it only recommends asking the guys who wrote that particular piece of kernel code.

Edit (for domain socket accounting):

[root@fedora16 fs]# netstat --protocol unix| wc -l
[root@fedora16 fs]# sar -n SOCK 1 1
Linux 3.3.1-5.fc16.x86_64 (fedora16)    06/21/2012  _x86_64_    (4 CPU)

10:03:25 PM    totsck    tcpsck    udpsck    rawsck   ip-frag    tcp-tw
10:03:26 PM       598         6         5         0         0         3
Average:          598         6         5         0         0         3
share|improve this question
up vote 5 down vote accepted

There's also UNIX domain sockets (STREAM and DGRAM) that are accounted for in total number of sockets used by the system as it seems. UNIX domain sockets are referenced by processes as inodes in the file system. There's a lot of stuff that still uses UNIX domain sockets for various purposes so sar picks that up. Check that output of netstat -a to see how many UNIX domain sockets are open on your system.

fs.file-nr is the number of maximum file handles and while important has nothing to with what you are seeing there on the sar output.

Edit: Please consider that sar basically reads /proc/net/sockstat and makes an average over that count or reports historical values. It seems that /proc/net/sockstat gets the data from two places (kernel source for 2.6.27) and the locations are net/socket.c line: 2324 and net/ipv4/proc.c line 54 and following and the total number comes from the first locations while the rest is from the second. Going through the net structure also reveals what sockets are counted/accounted for and printed into the proc file system.

 79  * @SOCK_STREAM: stream (connection) socket
 80  * @SOCK_DGRAM: datagram (conn.less) socket>  
 81  * @SOCK_RAW: raw socket
 82  * @SOCK_RDM: reliably-delivered message>
 83  * @SOCK_SEQPACKET: sequential packet socket
 84  * @SOCK_DCCP: Datagram Congestion Control Protocol socket
share|improve this answer
Is there any command with which I can count the unix domain sockets (like netstat -t | wc -l for the tcp sockets)? – moodywoody Jun 21 '12 at 12:00
Check the output of netstat --protocol unix | wc -l. – pfo Jun 21 '12 at 12:02
Cheers and already thanks, but still doesn't seem to add up (see edit in OP) – moodywoody Jun 21 '12 at 12:05
I've just skimmed through the source to see how it's calculated and edited my answer accordingly. – pfo Jun 21 '12 at 12:52
Cheers mate, quality answer – moodywoody Jun 21 '12 at 13:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.