[dtrace-discuss] Re: DTrace: Printing pid of the process when tcpListenDrop is incremented

[James Carlson]

Amer Ather writes:
> IHAC who is seeing high number of tcpListenDrop events. There are
> multiple servers are running on the system. He likes to know the pid of
> the process that has its listen backlog full and responsible for
> triggering the tcpListenDrop event. tcpListenDrop counter is logged in

You can get the pid of the process that opened the socket by looking
at tcp_cpid.  However, since it's possible for a process to fork --
causing multiple processes to hold a single socket open -- and for the
original owner to exit, there's no guarantee that this value is
meaningful.

What you really want is to find _all_ processes holding a given socket
open.  That's a substantially harder job.

-- 
James Carlson, KISS Network                    <james.d.carlson at sun.com>
Sun Microsystems / 1 Network Drive         71.232W   Vox +1 781 442 2084
MS UBUR02-212 / Burlington MA 01803-2757   42.496N   Fax +1 781 442 1677