maff's site!

Tag: Scripting

Posts relating to scripting tasks

  • File descriptor counting

    Yes I know I still haven’t done part two of that mail server post. I’ll get it done soon, I promise.While chatting on IRC, someone mentioned that they were having a problem with a process going mental and creating a bunch of file descriptors in linux, eventually hitting the “max FD limit” linux has. They couldn’t figure out which process it was and they couldn’t find a program that would list a count of how many FDs a process has open. A few minutes later I’d thrown together this bash one-liner for him. I’m posting it here just in case someone else might find it useful.

    echo "$(for pid in $(ls -a /proc|egrep '^([0-9])*$'|sort -n 2>/dev/null); do if [ -e /proc/$pid/fd ]; then FHC=$(ls -l /proc/$pid/fd|wc -l); if [ $FHC -gt 0 ]; then PNAME="$(cat /proc/$pid/comm)"; echo "$FHC files opened by $pid ($PNAME)"; fi; fi; done)"|sort -r -n|head -n4Code language: Bash (bash)

    To explain: It loops through every file/folder in /proc that is a process ID, then checks that there’s a file descriptor folder. Then it gets a count of all the FDs that process currently holds, gets the process name and outputs how many file descriptors that process has open, as well as the process name. This is then reverse-sorted and cut down to only the four processes with the most FDs open.

  • The journey of a thousand frustrations begins with a single step

    There are times when linux frustrates me. Not with issues specific to one distro, but software packages in general which are written for linux.

    My prime example here is Watch. In Gentoo, it’s included in the procps package. I recently was confused to find that my ident daemon, which I keep running because I’m an avid IRC user, was being flooded with traffic near constantly. Netstat told me it was because of two IRC servers I ran. So I logged in, checked netstat there, and sure enough, it was them. But I had no idea what process on the servers was actually creating the connections.

    I assumed it would be the ircd itself, but I wanted proof before investigating further. No problem, I thought, I’ll just run watch --differences=cumulative -n 0.1 'lsof +M -i4|grep auth', which according to watch’s manpage, would show what’s changed in a command’s output, rather than clearing the screen and displaying the output every .1 seconds. It did do this, in a way, however, because the program creating the connection to my ident server only kept that connection for a fraction of a second, the output vanished, and thanks to the unhelpful way that watch handles output which only shows up once, all I got was some white blocks showing that there had at one point been text there.

    My solution? Throw together a bash one-liner which looped infinitely until the offending program was identified: while true; do UNR=$(lsof -M -i4|grep auth); if [ -n "$UNR" ]; then echo "$UNR"; break; fi; done

    This did eventually work, and it turned out to be a runaway process on my personal box constantly creating connections to both IRC servers.