Sar: what does totsck stand for

Question

I'm looking for an explanation of the totsck column for the "sar -n SOCK" output

09:44:06 PM    totsck    tcpsck    udpsck    rawsck   ip-frag    tcp-tw
09:44:09 PM       580        18         5         0         0         1
09:44:10 PM       580        18         5         0         0         0
09:44:11 PM       580        18         5         0         0         0
Average:          580        18         5         0         0         1

It's obviously not the sum of the tcp/udp/raw sockets. The only other explanation I've come around is that it's sockets plus

 sysctl fs.file-nr 

but on my test box that's

fs.file-nr = 5632   0   803168

Precise explanation much appreciated.

Thanks

Edit 2: So apparently totsck is equivalent to

cat /proc/net/sockstat

which leads to the question what is counted there. I found this but in the end it only recommends asking the guys who wrote that particular piece of kernel code.

Edit (for domain socket accounting):

[root@fedora16 fs]# netstat --protocol unix| wc -l
413
[root@fedora16 fs]# sar -n SOCK 1 1
Linux 3.3.1-5.fc16.x86_64 (fedora16)    06/21/2012  _x86_64_    (4 CPU)

10:03:25 PM    totsck    tcpsck    udpsck    rawsck   ip-frag    tcp-tw
10:03:26 PM       598         6         5         0         0         3
Average:          598         6         5         0         0         3

Solution

There's also UNIX domain sockets (STREAM and DGRAM) that are accounted for in total number of sockets used by the system as it seems. UNIX domain sockets are referenced by processes as inodes in the file system. There's a lot of stuff that still uses UNIX domain sockets for various purposes so sar picks that up. Check that output of netstat -a to see how many UNIX domain sockets are open on your system.

fs.file-nr is the number of maximum file handles and while important has nothing to with what you are seeing there on the sar output.

Edit: Please consider that sar basically reads /proc/net/sockstat and makes an average over that count or reports historical values. It seems that /proc/net/sockstat gets the data from two places (kernel source for 2.6.27) and the locations are net/socket.c line: 2324 and net/ipv4/proc.c line 54 and following and the total number comes from the first locations while the rest is from the second. Going through the net structure also reveals what sockets are counted/accounted for and printed into the proc file system.

 79  * @SOCK_STREAM: stream (connection) socket
 80  * @SOCK_DGRAM: datagram (conn.less) socket>  
 81  * @SOCK_RAW: raw socket
 82  * @SOCK_RDM: reliably-delivered message>
 83  * @SOCK_SEQPACKET: sequential packet socket
 84  * @SOCK_DCCP: Datagram Congestion Control Protocol socket

Comments

[moodywoody]

Is there any command with which I can count the unix domain sockets (like netstat -t | wc -l for the tcp sockets)?

[pfo]

Check the output of netstat --protocol unix | wc -l.

[moodywoody]

Cheers and already thanks, but still doesn't seem to add up (see edit in OP)

[pfo]

I've just skimmed through the source to see how it's calculated and edited my answer accordingly.

[moodywoody]

Cheers mate, quality answer