How to identify where ptys are being used?

[Bernie Vande Griend]

I have a system (that I inherited)running 10.20. Today it maxed out on ptys, the max was set to 275. There were only 144 telnet sessions on it. I'm trying to determine how to track down where the other 130 some ptys were being used. I used netstat but couldn't find anything obvious. I know how to increase the table and everything, but we want to know where the increase came from today as something obviously isn't working quite right. Any ideas? What things besides telnet use regular ptys. The system was recently patched, so I suspected more things were using streams based ptys, but glance shows that it is the npty table that has filled.

[Baiju_2]

Hi

Observe that if this server is making any remote connections to other servers and that sessions are not getting terminated.

see the details of this sessions by ps -aef |grep pts.

U can increase the kernel parameter npty value so that more number of ptys are allowed.

[MANOJ SRIVASTAVA]

Hi Bernie

To know where the pty are being used you make like to use lsof from :

ftp://vic.cc.purdue.edu/pub/tools/unix/lsof/README

they ahve a binary for 10.XX so just download it and run like this

lsof | grep pty

and you are good to go.


Manoj Srivatava

[Pete Randall]

I'm not sure it will give a complete list, but the who command shows ptys.

For What It's Worth,

Pete

[Justo Exposito]

Hi Bernie,

As Pete tell you doyou try "who -u"?.

Regards,

Justo.

[Bernie Vande Griend]

Thanks everyone. I think I need to be clearer on what I'm looking for. Basically I'm saying that the system (via who and other methods) only shows 144 users and 144 telnet sessions, but there are 275 ptys being used. So these 130 other sessions are not login sessions.
lsof may be helpful here, but lsof | grep pty will show me everything the telneted users are doing. I just want to see what is using a pty, not what the people using the ptys are doing. ps -aef doesn't show me much more either. Thanks anyway.

[S.K. Chan]

What version of glance are you running ? I know the "earlier" version (can't remember which) mistakenly reports # ptys, so you might want to double check if you got the latest Glance for 10.20. Bottomline ..
# who -u|grep tty|wc -l
should match that of
# glance -t
==> the "used npty" number.

[Mark Greene_1]

try using fuser to see what processes are locking the files:

fuser /dev/* 2>&1|pg

HTH
mark

[Bernie Vande Griend]

S.K: we have a newer version of glance. Unfortunately this is exactly the situation I had, The number of users in who -u was 144 and the table for npty showed 275 connections. I also know this wasn't just a glance discrepancy because the system would not allow any more telnet connections and was giving the error: cannot allocate ptys. So we still have the question of where these other ptys were being used for.
Mark: your idea might work if put it into a script. If you fuser /dev/tty* and then take the check to see if the tty that has a process is not reported as a logged user, that would be helpful. But this does assume there is a process tied to the pty and I'm not convinced that that was the case. The system has now been rebooted, so the problem does not exist at the moment. If anyone else has ideas though, I'm welcome to them. Thanks!

[Pete Randall]

Bernie & S.K.

In another "for what it's worth" - the output from my who -u |grep tty |wc -l does not match what glance shows. Glance is higher by 8 to 12. Not the difference Bernie is seeing, but interesting. This is on an N-class running 11.0.

Pete

[Tom Danzig]

Try "ps -ef | grep -c pts" to get a count and compare to "w | wc -l" .

Use another ps listing to track down the other non-login processes using pts's.

[Sanjay_6]

Hi Bernie,

This may or may not work. Check your /dev/pty and /dev/ptym directory and see if the no of device files match or is closer to the kernel parameter,

# cd /dev/pty
# ll |wc -l
# cd /dev/ptym
# ll |wc -l

If not, try this,

insf -d pty -n

Then try the login thing once again. What is the exact error messge that you are getting.

Hope this helps.

regds

[Bernie Vande Griend]

Sanjay,
We did try that but it did not help. There were 275 devices for each and we upped it to 1000, but it did not help. But the table was only set to 275 and we had clearly reached that level. Cannot allocate pty was the error message in syslog.log.
We also tried the ps methods but it didn't show the unknown logins either.

[Sanjay_6]

Hi Bernie,

What is the type of terminal connection that you have. IS it MUX connected dumb terminals, terminal servers or what ?.

Regards

[Bill Hassell]

Starting at 10.xx and continuing on into 11.xx, ptys come in 2 flavors: standard and streams. And at 11.xx, telnet sessions are handled with streams-based drivers too. Thus, you need to setup not only npty but also nstrpty and nstrtel, typically making them all equal (ie, npty=nstrpty=nstrtel=1000), build a new kernel and reboot, then run insf to create the additional device files.

Or you can use SAM to increase the 3 parameters and it will automatically build all the needed device files.

[Bernie Vande Griend]

Sanjay-no terminal connections, just telnet sessions from PCs.
Bill-thanks for the info. This is 10.20 by the way. We do now how to increase this on 10.20 & 11.*, the question was how to tell what is using up the ptys when the tables does fill. Doesn't appear to be a great way to do this other than who, fuser, and looking at processes.
One thought did occur though, this system is running 10.20, but the Dec 2001 patch bundle was just put on it. Any chance that the kernel parameters for this are now behaving more like 11.*?