Which process is eating ptys in my Linux server?

The number of used pty's as reported in /proc/sys/kernel/pty/nr is getting constantly larger on my 2.6.32 server.

How can I find out which processes are using the ptys, short of killing them one after another and checking if the usage count decreases?

3 Answers

This appears to be a bug in Linux kernel¹ - the counter is never decremented, even if ptys are deallocated.

In a standard² setup, ls /dev/pts should show the actual ptys allocated at the moment, and you can run lsof on them to list all processes using a particular pty (or any other file, for that matter).

¹ Fixed in Linux 3.2.
² Single devpts instance.

Try using fuser or lsof to see which process is using them.

This shows what you want:

find /proc -maxdepth 1 -type d -name "[0-9]*" | while read f; do echo $(cat "$f/cmdline") " ${f:6} " $(readlink "$f/fd/0"); done

ok, to break this thing down: - find all directories that contain only numbers in proc - just in proc, no subdirectories. by convention, these are only process ids. - while read reads each line and stores in a shell variable (if this were a script, i'd've called it procpiddir or something cool like that - it's cli so i call it something short). - the cmdline file tells you what was run to make that pid (not exactly, but we'll go with that) - ${f:6} is bash variable manipulation - basically discard the first 6 characters in the name - '/proc/' in this case - readlink follows a link to its conclusion. since fd0 is stdin (fd1 is stdout, fd2 is stderr) it only makes sense that this would lead you to the tty the process is running under.

there's no good reason to be quoting this stuff - there's no way any of these variables would have spaces or other funny characters. it's just habit. oh, and $(cmd) makes it look like the output of a command is a shell variable (maybe someone better with bash should explain this better or find supporting links - this is afaik).