# Socket\_summary and linux user namespace

**URL:** <https://discuss.elastic.co/t/socket-summary-and-linux-user-namespace/232160>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [May 12, 2020, 7:59am UTC](https://discuss.elastic.co/t/socket-summary-and-linux-user-namespace/232160 "2020-05-12T07:59:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mads\_Jon\_Nielsen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mads_jon_nielsen/32/68120_2.png) [@Mads\_Jon\_Nielsen](https://discuss.elastic.co/u/Mads_Jon_Nielsen)\
**Post date:** [May 12, 2020, 7:59am UTC](https://discuss.elastic.co/t/socket-summary-and-linux-user-namespace/232160/1 "2020-05-12T07:59:58Z")

</div>

Hey there. I'm running a docker swarm stack in production, and was having some issues with too many sockets being created back and forth and sockets hanging in TIME\_WAIT etc. etc.

I thought that socket\_summary included sockets in the user "net" namespace, that docker utilizes.  
But at least with my setup it doesn't.

Is it possible to somehow make socket\_summary count all sockets on the system, not just those in the root namespace?

Metricbeat is installed as a systemd service and is running as root, it is not running inside the swarm.

I ssh'ed into the hosts to find the issue and fired this little script

```auto
#!/bin/bash

for ID in $(docker ps -q)
do
	PID=$(docker inspect -f '{{.State.Pid}}' $ID)
	echo -en $(docker inspect -f '{{.Name}}' $ID) " \t"
	nsenter -t $PID -n netstat -na | wc -l
done

```

Here is my metricbeat.yml

```auto
########################## Metricbeat Configuration ###########################
# Configuration reference:
# https://www.elastic.co/guide/en/beats/metricbeat/index.html
#========================== Modules configuration ============================

## Ansible managed

metricbeat.modules:

  #------------------------------- System Module -------------------------------
  - module: system
    metricsets:
      - "cpu"
      - "filesystem"
      - "load"
      - "memory"
      - "diskio"
      - "process_summary"
      - "socket_summary"
    enabled: true
    period: 1m
    # Configure the metric types that are included by these metricsets.
    cpu.metrics: ["normalized_percentages"]
    # Collect container metrics in cgroups.
    process.cgroups.enabled: true

  - module: docker
    metricsets:
      - "container"
      - "cpu"
      - "diskio"
      - "event"
      - "healthcheck"
      - "info"
      - "memory"
    hosts: ["unix:///var/run/docker.sock"]
    period: 5m
    enabled: true
    cpu.cores: false

#================================ General ======================================
# set beatname
name: somehostname

#================================ Outputs ======================================
# Configure what output to use when sending the data collected by the beat.
#-------------------------- Elasticsearch output -------------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  # Scheme and port can be left out and will be set to the default (http and 9200)
  # In case you specify and additional path, the scheme is required: http://localhost:9200/path
  # IPv6 addresses should always be defined as: https://[2001:db8::1]:9200
  hosts: [
    https://elastic.something.com:443/
  ]
  username: "XXXXX"
  password: "XXXXX"

#============================== Template =====================================
setup.template.enabled: true
setup.template.name: "metricbeat"
# Elasticsearch template settings
setup.template.settings:
  index:
    number_of_shards: 1
    number_of_replicas: 0

#============================== Setup ILM =====================================
# Configure index lifecycle management (ILM).
# Set the prefix used in the index lifecycle write alias name. The default alias
# name is 'metricbeat-%{[agent.version]}'.
setup.ilm.rollover_alias: "metricbeat"
setup.ilm.policy_name: "metricbeat-policy"

#================================ Logging ======================================
# There are three options for the log output: syslog, file, stderr.
logging.to_files: true
logging.level: warning

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 9, 2020, 7:59am UTC](https://discuss.elastic.co/t/socket-summary-and-linux-user-namespace/232160/2 "2020-06-09T07:59:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.