I have one process running 24\*7 in a system. Recenly it has been reported that this process is opening too many sockets exhausting its max limit.

```
root@typhoon-base-unit0:/root> lsof -p 681 | grep -i sock | wc -l
1018
root@typhoon-base-unit0:/root>

```

Strace revealed that its opening/closing a socket each iteration but suddenly there are many sockets opened by the process which are not closed correctly.

```
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 485
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 486
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 487
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 488
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 489
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 490
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 491
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 492
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 493
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 494
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 495
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 496
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 497
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 498
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 499
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 500
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 501
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 502
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 503
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 504
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 505
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 506
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 507
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 508
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 509
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 510
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 511
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 512
socket(0x1e /* PF_??? */, SOCK_SEQPACKET, 0) = 513
close(513)                              = 0
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 513
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 514
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 515
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 516
socket(0x1e /* PF_??? */, SOCK_SEQPACKET, 0) = 517
close(517)                              = 0
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 517
socket(PF_NETLINK, SOCK_DGRAM, 11)      = 518

```

My question how can i find out which function of that running process has created this PF\_NETLINK socket? The code is too big to follow all possible paths manually. Is there any tool that can tell me which function created these PF\_NETLINK sockets?

Any help is appreciated. 

Many thanks.