Questions[lsof](ubuntu)

From time to time I get this message, I cant start application when this happens.

I've tried those links: Can't start applications due to “Maximum number of clients reached” error and How can I diagnose/debug "maximum number of clients reached" X errors? but I couldn't find a proper solution.

Some info: when running lsof -U +c 15 | cut -f1 -d' ' | sort | uniq -c | sort -rn | head -15 the result is:

109 dbus-daemon
 16 systemd
 15 gnome-shell
 12 ibus-daemon
 11 xdg-desktop-por
 11 nautilus
 11 gnome-session-b
 10 pulseaudio
 10 gnome-software
  9 x-terminal-emul
  8 gsd-media-keys
  7 update-notifier
  7 gsd-xsettings
  7 gsd-power
  7 gsd-keyboard

and this is when I have only one terminal open, nautilus file explorer, chrome (7 tabs), and blender.

My main suspect is dbus-daemon. My questions:

1. How can I diagnose what causes dbus to behave like that?
2. Is there a way to increas the limit? I have a quite strong machine and all...
3. What to do? should I search in a different direction?

EDIT: after running uname -s -v -i -o I get: Linux #52~18.04.1-Ubuntu SMP Thu Sep 10 12:50:22 UTC 2020 x86_64 GNU/Linux

What are the device numbers reported by lsof?

I read the man page, Identify devices from lsof, and this.

Still I do not know what is its meaning. In particular, for this case, what can I infer from the numbers?

$ lsof -ai tcp -c vino-server
lsof: WARNING: can't stat() tracefs file system /sys/kernel/debug/tracing
      Output information may be incomplete.
COMMAND    PID     USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
vino-serv 4011    user1   12u  IPv4   27353      0t0  TCP *:5900 (LISTEN)
vino-serv 4011    user1   11u  IPv6   27352      0t0  TCP *:5900 (LISTEN)
vino-serv 4011    user1   14u  IPv4 7506511      0t0  TCP XXXXXXXXXX (ESTABLISHED)

We have certain Ubuntu (18.04) servers operating .NET Core apps on Kestrel. Recently the apps and OSes have been hanging, requiring entire VM restart.

What we found was the app had way too many file descriptors for network sockets. i.e. /proc/

Correspondingly, a query with lsof would reveal an ever-growing pool of "protocol:TCP" of type sock the dotnet process leaks.

COMMAND  PID     USER   FD      TYPE             DEVICE SIZE/OFF   NODE NAME
dotnet  6905 www-data  675u     sock                0,9      0t0  96816 protocol: TCP
dotnet  6905 www-data  676u     sock                0,9      0t0  96863 protocol: TCP
dotnet  6905 www-data  677u     sock                0,9      0t0  96910 protocol: TCP
dotnet  6905 www-data  678u     sock                0,9      0t0  96959 protocol: TCP
dotnet  6905 www-data  679u     sock                0,9      0t0  97006 protocol: TCP
dotnet  6905 www-data  680u     sock                0,9      0t0  97053 protocol: TCP
dotnet  6905 www-data  681u     sock                0,9      0t0  97101 protocol: TCP

From another thread with similar reported problem, https://serverfault.com/questions/153983/sockets-found-by-lsof-but-not-by-netstat we understand that is due to some code (likely some library) in the .NET app that is opening sockets without binding IP address or port to it.

However, what we particularly like to know in this case is, what are DEVICE 0 and 9 in this context? I have seen other reports list 0,5 or 0,7 but nobody explains what those numbers represent which type of device.

I used lsof | grep home/$USER and I found that the gmain process likes to open my personal files. What does this process do and is there any available documentation that explains it in context of Ubuntu?

How can I check which applications are using internet? How to block internet accessing one particular application? Is there any GUI tool that exist for it in Ubuntu Software Centre? Thanks in advance!