xrestop didn't tell me much, either. Most writeups of people researching this problem focus on finding the total open Unix sockets. But the
lsofc -c Xorg advice is much better.
However, you can use
ss to get at that info more directly these days. This command shows me the unix (local) sockets connecting to Xorg:
sudo ss -x src "*/tmp/.X11-unix/*"
You might need to experiment with the filter part to get it to work on your environment. Experiment with
sudo ss -x alone to see everything and try to filter from there.
I can't find a way to have
ss identify the source app (like
lsofc does) but with a few pipes I can get to this:
sudo ss -x src "*/tmp/.X11-unix/*" | grep -Eo "[0-9]+\s*$" | while read port
do sudo ss -p -x | grep -w $port | grep -v X11-unix
done | grep -Eo '".+"' | sort | uniq -c | sort -rn
Output looks like this:
When I ran this while getting the "Maximum number of clients reached" problem, this search turned up a list of 256 clients. So I'm pretty confident that this is the right tool to find the culprit.
You can find out more about
ss at these pages:
Here's a commented version of that gnarly script line:
sudo ss -x src "*/tmp/.X11-unix/*" | # List X11 sessions
grep -Eo "[0-9]+\s*$" | # extract the port number
while read port ; do # For every connected port
sudo ss -p -x | grep -w $port | # Find the connecting process
grep -v X11-unix # but ignore the x11 side
done | grep -Eo '".+"' | # extract process names
sort | uniq -c | # Count the number of repeats
sort -rn # And sort them descending by count