How do I tell how close I'm getting to somaxconn?

somaxconn determines the maximum number of backlogged connections allowed for each TCP port on the system. Increasing it (recommended for servers) can prevent "connection refused" messages, but it can result in slow connections if the server can't handle the increased load.

You can check the current backlog with netstat -ant | grep -c SYN_REC according to this page. It will count how many connections are in the "SYN received" state, meaning the system has received a SYN packet (connection request) but hasn't acknowledged it yet.

If your system has ss installed, you can also use ss -s to display a summary of connections. Look for synrecv in the output, or ss -s | grep -Po '(?<=synrecv )\d+(?=,)' to just print the number.