Identifying "Writing" connections in status stub
peter_booth at me.com
Sun Jul 30 09:26:52 UTC 2017
I just reread the thread and realize that you answered q2, and that makes the graph even more
surprising. You say that it son FreeBSD - does this mean that you don’t have /proc available to you?
Is there a procstat or other way to see the equivalent of /proc/<pid>/fd - a list of all open file descriptions for a specific pid?
> On Jul 30, 2017, at 5:15 AM, Peter Booth <peter_booth at me.com> wrote:
> You might not need to replicate it- you have it happening in production in front of you.
> Some questions:
> 1. When is the last time that your production nginx was restarted?
> 2. Do you have regular restarts?
> 3. Is there an obstacle to restarting at some point?
> 4. Is this a single instance or do you have multiple nginx hosts?
> 5. What 3rd party models are you using?
> 6. Is the website in question an enterprise app or something that is internet visible?
> Maxim’s hypothesis of leaking sockets from third party plugin is the simplest, most likely explanation for what you report.
> I start from a position of trusting nothing. If you can you capture the output of lsof -i :80 or net stat -ant | grep TCP or a
> similar ss command you can know for certain that your visualization is “telling the truth”
> Certainly the line labeled “Writing” looks unusual. Do you know of any site events that might have caused the minimum on
> 23 July, the spike on 24th, and the step up on 25th July?
>> On Jul 30, 2017, at 4:09 AM, Vlad K. <nginx-ml at acheronmedia.hr <mailto:nginx-ml at acheronmedia.hr>> wrote:
>> On 2017-07-30 01:47, Maxim Dounin wrote:
>>> It might not be trivial to debug such socket leaks though, and
>>> before doing anything else it is in general a good idea to:
>>> - make sure you are using latest nginx version, and
>>> - the problem is not in a 3rd party module (that is, you can
>>> reproduce it without 3rd party modules).
>> It's latest stable, 1.12.1 on FreeBSD.
>> Unfortunately I can't remove 3rd party modules as this is production. I have no idea what to do to try replicate that in testing.
>> But thanks for your reply.
>> Vlad K.
>> nginx mailing list
>> nginx at nginx.org <mailto:nginx at nginx.org>
> nginx mailing list
> nginx at nginx.org
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the nginx