<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Vlad,</div><div class=""><br class=""></div><div class="">You might not need to replicate it- you have it happening in production in front of you.</div><div class="">Some questions:</div><div class=""><br class=""></div><div class="">1. When is the last time that your production nginx was restarted?</div><div class="">2. Do you have regular restarts?</div><div class="">3. Is there an obstacle to restarting at some point?</div><div class="">4. Is this a single instance or do you have multiple nginx hosts?</div><div class="">5. What 3rd party models are you using?</div><div class="">6. Is the website in question an enterprise app or something that is internet visible? </div><div class=""><br class=""></div><div class="">Maxim’s hypothesis of leaking sockets from third party plugin is the simplest, most likely explanation for what you report.</div><div class=""><br class=""></div><div class="">I start from a position of trusting nothing. If you can you capture the output of <i class="">lsof -i :80 or net stat -ant | grep TCP </i>or a </div><div class="">similar <i class="">ss</i> command you can know for certain that your visualization is “telling the truth”</div><div class="">Certainly the line labeled “Writing” looks unusual. Do you know of any site events that might have caused the minimum on</div><div class="">23 July, the spike on 24th, and the step up on 25th July?</div><div class=""><br class=""></div><div class="">Peter </div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><br class=""><div><blockquote type="cite" class=""><div class="">On Jul 30, 2017, at 4:09 AM, Vlad K. <<a href="mailto:nginx-ml@acheronmedia.hr" class="">nginx-ml@acheronmedia.hr</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">On 2017-07-30 01:47, Maxim Dounin wrote:<br class=""><blockquote type="cite" class="">It might not be trivial to debug such socket leaks though, and<br class="">before doing anything else it is in general a good idea to:<br class="">- make sure you are using latest nginx version, and<br class="">- the problem is not in a 3rd party module (that is, you can<br class=""> reproduce it without 3rd party modules).<br class=""></blockquote><br class="">It's latest stable, 1.12.1 on FreeBSD.<br class=""><br class="">Unfortunately I can't remove 3rd party modules as this is production. I have no idea what to do to try replicate that in testing.<br class=""><br class="">But thanks for your reply.<br class=""><br class=""><br class=""><br class="">-- <br class="">Vlad K.<br class="">_______________________________________________<br class="">nginx mailing list<br class=""><a href="mailto:nginx@nginx.org" class="">nginx@nginx.org</a><br class="">http://mailman.nginx.org/mailman/listinfo/nginx<br class=""></div></div></blockquote></div><br class=""></body></html>