Identifying "Writing" connections in status stub

[Vlad K.]

Hello list,

I'm graphing information from the nginx status page, and have noticed 
something odd. The "Writing" connections are flat over time, not 
correlated to the Active/Reading/Waiting connections and are steadily 
increasing over time. Example for the past week:

https://pasteboard.co/GCHKB3B.png

Where it drops, is where I've restarted (not reloaded) the service, and 
starts growing up after a short while. This server FreeBSD but I've 
noticed it also in Debian.

Is there a way to find out which connections are these, which remote IPs 
they are so I can track them with netstat or sockstat? This looks to me 
like connection FD or something has been leaking. If this is a bug, I'm 
not sure what to report.

I've also noticed, from time to time, connections lingering for long 
time in "CLOSED" state (as reported by netstat), googling for which 
seems to suggest a bug in application, where it doesn't release the FD 
after the remote has closed.


Thanks.


-- 
Vlad K.