Number of CLOSE_WAIT with lsof

Question

I

lsof | grep CLOSE_WAIT | wc -l

on ubuntu 14.04 LTS

I got the PID and TID displayed. There are say 70 CLOSE_WAITs on a java proc with x number of threads.

However, if I do

lsof -i | grep CLOSE_WAIT |wc -l

I got only 1, which is the java process (no TID).

Does it mean that we can't reliably figure out FS leak by doing lsof -i? We always have to use "lsof"?

As a sidebar, does anyone know why ELB is not closing the connection?

java 9645 9863 ubuntu 133u IPv4 19375 0t0 TCP ip-10-20-187-89:51548->ec2-100-200-86-25.compute-1.amazonaws.com:https (CLOSE_WAIT) java 9645 9864 ubuntu 133u IPv4 19375 0t0 TCP ip-10-20-187-89:51548->ec2-100-200-86-25.compute-1.amazonaws.com:https (CLOSE_WAIT) java 9645 9865 ubuntu 133u IPv4 19375 0t0 TCP ip-10-20-187-89:51548->ec2-100-200-25.compute-1.amazonaws.com:https (CLOSE_WAIT) java 9645 9902 ubuntu 133u IPv4 19375 0t0 TCP ip-10-20-187-89:51548->ec2-100-200-25.compute-1.amazonaws.com:https (CLOSE_WAIT)

Thanks,

Answer 1

I'd recommend consulting a diagram like this one . A TCP connection is not considered closed each side sends a FIN and gets an ACK.

As stated here . CLOSE_WAIT usually indicates the remote end has sent a FIN and been ACK'd by the local end, but the local end has not sent a FIN.

You're likely not seeing the rest of the CLOSE_WAIT entries with lsof -i because the remote address is not being shown. It likely shows as empty.

See also:

https://superuser.com/questions/173535/what-are-close-wait-and-time-wait-states

https://serverfault.com/questions/450055/lot-of-fin-wait2-close-wait-last-ack-and-time-wait-in-haproxy