I just reread the thread and realize that you answered q2, and that makes the graph even more surprising. You say that it son FreeBSD - does this mean that you don’t have /proc available to you? Is there a procstat or other way to see the equivalent of /proc/<pid>/fd - a list of all open file descriptions for a specific pid?
> On Jul 30, 2017, at 5:15 AM, Peter Booth <peter_bo...@me.com> wrote: > > Vlad, > > You might not need to replicate it- you have it happening in production in > front of you. > Some questions: > > 1. When is the last time that your production nginx was restarted? > 2. Do you have regular restarts? > 3. Is there an obstacle to restarting at some point? > 4. Is this a single instance or do you have multiple nginx hosts? > 5. What 3rd party models are you using? > 6. Is the website in question an enterprise app or something that is internet > visible? > > Maxim’s hypothesis of leaking sockets from third party plugin is the > simplest, most likely explanation for what you report. > > I start from a position of trusting nothing. If you can you capture the > output of lsof -i :80 or net stat -ant | grep TCP or a > similar ss command you can know for certain that your visualization is > “telling the truth” > Certainly the line labeled “Writing” looks unusual. Do you know of any site > events that might have caused the minimum on > 23 July, the spike on 24th, and the step up on 25th July? > > Peter > > > > >> On Jul 30, 2017, at 4:09 AM, Vlad K. <nginx...@acheronmedia.hr >> <mailto:nginx...@acheronmedia.hr>> wrote: >> >> On 2017-07-30 01:47, Maxim Dounin wrote: >>> It might not be trivial to debug such socket leaks though, and >>> before doing anything else it is in general a good idea to: >>> - make sure you are using latest nginx version, and >>> - the problem is not in a 3rd party module (that is, you can >>> reproduce it without 3rd party modules). >> >> It's latest stable, 1.12.1 on FreeBSD. >> >> Unfortunately I can't remove 3rd party modules as this is production. I have >> no idea what to do to try replicate that in testing. >> >> But thanks for your reply. >> >> >> >> -- >> Vlad K. >> _______________________________________________ >> nginx mailing list >> nginx@nginx.org <mailto:nginx@nginx.org> >> http://mailman.nginx.org/mailman/listinfo/nginx > > _______________________________________________ > nginx mailing list > nginx@nginx.org > http://mailman.nginx.org/mailman/listinfo/nginx
_______________________________________________ nginx mailing list nginx@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx
