Detect CLOSE_WAIT leaks

Spot sockets the app forgot to close; growing CLOSE_WAIT = fd/connection leak

lsof -nP -i -sTCP:CLOSE_WAIT
tool
lsof19 commands
tags
lsofnetworkperformancetroubleshooting

More lsof commands

  • Connections to remote host
    lsof -nP -i @<host>:<port>

    Show only sockets talking to a specific peer host/port, both ends matched

  • Binaries and libs of a PID
    lsof -p <pid> -a -d txt,mem

    Show only mapped executable and shared libs; -a ANDs the filters, great after a deploy

  • Count open fds of a PID
    lsof -nP -p <pid> | wc -l

    Quick fd count to spot leaks vs ulimit -n; faster: ls /proc/<pid>/fd | wc -l

  • List open files by process
    lsof -p $(pgrep nginx) | head -30

    Show all files (sockets, regular, pipes) opened by nginx

  • Who is using a port
    lsof -i :8080

    Find which process is listening on port 8080

all 19 lsof commands