I just reread the thread and realize that you answered q2, and that makes the graph even more
surprising. You say that it son FreeBSD - does this mean that you don’t have /proc available to you?
Is there a procstat or other way to see the equivalent of /proc/<pid>/fd - a list of all open file descriptions for a specific pid?



> On Jul 30, 2017, at 5:15 AM, Peter Booth <peter_booth@me.com> wrote:
>
> Vlad,
>
> You might not need to replicate it- you have it happening in production in front of you.
> Some questions:
>
> 1. When is the last time that your production nginx was restarted?
> 2. Do you have regular restarts?
> 3. Is there an obstacle to restarting at some point?
> 4. Is this a single instance or do you have multiple nginx hosts?
> 5. What 3rd party models are you using?
> 6. Is the website in question an enterprise app or something that is internet visible?
>
> Maxim’s hypothesis of leaking sockets from third party plugin is the simplest, most likely explanation for what you report.
>
> I start from a position of trusting nothing. If you can you capture the output of lsof -i :80 or net stat -ant | grep TCP or a
> similar ss command you can know for certain that your visualization is “telling the truth”
> Certainly the line labeled “Writing” looks unusual. Do you know of any site events that might have caused the minimum on
> 23 July, the spike on 24th, and the step up on 25th July?
>
> Peter
>
>
>
>
>> On Jul 30, 2017, at 4:09 AM, Vlad K. <nginx-ml@acheronmedia.hr <mailto:nginx-ml@acheronmedia.hr>> wrote:
>>
>> On 2017-07-30 01:47, Maxim Dounin wrote:
>>> It might not be trivial to debug such socket leaks though, and
>>> before doing anything else it is in general a good idea to:
>>> - make sure you are using latest nginx version, and
>>> - the problem is not in a 3rd party module (that is, you can
>>> reproduce it without 3rd party modules).
>>
>> It's latest stable, 1.12.1 on FreeBSD.
>>
>> Unfortunately I can't remove 3rd party modules as this is production. I have no idea what to do to try replicate that in testing.
>>
>> But thanks for your reply.
>>
>>
>>
>> --
>> Vlad K.
>> _______________________________________________
>> nginx mailing list
>> nginx@nginx.org <mailto:nginx@nginx.org>
>> http://mailman.nginx.org/mailman/listinfo/nginx
>
> _______________________________________________
> nginx mailing list
> nginx@nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx

_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx