Uploaded image for project: 'ZABBIX BUGS AND ISSUES'
  1. ZABBIX BUGS AND ISSUES
  2. ZBX-18951

Zabbix server: TCP CLOSE_WAIT until forever with media type slack

    XMLWordPrintable

Details

    • Incident report
    • Status: Confirmed
    • Trivial
    • Resolution: Unresolved
    • 5.0.8
    • None
    • Server (S)
    • None

    Description

      Steps to reproduce:

       

      [email protected]:/home/steffen# ss -ano | grep CLOSE-WAIT
      [email protected]:/home/steffen# 
      
      • Create a new host with an unassigned IP address within your network and add the Template  Template Module ICMP Ping
      • Wait __ a few minutes, until you receive the alert in Slack
      • Check back for CLOSE_WAIT sockets on the Zabbix server:

       

      [email protected]:/home/steffen# ss -ano | grep CLOSE-WAIT
      tcp   CLOSE-WAIT 40     0                                            10.10.20.8:47818                  3.123.248.34:443                                         
      [email protected]:/home/steffen# 
      
      • Create another host (same procedure as before, with another unassigned IP) - or provoke an error otherwise of course.
      • Wait again for the alert to show up in Slack
      • Check one more time for CLOSE_WAIT sockets

       

      [email protected]:/home/steffen# ss -ano | grep CLOSE-WAIT
      tcp   CLOSE-WAIT 40     0                                            10.10.20.8:59914                  3.123.248.34:443                                         
      tcp   CLOSE-WAIT 40     0                                            10.10.20.8:47818                  3.123.248.34:443                                         
      [email protected]:/home/steffen# 
      
      • Restart zabbix-server to verify, that CLOSE_WAIT sockets are gone, after the application exits

       

      [email protected]:/home/steffen# systemctl restart zabbix-server
      [email protected]:/home/steffen# ss -ano | grep CLOSE-WAIT
      [email protected]:/home/steffen# 
      

      Result:

      With every new alert a new CLOSE_WAIT socket will spawn and the server will eventually run out of open ports.
      Expected:
      No leaking sockets/CLOSE_WAIT sockets

       

      Initially I "reported" the issue back in the beginning of 2020 [here|https://www.zabbix.com/forum/zabbix-troubleshooting-and-problems/394351-zabbix-4-4-5-slack-media-type-tcp-close-wait]and here.

      I guess nobody is monitoring for CLOSE_WAIT sockets or is not making use of the webhooks.

      BTW: The same can be reproduced with Discord as media type.

       

      Attachments

        Activity

          People

            zabbix.dev Zabbix Development Team
            sscheib Steffen Scheib
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated: