```

Problem

The "http agent poller" process accumulates TCP sockets that stay in CLOSE_WAIT
(the remote side closed the connection, the poller never calls close()).
After ~2.5 days the sockets consume the whole ephemeral port range of the
container network namespace and every HTTP agent item fails with:

Cannot perform request: Failed to connect to <PVE host>:8006 after 10 ms: Could not connect to server

Network is fine at that moment: a TCP connect from a shell in the same
container fails with "bind: Address in use", while the same connect from the
Docker host succeeds.

This looks like the socket part of ZBX-28080 (closed as duplicate of ZBX-27958).
ZBX-27958 is marked fixed in 7.0.30rc1, but 7.0.30 still leaks sockets.
Nothing related is listed in the 7.0.31 release notes.

Evidence (7 days after server start, 2026-09-23 -> 2026-09-30)

Poller process title: "http agent poller #1 [got 2 values, queued 2 in 5 sec, awaiting 0]"

• i.e. nothing is in flight, yet:

  open fds of http agent poller:   28258
    of which sockets:              28241
    anon_inode / pipe / file:      7 / 8 / 2
  other server processes:          25-45 fds each
  
  poller sockets in /proc/net/tcp, by state and remote port:
    28232  state 08 (CLOSE_WAIT)  remote port 8006, all to the same PVE API host
  
  net.ipv4.ip_local_port_range = 32768 60999   -> 28232 ports
  

  The number of CLOSE_WAIT sockets equals the size of the ephemeral port range
  exactly - the leak stops growing only because no more local ports are left.

  History

• Before 2026-09-17 the container ran with the default nofile=1024; the same
  leak then surfaced as EMFILE ("Could not connect" after 0 ms, also DNS
  resolution failures) within ~1 day.
• Raising nofile to 65536 and lowering MaxConcurrentChecksPerPoller to 100 only
  moved the failure point: now it is ephemeral port exhaustion instead of the
  fd limit.
• Restarting zabbix-server clears it (poller back to ~27 fds), and the growth
  starts again.

Steps to reproduce

1. Zabbix server 7.0.30 (Docker, alpine), one HTTP agent poller.
2. Monitor a Proxmox VE API (pveproxy, HTTPS :8006) with "Proxmox VE by HTTP",
   a few dozen HTTP agent items at 1m interval.
3. Watch: ls /proc/<http agent poller pid>/fd | wc -l and the CLOSE_WAIT count
   in /proc/net/tcp - both grow monotonically (~8 sockets per minute here).

Expected

Sockets closed by the peer are closed by the poller (or removed from the curl
connection cache), and the fd count stays flat.

Workaround

Periodic restart of zabbix-server.
```