Security Software

I've DPS 6.3 running over Linux and I constantly see an increasing number of CLOSE_WAIT connections (on the proxy) coming from different clients.
As an example, I have about 20000 connexions a day which remain in the CLOSE_WAIT state.

In order to prevent the proxy from being out of file descriptors, the only solution I found for the moment is to increase the maximum number of file descriptor per process and reboot it on a regular basis.

My understanding is that those CLOSE_WAIT connections are connections already closed on the proxy client side (which required the closing), and thus they should disappear from the proxy system after the configured timeout .

Any known bug (maybe in the Linux Java VM) ? better workaround ?


My configuration:

cat /etc/redhat-release
Red Hat Enterprise Linux AS release 4 (Nahant Update 6)

dpconf --version
[dpconf]
dpconf : 6.3 B2008.0311.0055

/usr/jdk/entsys-j2se/jre/bin/java -version
java version "1.5.0_12"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_12-b04)
Java HotSpot(TM) Client VM (build 1.5.0_12-b04, mixed mode, sharing)

sysctl net.ipv4.tcp_keepalive_time
net.ipv4.tcp_keepalive_time = 1800 (instead of 7200 by default, but it has no visible effect at least)


A few settings that should not affect the problem (since they concern either proxy to backend connections
or connections closed by the proxy)

dpconf get-ldap-data-source-prop -P 636 theoden monitoring-inactivity-timeout
monitoring-inactivity-timeout : 2m

Also, can anyone confirm the "connectionIdleTimeOutInSec value" has to be expressed in seconds (and not milliseconds) with DPS 6.3 ?