Newsgroups: comp.unix.admin

>We've got a problem with increasing close_waits on one of our server
[...]
>figure. Netstat currently shows 84 close_waits while lsof reports 212
>close_waits.

The difference in reports of CLOSE_WAIT sockets between netstat and lsof has a simple explanation. The two applications are reporting information from different orientations and for different purposes.

Netstat is reporting instances of the quadruple composed of local IP address, local port, foreign IP address, and foreign port. Lsof is reporting open files using the quadruples. There will be but one instance of a particular address quadruple, but can be many instances of open files bound to it.

Vic Abell