Much CLOSE_WAIT’s in netstat –a(n) output/ rmsock

iKnow-IT banner

#netstat -Aa |more

f1000600012f3b98 tcp4 0 0 loopback.32780 loopback.32993 CLOSE_WAIT
f1000600015ee398 tcp4 0 0 loopback.32780 loopback.32996 CLOSE_WAIT
f1000600013c1b98 tcp4 0 0 loopback.32780 loopback.32997 CLOSE_WAIT

#netstat -Aan |more

f1000600012f3b98 tcp4 0 0 CLOSE_WAIT
f1000600015ee398 tcp4 0 0 CLOSE_WAIT
f1000600013c1b98 tcp4 0 0 CLOSE_WAIT

#rmsock f100060001732b98 tcpcb

The socket 0x1732808 is being held by proccess 209036 (java).

#ps -lp 209036

F S            UID PID PPID         C   PRI NI   ADDR  SZ  WCHAN       TTY TIME         CMD
242001 A         0     209036   1    0               60         20  802f2480   108148 * - 1:50 java

#ps -ef | grep 209036 | grep -v grep

root 209036 1 0 Jan 25 - 1:50 java -Xms32M -Xmx256M -DATEVAL_CHAN=jni -showversion -DZIP=1 -DARCH=aix4-r1 -DLCF_DATDIR=/beheer/Tivoli/lcf/dat/2 -DLCF_EPLABEL=hostname -DTRACE_LEVEL=0 -DTRACE_SIZE=5000000 -DREBOOT=true -DIP_ADDRESS= -Ddb2j.infolog.append=false -Ddb2j.language.logStatementText= -Ddb2j.locks.waitTimeout=360 com.tivoli.dmunix.ep.agent.Main

# netstat –Aan | grep 65100

f10006… tcp4 0 0 ESTABLISHED

# rmsock  f10006… tcpcd

The socket 0x19ae0008 is being held bij de process 442576 (khdxprtj).


rmsock Command


       Removes a socket that does not have a file descriptor.


       rmsock Address TypeofAddress


       The rmsock command removes a socket that does not have a file descriptor. It accepts a socket, tcpcb, inpcb,
       ripcb, or rawcb address and converts it to a socket address. All opened files in every process are then
       checked to find a match to the socket. If a match is not found, an abort action is performed on that socket
       regardless of the existence of the socket linger option. The port number held by the socket is released. If
       a match is found, its file descriptor and status of the owner process are displayed to the user. The results
       are passed to syslogd and recorded in the /var/adm/ras/rmsock.log file.

       If the socket to be removed is not held by any active processes, but there are processes in the exiting
       state, rmsock will not remove the socket specified because the socket could be held by the processes in the
       exiting state. Any socket that is held by the exiting processes will be cleaned up when those processes exit

       1    To remove a socket from its socket address, type:

            rmsock 70054edc socket

            You do not need to specify the type of the socket. It can be a tcpcb, udp, raw, or routing socket.
       2    To remove a socket from its inpcb address, type:

            rmsock 70054edc inpcb
       3    To remove a socket from its tcpcb address, type:

            rmsock 70054ecc tcpcb


            Directory where the rmsock command resides.
            Contains the rmsock.log file.

Related Information

       The syslogd daemon.