branderson
40276fdb0a
Reported from a live host: "new listener or unit" at max priority every half hour, the heartbeat flapping down and up beside it, and accept not helping. No changes had been made to the watched machine. v6 added UDP to the listening-socket collection, which closed a real gap. But `ss -l` with -u also reports UDP sockets in UNCONN, and that is what a client socket looks like: a resolver doing a lookup holds one on a random high port for as long as the query takes, and TCP has the same shape for anything that binds before connecting. So a box doing nothing produced a new PORT line every cycle and lost the one from the cycle before. To a watcher that is a listener appearing and disappearing. accept cannot fix it because the next sample differs again, and the heartbeat only fires on a clean cycle, so the alerting ones send nothing and the dead-man's switch reports the guard down and up in turn. Every symptom on that host from one line of awk. Ports inside the kernel's ephemeral range are no longer recorded, with the range read from /proc rather than written down: it is tunable, and a wrong constant would either keep the flapping or hide real services. What this gives up is a listener the kernel would also hand out as an ephemeral port. That is a real loss and it is the better trade, because the alternative is an alert every cycle, and an alert that fires constantly is one nobody reads. v7, since the state no longer carries those lines and a v6 baseline differs from every state after this. The test that would have caught it asks the plain question the collector has to satisfy: two samples of a machine where nothing happened must be identical.
2 lines
2 B
Plaintext
2 lines
2 B
Plaintext
7
|