topic Re: ftpd keeps ftp processes alive in Operating System - HP-UX

ftpd keeps ftp processes alive

Bart_6 — Wed, 12 Feb 2003 08:10:53 GMT

I just noticed that on one of our ftp servers some ftpd processes are still alive while the connections is aleready disconnected.some are even disconnected for days.

how is this possible,what can I do to find the cause and what could be a solution

Re: ftpd keeps ftp processes alive

U.SivaKumar_2 — Wed, 12 Feb 2003 08:24:29 GMT

Hi,

Edit /etc/inetd.conf file and modify ftp line like this.
Original Line:

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l

Modified line:

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l -t 5

-t 5 option will cause the inactive sessions to timeout after 5 Min. Default timeout is 15 Min.

Now run

#inetd -c

regards,

U.SivaKumar

Re: ftpd keeps ftp processes alive

Bart_6 — Wed, 12 Feb 2003 08:30:32 GMT

If default timeout is 15 minutes it does not explain why I'm still seeing ftpd processes with ps -ef

Re: ftpd keeps ftp processes alive

Michael Tully — Wed, 12 Feb 2003 08:50:36 GMT

What OS version and current patch bundle level?

Re: ftpd keeps ftp processes alive

U.SivaKumar_2 — Wed, 12 Feb 2003 08:54:24 GMT

Hi,
Sorry misread
OK , ftp processes are alive after even after DISCONNECION.

Give this command

#ndd -set /dev/tcp tcp_keepalive_interval 700000

Default value is 72000000 millisecs .

Edit /etc/rc.config/nddconf for making the changes permanent.

Connect again with ftp ad come back with results.

regards,

U.SivaKumar

Re: ftpd keeps ftp processes alive

Stanimir — Wed, 12 Feb 2003 09:44:48 GMT

Hi!
I suppose your ftp is leaving open sockets.
Try #netstat -a | grep ftp
and look at state column: CLOSE_WAIT or
FIN_WAIT. May be you need ndd to
remove them.
Show the results.
Regards

Re: ftpd keeps ftp processes alive

Greg OBarr — Thu, 13 Feb 2003 13:48:24 GMT

I have seen this before with some applications that use FTP. We use eMatrix and I have seen it with that application. I had to modify the default timeout for ftpd several months ago, just as was shown above. I don't know if the application was poorly written and just not closing the ftp session properly or if the users were ending the application abnormally. In either case, changing the timeout will solve the problem.

-greg

Re: ftpd keeps ftp processes alive

Bart_6 — Fri, 14 Feb 2003 08:47:49 GMT

OS: HP-UX 11.11

I found with netstat -a|grep ftp several open sockets,connections with a status TIME_WAIT. After I killed the ftp-processes on unix these connections disappeared.

Re: ftpd keeps ftp processes alive

rick jones — Fri, 14 Feb 2003 19:00:26 GMT

It is _highly_ unlikely that a TCP connection in TIME_WAIT could hold a process open. Not impossible mind you, but unlikely. And besides, it would go the other way around :)

TIME_WAIT is the state that a TCP connection enters when that side of the TCP connection was the first to send a FINished segment, has had that FIN ACKnowledged by the remote TCP, and then has received and ACKed a FIN from the remote.

Most often this happens as each side calls close() on the socket. When an application calls close on a socket, it releases its reference to the connection - there is no longer an association between the connection and the process.

Now, it is possible that the ftpd issued a shutdown() call, and the remote did either shutdown() or close(), and then the local FTP never called close. That I would find rather surprising, but it could be investicated by taking a tusc trace (11.X) of the ftpd's.

And by default TIME_WAIT only lasts 60 seconds under HP-UX.

I think there may be something else going-on. One way to try to diagnose would be to run tusc on the ftpd.

Altering the tcp_keepalive_interval will have an effect IFF the ftpd is setting SO_KEEPALIVE. I cannot recall off the top of my head if it does, but again, tusc'ing the ftpd from start to finish could confirm that. Keepalives will only "kill" a TCP connection if the remote never answers them, so if the remote ftp client code has not close()ed his end, no setting to tcp_keepalive_interval will cull a TCP connection.

Re: ftpd keeps ftp processes alive

Bart_6 — Tue, 25 Feb 2003 10:10:00 GMT

Correct, I have traced these connections not to be of this current problem. The current problem stays that in the ps -ef output i still see ftpd processes: root 25763 762 0 Feb 14 ? 0:00 ftpd: :: STOR

Re: ftpd keeps ftp processes alive

rick jones — Tue, 25 Feb 2003 19:52:24 GMT

If you see an ftpd in the "STOR" state (as it were) then I believe that means the ftpd is in the process of receiving a file from a client. If the client has simply dropped-off the face of the net, then unless the ftpd is using SO_KEEPALIVE or has some other mechanism going it could stay there for a very long time.

If you download and run lsof to see what the state of that ftpd's TCP connections might be that would be good.

You might also see if the file is increasing in size, and/or tusc that ftpd to see if it ever comes-out of recv/select/whatever.