lsof question

[allanm77]

Hi All,

I wanted to know if there is an argument in lsof which can tell me the time when socket was left in CLOSE_WAIT state

(start time of that state).

Is there any other way I can find that?

Thanks,

Allan.

[allanm77]

Is there any other way to find this out?

Thanks,
Allan.

[Robert_Jewell]

I am not sure, but here is the man page for lsof that you can reference for options and what they do:

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/lsof-4.84/man.html

-Bob

[Dave Olker]

I'm not sure if any tool would be able to show this unless the TCP data structures themselves keep track of this information somewhere that the kernel could extract it from via a tool like ndd or lsof.  I used the latest version of xportshow (WTEC developed tool for deep analysis of TCP connection problems) and I don't see anything obvious in the data structures it dumps that looks like it tracks when a connection changed state.  There are some timers tracked in the per-connection structures (i.e. keepalive, etc.) but I don't see anything resembling a state timer showing when a connection transitioned from one state to another.

If you really need this information, meaning not just a casual interest, you could try contacting HP support and seeing if the RCEs or WTEC teams have any other tools for determining this.  They might have some tool I'm not familiar with that can extract this information from a live system.

Dave