Zabbix agent windows TIME_WAIT sockets

Question

I have a big problem with Zabbix windows agent.

The agent has lot of sockets in time_wait state:

 ...........  
 TCP    10.0.10.4:10050     10.0.10.8:38681      TIME_WAIT       0
 TCP    10.0.10.4:10050     10.0.10.8:38683      TIME_WAIT       0
 TCP    10.0.10.4:10050     10.0.10.8:38710      TIME_WAIT       0
 TCP    10.0.10.4:10050     10.0.10.8:38736      TIME_WAIT       0
 TCP    10.0.10.4:10050     10.0.10.8:38755      TIME_WAIT       0
 TCP    10.0.10.4:10050     10.0.10.8:38764      TIME_WAIT       0
 TCP    10.0.10.4:10050     10.0.10.8:38781      TIME_WAIT       0
 TCP    10.0.10.4:10050     10.0.10.8:38811      TIME_WAIT       0
 TCP    10.0.10.4:10050     10.0.10.8:38835      TIME_WAIT       0
 TCP    10.0.10.4:10050     10.0.10.8:38849      TIME_WAIT       0
 TCP    10.0.10.4:10050     10.0.10.8:38878      TIME_WAIT       0
 TCP    10.0.10.4:10050     10.0.10.8:38888      TIME_WAIT       0
 TCP    10.0.10.4:10050     10.0.10.8:38913      TIME_WAIT       0
 TCP    10.0.10.4:10050     10.0.10.8:38933      TIME_WAIT       0
 TCP    10.0.10.4:10050     10.0.10.8:38952      TIME_WAIT       0

C:\>netstat -nao | find /c "TIME_WAIT"
200 <- it is too much.

Why does the agent open all this sockets?

Is there a way to close this socket?

I have lot of monitored item, could be this the problem? The intervall time is about 10 minutes.

thank you any help is appreciated

200 'is too much' *why?* what's the *real* problem you're trying to solve? Long `netstat` listings aren't a problem in themselves. — user207421, Oct 29 '14 at 21:14

score 4 · Accepted Answer · answered Oct 29 '14 at 17:42

IMHO it's not a big problem, it's concept how TCP works. Do you have any performance issue because your device has 200 TIME-WAIT connections?

If you have a lot of monitored items and your agent is in passive mode, then zabbix server has to create a lot of TCP connections to your agent. TIME-WAIT is almost last state of this TCP connection. TIME_WAIT indicates that this side has closed the connection. The connection is being kept around so that any delayed packets can be matched to the connection and handled appropriately. Common duration of TIME-WAIT state can be 30 seconds.

You can play with Windows registry to decrease duration of TIME-WAIT state. But I don't recommend it, if you don't know what are you doing.

http://help.globalscape.com/help/secureserver3/Windows_Registry_keys_for_TCP_IP_Performance_Tuning.htm

About TCP states:

http://commons.wikimedia.org/wiki/File:Tcp_state_diagram_fixed_new.svg

About TIME-WAIT state (on linux)

http://www.fromdual.com/huge-amount-of-time-wait-connections