Splunk PDF Server: CLOSE_WAIT and FIN_WAIT2

[bpolen]

Hi,

I have installed dthe Splunk PDF Server app. Since the install I have notice it leaves a lot of the socket connection to 8089 in the CLOSE_WAIT or FIN_WAIT2 status. Can anyone tell me why this occurs?
Below is my netstat outpur:
tcp 0 0 0.0.0.0:8089 0.0.0.0:* LISTEN
tcp 0 0 10.40.26.52:9997 10.3.252.12:48089 ESTABLISHED
tcp 38 0 127.0.0.1:33143 127.0.0.1:8089 CLOSE_WAIT
tcp 38 0 127.0.0.1:33142 127.0.0.1:8089 CLOSE_WAIT
tcp 38 0 127.0.0.1:33146 127.0.0.1:8089 CLOSE_WAIT
tcp 38 0 127.0.0.1:33145 127.0.0.1:8089 CLOSE_WAIT
tcp 38 0 127.0.0.1:33144 127.0.0.1:8089 CLOSE_WAIT
tcp 38 0 127.0.0.1:41578 127.0.0.1:8089 CLOSE_WAIT
tcp 38 0 127.0.0.1:41587 127.0.0.1:8089 CLOSE_WAIT
tcp 38 0 127.0.0.1:41597 127.0.0.1:8089 CLOSE_WAIT
tcp 38 0 127.0.0.1:42098 127.0.0.1:8089 CLOSE_WAIT
tcp 0 0 127.0.0.1:8089 127.0.0.1:33146 FIN_WAIT2
tcp 0 0 127.0.0.1:8089 127.0.0.1:33145 FIN_WAIT2
tcp 0 0 127.0.0.1:8089 127.0.0.1:33144 FIN_WAIT2
tcp 0 0 127.0.0.1:8089 127.0.0.1:33143 FIN_WAIT2
tcp 0 0 127.0.0.1:8089 127.0.0.1:33142 FIN_WAIT2

[rmcdougal]

I can't answer why it happens but I can tell you that I am having the same issue with an indexer. I have a case open with Splunk on the matter and I am waiting on a response.

The issue on the indexer is a little more serious because it creates so many connections it runs the box out of RAM.