Files
felhom.eu/documentation/audits/evidence-ep0-established-connections-2026-08-20/step1.3-fd-breakdown.txt
T
admin 19672e685e
gates / gates (push) Successful in 14s
SPIKE ep0 connections: the leak is felhom-agent's, not the poll rate
R-341's first dated check, taken at +46.2 h: fd 17 -> 405 over 166,251 s
= 201.6/day. Pre-registered range was 370-450; observed 388. UNCHANGED,
as predicted. CLOSE-WAIT is 0 -- absent entirely, not merely flat.

Q1: exactly two peers, 194 each, no third party.
Q2: outcome (a). ep0 388 = 194 + 194 on the boxes, twice, and the four
    new sockets carry the same source ports on both sides. 0 closed in 31 min.

The finding: all 388 are held by felhom-agent. pvestatd and
proxmox-backup-client made 162,404 requests and leaked zero. Mechanism is
a per-cycle http.Transport with a zero-value IdleConnTimeout that nothing
ever closes (internal/pbs/client.go:56, main.go:1486). R-336's premise
does not survive this -- cutting the poll rate would have fixed nothing.

Q3 NOT measured: Phase C held at STOP 1, prediction pre-registered first.

Part 0 captures the due-checks gate's first conviction on a real overdue
date (rc=1, names R-341, sole failure among 10 gates). Row cleared at
Part 4, after the result was recorded in R-341, not to make a push work.

New: R-344 (the transport leak), R-345 (hub/Makefile pushes :latest),
R-346 (ActiveEnterTimestamp reads 5h56m early -- NRestarts is still 0).
2026-08-20 10:41:37 +02:00

47 lines
2.1 KiB
Plaintext

=== 1.3 descriptor type breakdown (Proxmox support's own diagnostic) ===
UTC: 2026-08-20T08:02:59+00:00
PID=551655
--- lsof TYPE histogram ---
390 IPv6
32 REG
7 unix
3 a_inode
2 DIR
1 CHR
--- lsof TCP count ---
390
--- /proc fd link-target class histogram (independent of lsof) ---
397 socket
2 anon_inode:[eventpoll]
1 anon_inode:[eventfd]
1 0
1 /var/log/proxmox-backup/api/auth.log
1 /var/log/proxmox-backup/api/access.log
1 /var/lib/proxmox-backup/rrdb/rrd.journal
1 /mnt/pbs-datastore/.lock
1 /dev/null
=== 1.6 control-window cleanliness ===
--- access log files ---
total 55744
drwxr-xr-x 2 backup backup 4096 Aug 20 00:00 .
drwxr-xr-x 4 root root 4096 Jul 3 19:33 ..
-rw-r--r-- 1 backup backup 4023740 Aug 20 08:02 access.log
-rw-r--r-- 1 backup backup 43115482 Aug 19 23:59 access.log.1
-rw-r--r-- 1 backup backup 700249 Jul 24 00:00 access.log.10.zst
-rw-r--r-- 1 backup backup 724750 Jul 19 00:00 access.log.11.zst
-rw-r--r-- 1 backup backup 612227 Jul 15 00:00 access.log.12.zst
-rw-r--r-- 1 backup backup 959113 Aug 20 00:00 access.log.2.zst
-rw-r--r-- 1 backup backup 975898 Aug 16 00:00 access.log.3.zst
-rw-r--r-- 1 backup backup 1274332 Aug 13 00:00 access.log.4.zst
-rw-r--r-- 1 backup backup 1078875 Aug 9 00:00 access.log.5.zst
-rw-r--r-- 1 backup backup 850578 Aug 6 00:00 access.log.6.zst
-rw-r--r-- 1 backup backup 857058 Aug 3 00:00 access.log.7.zst
-rw-r--r-- 1 backup backup 986392 Jul 31 00:00 access.log.8.zst
-rw-r--r-- 1 backup backup 705209 Jul 28 00:00 access.log.9.zst
-rw-r--r-- 1 backup backup 164293 Aug 18 03:55 auth.log
--- log format sample ---
::ffff:10.77.0.3 - felhom@pbs!demo-hp [20/08/2026:08:02:52 +0000] "GET /api2/json/admin/datastore/felhom-offsite/status" 200 67 proxmox-backup-client/1.0
::ffff:10.77.0.3 - felhom@pbs!demo-hp [20/08/2026:08:02:54 +0000] "GET /api2/json/admin/datastore" 200 110 libwww-perl/6.78
::ffff:10.77.0.3 - felhom@pbs!demo-hp [20/08/2026:08:02:54 +0000] "GET /api2/json/admin/datastore/felhom-offsite/status" 200 67 proxmox-backup-client/1.0