Skip to main content
Migration Notice
We're migrating documentation from the old portal into this one. Some things may look a little different or out of place in the meantime — we know, and we're working to get it right. If something's unclear or doesn't look right, let us know.

Agent Dashboard — TCP Orphan

What this chart shows​

TCP Orphan — the number of TCP sockets that are no longer attached to a file descriptor but have not yet been fully torn down, read from /proc/net/sockstat (orphan field) on every heartbeat (~30 s + 0–10 s jitter).

Orphaned sockets arise when a process closes a socket while data is still in-flight or when the remote end has not acknowledged a FIN. The kernel continues to manage them until they drain or time out.

Linux only​

This metric requires /proc/net/sockstat.

How to read it​

Value rangeInterpretation
0–10Normal
10–50Elevated — possible network issues or abrupt connection closures
> 50High — investigate network connectivity to S3 endpoints or ClickHouse

Why orphans appear during copy jobs​

If the network path to S3 or ClickHouse becomes unstable (packet loss, MTU mismatch, firewall resets), the agent's TCP stack may accumulate orphaned sockets while waiting for acknowledgements that never arrive. Unlike TIME_WAIT (which is always transient and benign), a sustained rise in orphan count indicates an active network problem.

Polling interval​

Sampled on every heartbeat (~30 s + 0–10 s jitter). Orphan counts should normally stay near zero.

Tips​

  • A non-zero orphan count that persists across multiple heartbeats is a signal to check network connectivity between the agent host and its S3 target endpoint.
  • Correlate with TCP TIME_WAIT and Egress (Tx) charts — if Egress drops and orphans rise simultaneously, the network path is likely disrupted.