Gateway unresponsiveness due to TCP CLOSE_WAIT connection leak - CA API Gateway

Products

• CA API Gateway

Issue/Introduction

The CA API Gateway process (ssg) may become unresponsive under high concurrency or specific network conditions, requiring a manual service restart.

This is often accompanied by a high number of TCP connections stuck in a CLOSE_WAIT state.

netstat -an | grep CLOSE_WAIT | wc -l.

Service is temporarily restored after running systemctl restart ssg.

Environment

• CA API Gateway 11.1, 11.2

Cause

 A product defect (DE671017) in the network handling logic prevents the Gateway from properly closing sockets during certain TCP events, such as Zero Window scenarios.

Resolution

This issue is targeted to be fixed in release 11.2.2.

For immediate resolution on version 11.2.0,  request the hotfix by raising a support case ,

1. Take a snapshot or backup of the Gateway appliance.
2. Stop the Gateway service:

   systemctl stop ssg

3. Install the following hotfix packages:
   • ssg-appliance_11.2.0-25127-hotfixDE671017_all.deb
   • ssg_11.2.0-25127-hotfixDE671017_all.deb

   dpkg -i ssg-appliance_11.2.0-25127-hotfixDE671017_all.deb ssg_11.2.0-25127-hotfixDE671017_all.deb

4. Start the Gateway service:

   systemctl start ssg

    

Additional Information

• To monitor connection counts, use: netstat -an | grep CLOSE_WAIT | wc -l.
• If the issue persists after applying the hotfix. contact Broadcom support