On Tue, 2019-07-30 at 14:56 -0400, Brian Reichert wrote: > I see, between 13:49:30 and 13:50:01, I see 25 'successful' calls > for close(), e.g.: > > 13:50:01 close(19) = 0 > > Followed by getsockopt(), and a received message on the supposedly-closed > file descriptor: > > 13:50:01 getsockopt(19, SOL_SOCKET, SO_PEERCRED, {pid=3323, uid=0, gid=0}, [12]) = 0 Are you sure it's the same file descriptor? You don't explicitly say anything about there not being any relevant lines between those. Does systemd really just call getsockopt() on fd 19 after closing it, with nothing to trigger that? Obvious candidates to check in the strace would be an accept call returning a new fd 19, or epoll indicating activity on the fd (though I'd expect systemd to remove the fd from the epoll set after closing it). _______________________________________________ systemd-devel mailing list systemd-devel@xxxxxxxxxxxxxxxxxxxxx https://lists.freedesktop.org/mailman/listinfo/systemd-devel