Linux – Production Instance : CLOSE_WAIT Connection Issue

Please add sar -w 1 output. I suppose a number of context switches per second is killing your performance, because there are much more processes running than available processors. I think context switches on a virtual machine are expensive.

If it's true, then there are some kernel tunables that can help you lower number of context switches:

• Check value of systctl kernel.sched_min_granularity_ns. Double it with a command similar to systctl kernel.sched_min_granularity_ns=2000000. Retest. Double it again. Retest. Repeat. Try to find a value which will not cripple interactivity too much but won't allow too many context switches and write it to /etc/sysctl.conf so it will be set at startup.

• Set apache scheduling policy to SCHED_BATCH - start it with chrt -b 0 apache2

When your RDS instance is not in a VPC, then your RDS instance is associated with an RDS security group. Those security groups are controlled by the "Security Groups" section in the RDS console. From there, you can add EC2-Classic security groups for access:

1. Select your RDS security group
2. Select "EC2 Security Group" for the "Connection Type"
3. Select this or another AWS account and fill in the other AWS account number if necessary
4. Select or fill in the correct security group.
5. Click "Authorize"

When your RDS instance is inside a VPC, then your RDS instance is associated with a VPC security group. Those security groups are controlled by the "Security Groups" section in the VPC console. From there, you can add other VPC security groups for access:

1. Select your VPC security group
2. Select the "Inbound Rules" tab
3. Click "Edit"
4. Add a new rule, select your protocol and port range. For "Source", type or select your security group. Only VPC security groups within the same VPC can be used for this purpose.
5. Click "Save"

Note, when selecting the security group, depending on the browser you're using, the list may only appear once focus is in the "Source" edit box. It may also only appear if you start typing. Also, it may not appear at all. If this is the case, type in the source VPC security group's identifier (eg. sg-12345678).