ss --events no output on CentOS 7

Solution 1:

Here are the relevant commits:

• iproute2 commit:

ss: Include -E option for socket destroy events

Use the IPv4/IPv6/TCP/UDP multicast groups of NETLINK_SOCK_DIAG to filter and display socket statistics as they are destroyed.

Kernel support patch series: 24029a3603cfa633e8bc2b3fb3e48e76c497831d

Signed-off-by: Craig Gallek [email protected]

• kernel commit

Merge branch 'sock_diag_destruction_events'

Craig Gallek says:

====================
Socket destruction events via netlink sock_diag

This series extends the netlink sock_diag interface to broadcast socket information as they are being destroyed. The current interface is poll based and can not be used to retreive information about sockets that are destroyed between poll intervals.
[...]

This has been included in Linux kernel 4.2.

While Red Hat backports a lot of features in older kernels, from OP's question, it appears this feature isn't available in CentOS 7's kernel 3.10.