There are a number of resource limits (called [[User Beancounters]], or UBC for short) set for a VEcontainer. If one of those resources hit its limit, the appropriate fail counter (last column of <code>/proc/user_beancounters</code>) increases. See [[Resource shortage]] for more info.

UBC failcnts are stored for the duration of the uptime of your VEcontainer. Thus, restarting the VE container resets the counts.

The problem here is tcp time wait buckets can still there after a VE container is stopped. You can check that by seeing the <code>held</code> column for <code>kmemsize</code> parameter. If it is not zero, that means you have to wait about 5 minutes in order to time wait buckets to expire, and the corresponding beancounter to be uncharged.

If you still see failcnt not reset to 0 after more than 5 minutes after VE container is stopped, your kernel was likely compiled with CONFIG_UBC_KEEP_UNUSED=y, and in that case you'll have to switch off this option if you want to reset beancounters when VE container is restarted.