[Bro] accept failed, Too many open files 24

[Matt Clemons]

Lo All,

Started receiving this error after adding a worker yesterday.  If I remove
the worker and deploy, no issues.

Communications.log: "accept failed, Too many open files 24"


Running CentOS6.  Bro 2.4.1.  17 Physical worker systems.  150 total worker
processes.

When adding the 18th worker (6 additional worker processes) logs slow to a
crawl and the communications log is filled with the failure message.

I've experimented with limits.conf and set a high soft and hard limits of
open files.  Also tried doubling the defaults, and many different
combinations to no avail.  Most of these caused bro to hang and stop
logging.  Others had no affect on the problem.

Has anyone had to deal with this issue or have some ideas?  Is there some
hidden setting in bro where I can set open file limits?

-- 
Regards,

Matt Clemons
(816) 200-0789
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20161101/25788555/attachment.html