[Bro] accept failed, Too many open files 24

[James Lay]

On 2016-11-01 15:16, Azoff, Justin S wrote:
>> On Nov 1, 2016, at 4:25 PM, Seth Hall <seth at icir.org> wrote:
>> 
>> 
>>> On Nov 1, 2016, at 11:06 AM, Matt Clemons <matt.clemons at gmail.com> 
>>> wrote:
>>> 
>>> Has anyone had to deal with this issue or have some ideas?  Is there 
>>> some hidden setting in bro where I can set open file limits
>> 
>> There was an issue with file handles being left open when they weren't 
>> needed which will be fixed in 2.5 (and is fixed in the 2.5 beta).  
>> Also, in 2.5 you can run a cluster with a dedicated "logger" node 
>> which should improve some of the cluster behavior with such a large 
>> cluster.
>> 
>> I would recommend jumping in and trying out the beta.
> 
> The 2 file descriptor leakage fixes were committed just after the 2.5
> beta was released
> 
> commit 520ed43eae4ce7bcd8bb22cfd9cb6d138c4a4fd7
> Author: Daniel Thayer <dnthayer at illinois.edu>
> Date:   Wed Aug 31 16:30:10 2016 -0500
> 
>     Added another missing fclose in scan.l
> 
> commit b3a7d07e66b027a56e57ba010998639ff0d6da86
> Author: Daniel Thayer <dnthayer at illinois.edu>
> Date:   Wed Aug 31 14:07:44 2016 -0500

Give this a look:

http://posidev.com/blog/2009/06/04/set-ulimit-parameters-on-ubuntu/

James