[Bro] accept failed, Too many open files 24

[Matt Clemons]

James,
I tried all those options.  Bro would hang when I changed the soft limit,
and no matter what hard limit I set, it still produced errors.  I'm going
to do a parallel install of 2.5 and see if that fixes it.  I have already
tested, but was waiting for the full release.

Thanks for you responses.

On Wed, Nov 2, 2016 at 9:13 AM, James Lay <jlay at slave-tothe-box.net> wrote:

> On 2016-11-01 15:16, Azoff, Justin S wrote:
> >> On Nov 1, 2016, at 4:25 PM, Seth Hall <seth at icir.org> wrote:
> >>
> >>
> >>> On Nov 1, 2016, at 11:06 AM, Matt Clemons <matt.clemons at gmail.com>
> >>> wrote:
> >>>
> >>> Has anyone had to deal with this issue or have some ideas?  Is there
> >>> some hidden setting in bro where I can set open file limits
> >>
> >> There was an issue with file handles being left open when they weren't
> >> needed which will be fixed in 2.5 (and is fixed in the 2.5 beta).
> >> Also, in 2.5 you can run a cluster with a dedicated "logger" node
> >> which should improve some of the cluster behavior with such a large
> >> cluster.
> >>
> >> I would recommend jumping in and trying out the beta.
> >
> > The 2 file descriptor leakage fixes were committed just after the 2.5
> > beta was released
> >
> > commit 520ed43eae4ce7bcd8bb22cfd9cb6d138c4a4fd7
> > Author: Daniel Thayer <dnthayer at illinois.edu>
> > Date:   Wed Aug 31 16:30:10 2016 -0500
> >
> >     Added another missing fclose in scan.l
> >
> > commit b3a7d07e66b027a56e57ba010998639ff0d6da86
> > Author: Daniel Thayer <dnthayer at illinois.edu>
> > Date:   Wed Aug 31 14:07:44 2016 -0500
>
> Give this a look:
>
> http://posidev.com/blog/2009/06/04/set-ulimit-parameters-on-ubuntu/
>
> James
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>



-- 
Regards,

Matt Clemons
(816) 200-0789
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20161102/fb9a8104/attachment.html