[Bro] accept failed, Too many open files 24

[James Lay]

You bet...sorry it didn't help.  Would like to know what the resolution 
was once you find it.

James

On 2016-11-02 09:53, Matt Clemons wrote:
> James,
> I tried all those options.  Bro would hang when I changed the soft
> limit, and no matter what hard limit I set, it still produced errors.
> I'm going to do a parallel install of 2.5 and see if that fixes it.  I
> have already tested, but was waiting for the full release.
> 
> Thanks for you responses.
> 
> On Wed, Nov 2, 2016 at 9:13 AM, James Lay <jlay at slave-tothe-box.net>
> wrote:
> 
>> On 2016-11-01 15:16, Azoff, Justin S wrote:
>>>> On Nov 1, 2016, at 4:25 PM, Seth Hall <seth at icir.org> wrote:
>>>> 
>>>> 
>>>>> On Nov 1, 2016, at 11:06 AM, Matt Clemons
>> <matt.clemons at gmail.com>
>>>>> wrote:
>>>>> 
>>>>> Has anyone had to deal with this issue or have some ideas?  Is
>> there
>>>>> some hidden setting in bro where I can set open file limits
>>>> 
>>>> There was an issue with file handles being left open when they
>> weren't
>>>> needed which will be fixed in 2.5 (and is fixed in the 2.5 beta).
>>>> Also, in 2.5 you can run a cluster with a dedicated "logger" node
>>>> which should improve some of the cluster behavior with such a
>> large
>>>> cluster.
>>>> 
>>>> I would recommend jumping in and trying out the beta.
>>> 
>>> The 2 file descriptor leakage fixes were committed just after the
>> 2.5
>>> beta was released
>>> 
>>> commit 520ed43eae4ce7bcd8bb22cfd9cb6d138c4a4fd7
>>> Author: Daniel Thayer <dnthayer at illinois.edu>
>>> Date:   Wed Aug 31 16:30:10 2016 -0500
>>> 
>>> Added another missing fclose in scan.l
>>> 
>>> commit b3a7d07e66b027a56e57ba010998639ff0d6da86
>>> Author: Daniel Thayer <dnthayer at illinois.edu>
>>> Date:   Wed Aug 31 14:07:44 2016 -0500
>> 
>> Give this a look:
>> 
>> http://posidev.com/blog/2009/06/04/set-ulimit-parameters-on-ubuntu/
>> [1]
>> 
>> James
>> _______________________________________________
>> Bro mailing list
>> bro at bro-ids.org
>> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro [2]
> 
> --
> 
> Regards,
> 
> Matt Clemons
> (816) 200-0789
> 
> 
> Links:
> ------
> [1] http://posidev.com/blog/2009/06/04/set-ulimit-parameters-on-ubuntu/
> [2] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro