------------------------------
Message: 3 Date: Thu, 24 Jan 2008 12:41:36 +0000 From: Joe Fegan <joe_fegan@hotmail.com> Subject: Re: [syslog-ng] Syslog-ng too many open files To: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu> Message-ID: <BAY111-W20A021959661E71A0B78C39B380@phx.gbl> Content-Type: text/plain; charset="windows-1256"
What version of syslog-ng is this? Is it 2.0.7?
Could it be the same issue recently reported as "syslog-ng 2.0.7 major problem?" in the list archives, where syslog-ng 2.0.7 does not close old files after SIGHUP? 300,000 is a lot of files...
I'm using Syslog-ng 2.0.0-1 in a Debian Etch Linux.
------------------------------
Message: 4 Date: Thu, 24 Jan 2008 12:46:53 -0000 From: "Geller, Sandor \(IT\)" <Sandor.Geller@morganstanley.com> Subject: Re: [syslog-ng] Syslog-ng too many open files To: "Syslog-ng users' and developers' mailing list" <syslog-ng@lists.balabit.hu> Message-ID: <14F0A35F6E466D48BF11108F4E09E68C0970D239@LNWEXMB58.msad.ms.com> Content-Type: text/plain; charset="us-ascii"
Hi,
Hello,
I'm receiving many messages on my syslog-ng like this:
syslog-ng[20419]: Error opening file for writing; filename="...", error='Too many open files (24)' syslog-ng[20419]: Error accepting new connection; error='Too many open files (24)'
Try raising the per-process number of open files. Please refer to ulimit.
In lsof output, the syslog-ng daemon has many files opened and when I try to login from other console or change to root account, it gets blocked.
I've increased the sysctl fs.file-max to 300000 but the problem persists.
This raises the per-system limit only. per-process limits still apply as well as the maximum (maybe 4096, I'm not sure) is hardcoded into the kernel, so without recompiling you r kernel you can't exceed this limitation. When you said that's hardcoded, you mean that I have to change the source code or it's configurable via make config?
Any ideas what's going wrong?
Without seeing more details (syslog-ng version number, configuration, approximate number of clients, client configs) we could only guess.
Regards,
Sandor --------------------------------------------------------
NOTICE: If received in error, please destroy and notify sender. Sender
does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.