Hi Pedro, If you are not expecting syslog-ng to open so many files then we should be investigating why it is, not investigating how to raise the limit. Do you end up with thousands of unexpected files in the output directory? Does the lsof output and/or syslog-ng error messages give you any hint about the naming pattern of the new files? Can you send on your syslog-ng.conf file and some complete error messages. Joe. ________________________________ Date: Fri, 25 Jan 2008 15:02:31 +0000 From: pedro.a.simoes@gmail.com To: syslog-ng@lists.balabit.hu Subject: Re: [syslog-ng] Syslog-ng too many open files
------------------------------
Message: 3 Date: Thu, 24 Jan 2008 12:41:36 +0000 From: Joe Fegan <joe_fegan@hotmail.com> Subject: Re: [syslog-ng] Syslog-ng too many open files To: Syslog-ng users' and developers' mailing list <syslog-ng@lists.balabit.hu> Message-ID: <BAY111-W20A021959661E71A0B78C39B380@phx.gbl> Content-Type: text/plain; charset="windows-1256"
What version of syslog-ng is this? Is it 2.0.7?
Could it be the same issue recently reported as "syslog-ng 2.0.7 major problem?" in the list archives, where syslog-ng 2.0.7 does not close old files after SIGHUP? 300,000 is a lot of files...
I'm using Syslog-ng 2.0.0-1 in a Debian Etch Linux.
------------------------------
Message: 4 Date: Thu, 24 Jan 2008 12:46:53 -0000 From: "Geller, Sandor \(IT\)" <Sandor.Geller@morganstanley.com> Subject: Re: [syslog-ng] Syslog-ng too many open files To: "Syslog-ng users' and developers' mailing list" <syslog-ng@lists.balabit.hu> Message-ID: <14F0A35F6E466D48BF11108F4E09E68C0970D239@LNWEXMB58.msad.ms.com> Content-Type: text/plain; charset="us-ascii"
Hi,
Hello,
I'm receiving many messages on my syslog-ng like this:
syslog-ng[20419]: Error opening file for writing; filename="...", error='Too many open files (24)' syslog-ng[20419]: Error accepting new connection; error='Too many open files (24)'
Try raising the per-process number of open files. Please refer to ulimit.
In lsof output, the syslog-ng daemon has many files opened and when I try to login from other console or change to root account, it gets blocked.
I've increased the sysctl fs.file-max to 300000 but the problem persists.
This raises the per-system limit only. per-process limits still apply as well as the maximum (maybe 4096, I'm not sure) is hardcoded into the kernel, so without recompiling you r kernel you can't exceed this limitation. When you said that's hardcoded, you mean that I have to change the source code or it's configurable via make config?
Any ideas what's going wrong?
Without seeing more details (syslog-ng version number, configuration, approximate number of clients, client configs) we could only guess.
Regards,
Sandor --------------------------------------------------------
NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.
_________________________________________________________________ Get 30 Free Emoticons for your Windows Live Messenger http://www.livemessenger-emoticons.com/en-ie