[syslog-ng] Syslog-ng too many open files

[Pedro Rafael Alves Simoes]

> ------------------------------
>
> Message: 3
> Date: Thu, 24 Jan 2008 12:41:36 +0000
> From: Joe Fegan <joe_fegan at hotmail.com>
> Subject: Re: [syslog-ng] Syslog-ng too many open files
> To: Syslog-ng users' and developers' mailing list
>         <syslog-ng at lists.balabit.hu>
> Message-ID: <BAY111-W20A021959661E71A0B78C39B380 at phx.gbl>
> Content-Type: text/plain; charset="windows-1256"
>
>
> What version of syslog-ng is this? Is it 2.0.7?
>
> Could it be the same issue recently reported as "syslog-ng 2.0.7 major
problem?"
> in the list archives, where syslog-ng 2.0.7 does not close old files after
SIGHUP?
> 300,000 is a lot of files...
>
I'm using Syslog-ng 2.0.0-1 in a Debian Etch Linux.

> ------------------------------
>
> Message: 4
> Date: Thu, 24 Jan 2008 12:46:53 -0000
> From: "Geller, Sandor \(IT\)" <Sandor.Geller at morganstanley.com>
> Subject: Re: [syslog-ng] Syslog-ng too many open files
> To: "Syslog-ng users' and developers' mailing list"
>         <syslog-ng at lists.balabit.hu>
> Message-ID:
>         <14F0A35F6E466D48BF11108F4E09E68C0970D239 at LNWEXMB58.msad.ms.com>
> Content-Type: text/plain;       charset="us-ascii"
>
> Hi,
>
> > Hello,
> >
> > I'm receiving many messages on my syslog-ng like this:
> >
> > syslog-ng[20419]: Error opening file for writing; filename="...",
> > error='Too many open files (24)'
> > syslog-ng[20419]: Error accepting new connection; error='Too many open
> > files (24)'
>
> Try raising the per-process number of open files. Please refer to
> ulimit.
>
> > In lsof output, the syslog-ng daemon has many files opened and when I
> > try to login from other console or change to root account, it gets
> > blocked.
> >
> > I've increased the sysctl fs.file-max to 300000 but the
> > problem persists.
>
> This raises the per-system limit only. per-process limits still
> apply as well as the maximum (maybe 4096, I'm not sure) is hardcoded
> into the kernel, so without recompiling you r kernel you can't exceed
> this limitation.
When you said that's hardcoded, you mean that I have to change the source
code or it's configurable via make config?

>
> > Any ideas what's going wrong?
>
> Without seeing more details (syslog-ng version number, configuration,
> approximate number of clients, client configs) we could only guess.
>
> Regards,
>
> Sandor
> --------------------------------------------------------
>
> NOTICE: If received in error, please destroy and notify sender. Sender
does not intend to waive confidentiality or privilege. Use of this email is
prohibited when received in error.
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.balabit.hu/pipermail/syslog-ng/attachments/20080125/1c50fd80/attachment.htm