[syslog-ng] Syslog-ng too many open files

[Joe Fegan]

Hi Pedro,

If you are not expecting syslog-ng to open so many files then we should
be investigating why it is, not investigating how to raise the limit.

Do you end up with thousands of unexpected files in the output directory?
Does the lsof output and/or syslog-ng error messages give you any hint
about the naming pattern of the new files? Can you send on your
syslog-ng.conf file and some complete error messages.

Joe.

________________________________

Date: Fri, 25 Jan 2008 15:02:31 +0000
From: pedro.a.simoes at gmail.com
To: syslog-ng at lists.balabit.hu
Subject: Re: [syslog-ng] Syslog-ng too many open files

> ------------------------------
>
> Message: 3
> Date: Thu, 24 Jan 2008 12:41:36 +0000
> From: Joe Fegan <joe_fegan at hotmail.com>
> Subject: Re: [syslog-ng] Syslog-ng too many open files
> To: Syslog-ng users' and developers' mailing list
>         <syslog-ng at lists.balabit.hu>
> Message-ID: <BAY111-W20A021959661E71A0B78C39B380 at phx.gbl>
> Content-Type: text/plain; charset="windows-1256"
>
>
> What version of syslog-ng is this? Is it 2.0.7?
>
> Could it be the same issue recently reported as "syslog-ng 2.0.7 major problem?"
> in the list archives, where syslog-ng 2.0.7 does not close old files after SIGHUP?
> 300,000 is a lot of files...
>
I'm using Syslog-ng 2.0.0-1 in a Debian Etch Linux.

> ------------------------------
>
> Message: 4
> Date: Thu, 24 Jan 2008 12:46:53 -0000
> From: "Geller, Sandor \(IT\)" <Sandor.Geller at morganstanley.com>
> Subject: Re: [syslog-ng] Syslog-ng too many open files
> To: "Syslog-ng users' and developers' mailing list"
>         <syslog-ng at lists.balabit.hu>
> Message-ID:
>         <14F0A35F6E466D48BF11108F4E09E68C0970D239 at LNWEXMB58.msad.ms.com>
> Content-Type: text/plain;       charset="us-ascii"
>
> Hi,
>
>> Hello,
>>
>> I'm receiving many messages on my syslog-ng like this:
>>
>> syslog-ng[20419]: Error opening file for writing; filename="...",
>> error='Too many open files (24)'
>> syslog-ng[20419]: Error accepting new connection; error='Too many open
>> files (24)'
>
> Try raising the per-process number of open files. Please refer to
> ulimit.
>
>> In lsof output, the syslog-ng daemon has many files opened and when I
>> try to login from other console or change to root account, it gets
>> blocked.
>>
>> I've increased the sysctl fs.file-max to 300000 but the
>> problem persists.
>
> This raises the per-system limit only. per-process limits still
> apply as well as the maximum (maybe 4096, I'm not sure) is hardcoded
> into the kernel, so without recompiling you r kernel you can't exceed
> this limitation.
When you said that's hardcoded, you mean that I have to change the source code or it's configurable via make config?

>
>> Any ideas what's going wrong?
>
> Without seeing more details (syslog-ng version number, configuration,
> approximate number of clients, client configs) we could only guess.
>
> Regards,
>
> Sandor
> --------------------------------------------------------
>
> NOTICE: If received in error, please destroy and notify sender. Sender does not intend to waive confidentiality or privilege. Use of this email is prohibited when received in error.
>
>


_________________________________________________________________
Get 30 Free Emoticons for your Windows Live Messenger
http://www.livemessenger-emoticons.com/en-ie