topic Re: [error 'open /proc/stat: too many open files'] in Cortex XSOAR Discussions

[error 'open /proc/stat: too many open files']

jboyd98 — Thu, 03 Mar 2022 18:51:25 GMT

Recently had some performance problems reported from my xsoar users.

Found a tenant crashing. Upon investigating I found the following error in the logs:

App03 host:

error Couldn't calc cores number [error 'open /proc/stat: too many open files']error Couldn't calc cores number [error 'open /proc/stat: too many open files']

I set this on APP03 last night as a temporary band-aid until I could better understand:
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-multi-tenant-guide/manage-con...

Review other host nodes that I didn't touch I see the following:

ulimit -a for root shows:

open files (-n) 1024

DockerHardeningCheck shows:

Additionally:

This key does NOT exist under Advanced /Troubleshooting:

Where is it pulling 1048576 from; where would this be set and whats the difference between that and my ulimit -a for root (there is no special config in /etc/security/limits.conf)

Any feedback is appreciated,

Boyd

Re: [error 'open /proc/stat: too many open files']

LancePettay — Thu, 03 Mar 2022 20:26:45 GMT

Hi Jboyd,

This forum is best for implementation questions, not so much for server crashes, bugs, or other unexpected behaviors.

I would recommend that you open a support ticket a support.paloaltonetworks.com. Please attach your log bundle set to Debug level from the Settings>About>Troubleshooting page. There you will be met with the proper team to investigate this, along with an SLA for a response to your issue.

Thanks,

Lance

Re: [error 'open /proc/stat: too many open files']

jboyd98 — Thu, 03 Mar 2022 20:30:21 GMT

Thanks, I opened a support ticket as suggested.

Though, I referenced the error, I really just want to better understand how max open files / file descriptors setting is inherited by xsoar containers. More of an education question.