<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Too many open files error in engine log in General Topics</title>
    <link>https://live.paloaltonetworks.com/t5/general-topics/too-many-open-files-error-in-engine-log/m-p/120861#M99793</link>
    <description>&lt;P&gt;The only other things I see (grepping for error) are like this:&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;PRE&gt;2016-10-23T07:39:03 (23610)basepoller._age_out_run ERROR: Exception in _age_out_loop
2016-10-23T07:39:05 (23610)local._build_iterator ERROR: &amp;lt;feed name&amp;gt; - exception loading indicators list
&lt;/PRE&gt;</description>
    <pubDate>Mon, 24 Oct 2016 15:50:57 GMT</pubDate>
    <dc:creator>DanWoodruff</dc:creator>
    <dc:date>2016-10-24T15:50:57Z</dc:date>
    <item>
      <title>Too many open files error in engine log</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/too-many-open-files-error-in-engine-log/m-p/120824#M99791</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;As of yesterday morning I'm getting an error in my MineMeld engine log that is indicating too many open files. Also, some of my input and output miners are not updating (they show 0 entries even though there are indicators in the input table in the web interface). The timing indicates these errors are possibly the cause. Examples:&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;PRE&gt;2016-10-23T07:43:43 (23610)basepoller._run ERROR: Exception in polling loop for &amp;lt;feed name&amp;gt;: IO error: &amp;lt;feed name&amp;gt;/194800.ldb: Too many open files
IOError: IO error: &amp;lt;feed name&amp;gt;/194800.ldb: Too many open files
OSError: [Errno 24] Too many open files: '/opt/minemeld/local/config/&amp;lt;feed name&amp;gt;_indicators.yml.lock'&lt;/PRE&gt;
&lt;P&gt;I've restarted MineMeld and the error has gone away for now. It was only running for about 3 days before the errors started:&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;PRE&gt;2016-10-20T09:28:18 (23604)launcher.main INFO: Starting mm-run.py version 0.9.24&lt;/PRE&gt;
&lt;P&gt;Any guidance on how to best increase the max number of file descriptors for MineMeld?&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Thanks,&lt;/P&gt;
&lt;P&gt;Dan&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Mon, 24 Oct 2016 14:51:58 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/too-many-open-files-error-in-engine-log/m-p/120824#M99791</guid>
      <dc:creator>DanWoodruff</dc:creator>
      <dc:date>2016-10-24T14:51:58Z</dc:date>
    </item>
    <item>
      <title>Re: Too many open files error in engine log</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/too-many-open-files-error-in-engine-log/m-p/120831#M99792</link>
      <description>&lt;P&gt;Hi Dan,&lt;/P&gt;
&lt;P&gt;do you see other ERRORs in the log file ?&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Luigi&lt;/P&gt;</description>
      <pubDate>Mon, 24 Oct 2016 15:09:53 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/too-many-open-files-error-in-engine-log/m-p/120831#M99792</guid>
      <dc:creator>lmori</dc:creator>
      <dc:date>2016-10-24T15:09:53Z</dc:date>
    </item>
    <item>
      <title>Re: Too many open files error in engine log</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/too-many-open-files-error-in-engine-log/m-p/120861#M99793</link>
      <description>&lt;P&gt;The only other things I see (grepping for error) are like this:&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;PRE&gt;2016-10-23T07:39:03 (23610)basepoller._age_out_run ERROR: Exception in _age_out_loop
2016-10-23T07:39:05 (23610)local._build_iterator ERROR: &amp;lt;feed name&amp;gt; - exception loading indicators list
&lt;/PRE&gt;</description>
      <pubDate>Mon, 24 Oct 2016 15:50:57 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/too-many-open-files-error-in-engine-log/m-p/120861#M99793</guid>
      <dc:creator>DanWoodruff</dc:creator>
      <dc:date>2016-10-24T15:50:57Z</dc:date>
    </item>
    <item>
      <title>Re: Too many open files error in engine log</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/too-many-open-files-error-in-engine-log/m-p/120867#M99794</link>
      <description>&lt;P&gt;Also I should note I'm on Ubuntu 14.04.5 that I installed myself, not the OVA. Thanks!&lt;/P&gt;</description>
      <pubDate>Mon, 24 Oct 2016 16:07:07 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/too-many-open-files-error-in-engine-log/m-p/120867#M99794</guid>
      <dc:creator>DanWoodruff</dc:creator>
      <dc:date>2016-10-24T16:07:07Z</dc:date>
    </item>
    <item>
      <title>Re: Too many open files error in engine log</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/too-many-open-files-error-in-engine-log/m-p/120871#M99795</link>
      <description>&lt;P&gt;I'm keeping an eye on open file descriptors by process and will report back when/if the error occurs again and what process is consuming the most files.&amp;nbsp;&lt;/P&gt;
&lt;PRE&gt;$ for p in `ls /proc/*/fd -d`; do  echo "`sudo ls $p | wc -l` : $p"; done | sort -n | grep -v '^0' | tail
14 : /proc/5290/fd
15 : /proc/19530/fd
16 : /proc/1103/fd
16 : /proc/533/fd
19 : /proc/18286/fd
24 : /proc/2029/fd
64 : /proc/1845/fd
96 : /proc/5296/fd
106 : /proc/5295/fd
109 : /proc/1748/fd
&lt;/PRE&gt;</description>
      <pubDate>Mon, 24 Oct 2016 16:24:00 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/too-many-open-files-error-in-engine-log/m-p/120871#M99795</guid>
      <dc:creator>DanWoodruff</dc:creator>
      <dc:date>2016-10-24T16:24:00Z</dc:date>
    </item>
    <item>
      <title>Re: Too many open files error in engine log</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/too-many-open-files-error-in-engine-log/m-p/121147#M99796</link>
      <description>&lt;P&gt;I believe this may have been an artifact of my scripted backend updates to miners and MineMeld polling each miner for changes every 1 minute. I've since created new miners to be used with these scripted updates that have a once a day update interval, rather than once a minute, relying on my script to send a HUP to the feed after it has been updated as advised in another thread by Luigi. It has been running for 24 hours with no sign of the number of open files running away (and much better CPU usage).&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Tue, 25 Oct 2016 13:02:41 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/too-many-open-files-error-in-engine-log/m-p/121147#M99796</guid>
      <dc:creator>DanWoodruff</dc:creator>
      <dc:date>2016-10-25T13:02:41Z</dc:date>
    </item>
    <item>
      <title>Re: Too many open files error in engine log</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/too-many-open-files-error-in-engine-log/m-p/121411#M99797</link>
      <description>&lt;P&gt;Great ! &amp;nbsp;Thanks for letting us know ! I think the original problem was a descriptor leak generated by the heavy usage of the local list Miner. It will be fixed in 0.9.28.&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;Luigi&lt;/P&gt;</description>
      <pubDate>Wed, 26 Oct 2016 08:29:39 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/too-many-open-files-error-in-engine-log/m-p/121411#M99797</guid>
      <dc:creator>lmori</dc:creator>
      <dc:date>2016-10-26T08:29:39Z</dc:date>
    </item>
  </channel>
</rss>

