[error 'open /proc/stat: too many open files']

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

[error 'open /proc/stat: too many open files']

L2 Linker

Recently had some performance problems reported from my xsoar users.

Found a tenant crashing.  Upon investigating I found the following error in the logs:

App03 host:

error Couldn't calc cores number [error 'open /proc/stat: too many open files']error Couldn't calc cores number [error 'open /proc/stat: too many open files'] 

 

I set this on APP03 last night as a temporary band-aid until I could better understand:
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-multi-tenant-guide/manage-con...

 

 

Review other host nodes that I didn't touch I see the following:

ulimit -a for root shows:

open files                      (-n) 1024

 

DockerHardeningCheck shows:

jboyd98_0-1646333459707.png

 

Additionally:

jboyd98_1-1646333459832.png

 

 

This key does NOT exist under  Advanced /Troubleshooting:

jboyd98_2-1646333459708.png

 

 

Where is it pulling 1048576 from; where would this be set and whats the difference between that and my ulimit -a for root (there is no special config in /etc/security/limits.conf)

Any feedback is appreciated,

 

Boyd

 

 
2 REPLIES 2

L2 Linker

Hi Jboyd,

 

This forum is best for implementation questions, not so much for server crashes, bugs, or other unexpected behaviors.

 

I would recommend that you open a support ticket a support.paloaltonetworks.com. Please attach your log bundle set to Debug level from the Settings>About>Troubleshooting page. There you will be met with the proper team to investigate this, along with an SLA for a response to your issue.

 

Thanks,

Lance

Thanks, I opened a support ticket as suggested.

Though, I referenced the error, I really just want to better understand how max open files / file descriptors setting is inherited by xsoar containers.  More of an education question.

  • 1985 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!