- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
03-03-2022 10:51 AM
Recently had some performance problems reported from my xsoar users.
Found a tenant crashing. Upon investigating I found the following error in the logs:
App03 host:
error Couldn't calc cores number [error 'open /proc/stat: too many open files']error Couldn't calc cores number [error 'open /proc/stat: too many open files']
I set this on APP03 last night as a temporary band-aid until I could better understand:
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-multi-tenant-guide/manage-con...
Review other host nodes that I didn't touch I see the following:
ulimit -a for root shows:
open files (-n) 1024
DockerHardeningCheck shows:
Additionally:
This key does NOT exist under Advanced /Troubleshooting:
Where is it pulling 1048576 from; where would this be set and whats the difference between that and my ulimit -a for root (there is no special config in /etc/security/limits.conf)
Any feedback is appreciated,
Boyd
03-03-2022 12:26 PM
Hi Jboyd,
This forum is best for implementation questions, not so much for server crashes, bugs, or other unexpected behaviors.
I would recommend that you open a support ticket a support.paloaltonetworks.com. Please attach your log bundle set to Debug level from the Settings>About>Troubleshooting page. There you will be met with the proper team to investigate this, along with an SLA for a response to your issue.
Thanks,
Lance
03-03-2022 12:30 PM
Thanks, I opened a support ticket as suggested.
Though, I referenced the error, I really just want to better understand how max open files / file descriptors setting is inherited by xsoar containers. More of an education question.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!