topic Re: On solaris 10 x86, 32 bit, Splunk 3.4.x crashes with "Too many open files", even though ulimit is set to a large value, what gives? in Splunk Search

On solaris 10 x86, 32 bit, Splunk 3.4.x crashes with "Too many open files", even though ulimit is set to a large value, what gives?

rementis — Sat, 10 Apr 2010 23:53:58 GMT

Splunk server crashing with Too many open files error in splunkd_stderr.log

Re: On solaris 10 x86, 32 bit, Splunk 3.4.x crashes with "Too many open files", even though ulimit is set to a large value, what gives?

rementis — Sat, 10 Apr 2010 23:55:38 GMT

Switch to csh:

csh

Then issue this command:

% setenv LD_PRELOAD_32 /usr/lib/extendedFILE.so.1

This solution is for Solaris 10 x86.

See this page:

Workaround to stdio_s

Re: On solaris 10 x86, 32 bit, Splunk 3.4.x crashes with "Too many open files", even though ulimit is set to a large value, what gives?

oreoshake — Tue, 13 Apr 2010 07:25:55 GMT

edit /etc/security/limits.conf

root    soft    nofile          250000
root    hard    nofile          250000

This will change the limit of open files, ulimit -n will show you the current setting

Re: On solaris 10 x86, 32 bit, Splunk 3.4.x crashes with "Too many open files", even though ulimit is set to a large value, what gives?

jrodman — Sat, 17 Apr 2010 08:26:34 GMT

Do you have this problem on forwarders? I wouldn't expect so. You really should run your indexers on 64bit for performance reasons, avoiding the need for this workaround. However, it's a nice tip, thanks for sharing!

Re: On solaris 10 x86, 32 bit, Splunk 3.4.x crashes with "Too many open files", even though ulimit is set to a large value, what gives?

yannK — Fri, 30 Mar 2012 19:10:36 GMT

Depending of the system, you may have to change /etc/sysctl.conf and /etc/security/limits.conf
ulimit is not persistent after reboot.

http://splunk-base.splunk.com/answers/13313/how-to-tune-ulimit-on-my-server