Splunk Search

On solaris 10 x86, 32 bit, Splunk 3.4.x crashes with "Too many open files", even though ulimit is set to a large value, what gives?

rementis
Explorer

Splunk server crashing with Too many open files error in splunkd_stderr.log

Tags (1)

oreoshake
Communicator

edit /etc/security/limits.conf

root    soft    nofile          250000
root    hard    nofile          250000

This will change the limit of open files, ulimit -n will show you the current setting

yannK
Splunk Employee
Splunk Employee

Depending of the system, you may have to change /etc/sysctl.conf and /etc/security/limits.conf
ulimit is not persistent after reboot.

http://splunk-base.splunk.com/answers/13313/how-to-tune-ulimit-on-my-server

0 Karma

rementis
Explorer

Switch to csh:

csh

Then issue this command:

% setenv LD_PRELOAD_32 /usr/lib/extendedFILE.so.1

This solution is for Solaris 10 x86.

See this page:

Workaround to stdio_s

jrodman
Splunk Employee
Splunk Employee

Do you have this problem on forwarders? I wouldn't expect so. You really should run your indexers on 64bit for performance reasons, avoiding the need for this workaround. However, it's a nice tip, thanks for sharing!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...