On solaris 10 x86, 32 bit, Splunk 3.4.x crashes with "Too many open files", even though ulimit is set to a large value, what gives?

[rementis]

Splunk server crashing with Too many open files error in splunkd_stderr.log

[oreoshake]

edit /etc/security/limits.conf

root    soft    nofile          250000
root    hard    nofile          250000

This will change the limit of open files, ulimit -n will show you the current setting

[yannK]

Depending of the system, you may have to change /etc/sysctl.conf and /etc/security/limits.conf
ulimit is not persistent after reboot.

http://splunk-base.splunk.com/answers/13313/how-to-tune-ulimit-on-my-server

[rementis]

Switch to csh:

csh

Then issue this command:

% setenv LD_PRELOAD_32 /usr/lib/extendedFILE.so.1

This solution is for Solaris 10 x86.

See this page:

Workaround to stdio_s

[jrodman]

Do you have this problem on forwarders? I wouldn't expect so. You really should run your indexers on 64bit for performance reasons, avoiding the need for this workaround. However, it's a nice tip, thanks for sharing!