Splunk Search

On solaris 10 x86, 32 bit, Splunk 3.4.x crashes with "Too many open files", even though ulimit is set to a large value, what gives?

rementis
Explorer

Splunk server crashing with Too many open files error in splunkd_stderr.log

Tags (1)

oreoshake
Communicator

edit /etc/security/limits.conf

root    soft    nofile          250000
root    hard    nofile          250000

This will change the limit of open files, ulimit -n will show you the current setting

yannK
Splunk Employee
Splunk Employee

Depending of the system, you may have to change /etc/sysctl.conf and /etc/security/limits.conf
ulimit is not persistent after reboot.

http://splunk-base.splunk.com/answers/13313/how-to-tune-ulimit-on-my-server

0 Karma

rementis
Explorer

Switch to csh:

csh

Then issue this command:

% setenv LD_PRELOAD_32 /usr/lib/extendedFILE.so.1

This solution is for Solaris 10 x86.

See this page:

Workaround to stdio_s

jrodman
Splunk Employee
Splunk Employee

Do you have this problem on forwarders? I wouldn't expect so. You really should run your indexers on 64bit for performance reasons, avoiding the need for this workaround. However, it's a nice tip, thanks for sharing!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!