On solaris 10 x86, 32 bit, Splunk 3.4.x crashes with "Too many open files", even though ulimit is set to a large value, what gives?

Question

Splunk server crashing with Too many open files error in splunkd_stderr.log

Answer 1

1

Switch to csh:

csh

Then issue this command:

% setenv LD_PRELOAD_32 /usr/lib/extendedFILE.so.1

This solution is for Solaris 10 x86.

See this page:

Workaround to stdio_s

link

answered 10 Apr '10, 16:55

rementis
21●2
accept rate: 0%

Do you have this problem on forwarders? I wouldn't expect so. You really should run your indexers on 64bit for performance reasons, avoiding the need for this workaround. However, it's a nice tip, thanks for sharing!

(17 Apr '10, 01:26) jrodman ♦

Answer 2

1

edit /etc/security/limits.conf

root    soft    nofile          250000
root    hard    nofile          250000

This will change the limit of open files, ulimit -n will show you the current setting

link

answered 13 Apr '10, 00:25

oreoshake
570●2●3●26
accept rate: 31%

Depending of the system, you may have to change /etc/sysctl.conf and /etc/security/limits.conf ulimit is not persistent after reboot.

http://splunk-base.splunk.com/answers/13313/how-to-tune-ulimit-on-my-server

(30 Mar '12, 12:10) yannK

On solaris 10 x86, 32 bit, Splunk 3.4.x crashes with "Too many open files", even though ulimit is set to a large value, what gives?

Follow this question

Splunk Resources

Related questions