BETA6 kern.maxfiles messages

From: freebsd <freebsd_at_paymentonline.net>
Date: Tue, 5 Oct 2004 23:04:08 -0700
I'm suspicious someone was trying to probe or dos this server, but if there 
is some other possible explanation, and since I have only seen this on a 5.3 
BETA box I thought I would post it here.  It looks to me like someone was 
trying to do a small dos attack perhaps?

Today I had these messages in dmesg.today:

kern.maxfiles limit exceeded by uid 70, please see tuning(7).
kern.maxfiles limit exceeded by uid 88, please see tuning(7).
......................

The offending processes are:
# ps 88
  PID  TT  STAT      TIME COMMAND
   88  ??  IL     0:00.00 [nfsiod 3]
# ps 70
  PID  TT  STAT      TIME COMMAND
   70  ??  WL     0:08.60 [swi3: cambio]

This is what kern.maxfiles looks like under normal operation.  This server 
doesn't vary that much in traffic and these numbers shouldn't go up or down 
too much.  I have apache/mod_perl and postgresql running and that is about 
it.  Maybe a little bit of variation in maxfiles is normal, but I can't 
think of what would open up almost 12,000 extra files.

# sysctl kern.maxfiles
kern.maxfiles: 12328
# sysctl kern.openfiles
kern.openfiles: 492
Received on Wed Oct 06 2004 - 04:03:39 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:38:15 UTC