Date: Tue, 5 Oct 2004 23:04:08 -0700 From: "freebsd" <freebsd@paymentonline.net> To: <freebsd-current@freebsd.org> Subject: BETA6 kern.maxfiles messages Message-ID: <044d01c4ab6a$4b1f44c0$0500a8c0@home> References: <20041006041104.GK15774@atlantis.ccs.neu.edu>
next in thread | previous in thread | raw e-mail | index | archive | help
I'm suspicious someone was trying to probe or dos this server, but if there is some other possible explanation, and since I have only seen this on a 5.3 BETA box I thought I would post it here. It looks to me like someone was trying to do a small dos attack perhaps? Today I had these messages in dmesg.today: kern.maxfiles limit exceeded by uid 70, please see tuning(7). kern.maxfiles limit exceeded by uid 88, please see tuning(7). ...................... The offending processes are: # ps 88 PID TT STAT TIME COMMAND 88 ?? IL 0:00.00 [nfsiod 3] # ps 70 PID TT STAT TIME COMMAND 70 ?? WL 0:08.60 [swi3: cambio] This is what kern.maxfiles looks like under normal operation. This server doesn't vary that much in traffic and these numbers shouldn't go up or down too much. I have apache/mod_perl and postgresql running and that is about it. Maybe a little bit of variation in maxfiles is normal, but I can't think of what would open up almost 12,000 extra files. # sysctl kern.maxfiles kern.maxfiles: 12328 # sysctl kern.openfiles kern.openfiles: 492
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?044d01c4ab6a$4b1f44c0$0500a8c0>