000017510 - 'Too Many Files Open' error after appliance upgrade from RSA Security Analytics 10.2.x to 10.3

Document created by RSA Customer Support Employee on Jun 14, 2016•Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000017510
Applies ToRSA Security Analytics
RSA Security Analytics Decoder
RSA Security Analytics Concentrator
RSA Security Analytics Hybrid
IssueConcentrator logs show "Too many files open" errors.
Concentrator unable to consume from decoder.
Resolution

To resolve the issue, perform one of the workarounds below.


Workaround #1:

  1. Issue the following command:  vi /etc/init/nwconcentrator.conf
  2. Add the following two lines in the configuration file, ensuring that they are in the same order:
         limit core unlimited unlimited
      limit nofile 100000 100000
  3. Issue the following command:  initctl stop nwconcentrator && initctl start nwconcentrator

 

Workaround #2:

  1. Remove the decoder as an aggregation source for the concentrator in the Security Analytics UI.
  2. Re-add the deocder as an aggregation source for the concentrator.

 

If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article ID for further assistance.

WorkaroundThe appliance was upgraded from RSA Security Analytics 10.2.x to 10.3.
Legacy Article IDa64248

Attachments

    Outcomes