[avahi] accept(): Too many open files

[Aldrin Martoq]

On Tue, 2008-03-25 at 15:57 +0100, Lennart Poettering wrote:
> On Thu, 20.03.08 22:56, Mark Edwards (mark at antsclimbtree.com) wrote:
> > > Histroic versions of Avahi didn't close all open fds on startup. So it
> > > maybe some program is leaking fds when starting Avahi? I remember some
> > > initng users having a problem like that with initng leaking fds like
> > > stupid or something like it.
> > I don't see a huge amount of files in /proc/$(pidof avahi-daemon)/fd/
> > I get a list like this:
> > lr-x------ 1 root root 64 2008-03-20 22:49 0 -> /dev/null
> > l-wx------ 1 root root 64 2008-03-20 22:49 1 -> /dev/null
> > l-wx------ 1 root root 64 2008-03-20 22:49 10 -> pipe:[1192423]
> > lrwx------ 1 root root 64 2008-03-20 22:49 11 -> socket:[1192424]
> > lrwx------ 1 root root 64 2008-03-20 22:49 12 -> socket:[1192426]
> > lrwx------ 1 root root 64 2008-03-20 22:49 13 -> socket:[1192428]
> > lrwx------ 1 root root 64 2008-03-20 22:49 14 -> socket:[1192429]
> > lrwx------ 1 root root 64 2008-03-20 22:49 15 -> socket:[1192430]
> > l-wx------ 1 root root 64 2008-03-20 22:49 2 -> /dev/null
> > lrwx------ 1 root root 64 2008-03-20 22:49 5 -> socket:[1192418]
> > lrwx------ 1 root root 64 2008-03-20 22:49 6 -> socket:[1192420]
> > lr-x------ 1 root root 64 2008-03-20 22:49 7 -> pipe:[1192422]
> > l-wx------ 1 root root 64 2008-03-20 22:49 8 -> pipe:[1192422]
> > lr-x------ 1 root root 64 2008-03-20 22:49 9 -> pipe:[1192423]
> > I'm kind of at a loss as to what I'm looking for here.  Again, this  
> > is only happening at 4:00am each day, and the only thing I can see  
> > happening in particular at that point is a bunch of cron jobs  
> > occurring at the same time.

I suggest the following:
1) Replicate the error on day, no need to wait 4.00 am! Just run the
scripts from /etc/cron.daily/ (check /etc/crontab for exact time and
check what runs in /etc/cron.d). I'm assuming the crontab is immutable
(it does not matter if you run the crontabs afterhours).

2) Run strace and lsof to see what really is going on... Example bash
code:

# lsof -np $(pidof avahi-daemon | sed 's/ /,/')
# strace -s1024 -fo /tmp/strace -p $(pidof avahi-daemon | sed 's/ /
-p /g')

You may put that in a crontab right before 4.00 am; or run it while you
follow my suggestion 1).


Put the files here, the important lines should be something like these
(right before the "accept(): too many open files" message):


5292  read(3, "RESOLVE-HOSTNAME-IPV4 amartoq.local\n", 20480) = 36


> Hmm, maybe a couple of other daemons try to connect to Avahi at the
> same time, and Avahi is configured to have only 30 fds around at the
> same time? Does any of the other daemons running that might access
> Avahi (cups, apache, ...) report a failure when contacting Avahi?

Anyhow, this sound like a possible denial of service attack... don't you
think?


HTH,

-- 
Aldrin Martoq <amartoq at dcc.uchile.cl>
NUEVO: Episodio 002 (Lunes 24 Marzo)!!
http://aldrinvideopodcast.podshow.com/