6

Is there a log file that logs information when the values set in /etc/security/limits.conf are exceeded?

If not is there a way to make it log when the values are exceeded?

Improve this question

3 Answers 3

Reset to default
3

There is no central log for every process that hits these limits.

Whenever a process tries to allocate resources which exceed it's limit, it receives a negative return code from the OS, so each process can handle this case in it's own way. Most processes will write something into their specific log if they hit one of the limits, but you'll have to check that for each process specifically.

Improve this answer
1
  • 2
    Processes may also end up being killed. Note that you can log syscalls that fail with a given errno with the audit system, so you can use it for some limits that cause syscalls to fail with a specific errno.
    – Stéphane Chazelas
    Sep 2, 2013 at 8:18
3

As per man limit page

The pam_limits module does report configuration problems found in its configuration file and errors via syslog(3).

So you need to define as below 

pam_limits.so [ conf=/path/to/limits.conf ] [ debug ] [ set_all ] [ utmp_early ] [ noaudit ]

Example of my /etc/pam.d/su

session    required   pam_limits.so conf=/etc/security/limits.conf

Reference Link pam_limits - limit resources man page limits.conf

Improve this answer
2
  • That doesn't answer the question though.
    – Stéphane Chazelas
    Sep 2, 2013 at 9:36
  • 1
    yes sir, I have also configure the same and tested with open file limit 50, but it doesn't shows anything in logs
    – Rahul Patil
    Sep 2, 2013 at 9:56
3

I have been able to achieve partial solution using audit subsystem. The idea is to track the failed system calls.

You may refer [1] to track the work I have done in this field.

[1] https://github.com/PaulDaviesC/Logging-limits.conf

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .