What's the difference between setting open file limits in /etc/sysctl.conf vs /etc/security/limits.conf?

Question

I've read two separate ways of increasing the allowed open file count (I'm attempting to modify for root, if it matters).

One way is to update the settings in /etc/security/limits.conf with something like:

*                soft    nofile          500000

*                hard    nofile          500000

root             soft    nofile          500000

root             hard    nofile          500000

To make settings for the active shell, it looks like you can just do ulimit -n 500000, which wouldn't require a reboot or to logout/login, but may require restarting services (?).

---

The other option is to update /etc/sysctl.conf:

echo 'fs.file-max = 500000' >> /etc/sysctl.conf

To make settings for the active shell, we can do sysctl -p, and verify with sysctl fs.file-max.

So my question is, what's the difference? Is there one? I'm on Ubuntu 14.04.2 LTS

Answer 1

The difference is the scope, and how it's applied. Open file limits set via sysctls apply to the entire system, whereas limits set via /etc/security/limits.conf apply only to things that meet the criteria specified there. The other primary difference is that /etc/security/limits.conf limits are applied via ulimit, and thus can be changed more readily, while the sysctl limit is essentially setting up a memory allocation limit in the kernel itself.

As a general rule, you almost always want to use /etc/security/limits.conf, even if you're setting global limits with the wildcard match there, as it is a bit more reliable, and things usually fail more gracefully when hit with ulimit restrictions than hitting kernel memory allocation limits.