I have a server built with AWS OpsWOrks, so everything is in configuration. There is a process whose ulimit is set to 4096, as checked from /proc/$PID/limits. This process runs as root. I ran the ulimit command as root user which shows the file limit as 1024.

There are many servers (around 50) configured with the same cookbooks and all of them have the same configuration "drift". There is no knife ssh involved so couldn't have been someone running a one-liner on all instances. The codebase doesn't have a single line referencing the value if 4096, so I am stumped.

Is there any way I can determine how the process might have picked up the value of 4096?

  • I would grep -r ulimit /etc/init.d/ – binarym Oct 30 '19 at 9:36
  • Thanks for answering. Only /etc/init.d/lxd and /etc/init.d/docker have some value of ulimit, and its not 4096. Besides, the process in OP is not dockerized. – theTuxRacer Oct 30 '19 at 9:40
  • 1
    What are the processes which have the ulimit set to 4096 ? Cause it may be done directly by the process, using ulimit() or setrlimit() call in C. You can use objdump -T <binary>|grep -E '(ulimit|setrlimit)' to verify if the binary make use of ulimit()/setrlimit() . – binarym Oct 30 '19 at 10:17
  • Its a jre process, and is passed a jar file and a ldif config file. I ran the command and checked the config file, a negative in both places. – theTuxRacer Oct 31 '19 at 8:18

There are a crap load of ways this gets sets. This could be set by the application running... what is the process $PID? I am with @binarym you will need to do an object dump, or use truss/strace when the process kicks off. When it does you will seee the call to the ulimit() or setrlimit() functions if they are called.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.