On Tue, 2008-03-25 at 15:57 +0100, Lennart Poettering wrote: > On Thu, 20.03.08 22:56, Mark Edwards ([EMAIL PROTECTED]) wrote: > > > Histroic versions of Avahi didn't close all open fds on startup. So it > > > maybe some program is leaking fds when starting Avahi? I remember some > > > initng users having a problem like that with initng leaking fds like > > > stupid or something like it. > > I don't see a huge amount of files in /proc/$(pidof avahi-daemon)/fd/ > > I get a list like this: > > lr-x------ 1 root root 64 2008-03-20 22:49 0 -> /dev/null > > l-wx------ 1 root root 64 2008-03-20 22:49 1 -> /dev/null > > l-wx------ 1 root root 64 2008-03-20 22:49 10 -> pipe:[1192423] > > lrwx------ 1 root root 64 2008-03-20 22:49 11 -> socket:[1192424] > > lrwx------ 1 root root 64 2008-03-20 22:49 12 -> socket:[1192426] > > lrwx------ 1 root root 64 2008-03-20 22:49 13 -> socket:[1192428] > > lrwx------ 1 root root 64 2008-03-20 22:49 14 -> socket:[1192429] > > lrwx------ 1 root root 64 2008-03-20 22:49 15 -> socket:[1192430] > > l-wx------ 1 root root 64 2008-03-20 22:49 2 -> /dev/null > > lrwx------ 1 root root 64 2008-03-20 22:49 5 -> socket:[1192418] > > lrwx------ 1 root root 64 2008-03-20 22:49 6 -> socket:[1192420] > > lr-x------ 1 root root 64 2008-03-20 22:49 7 -> pipe:[1192422] > > l-wx------ 1 root root 64 2008-03-20 22:49 8 -> pipe:[1192422] > > lr-x------ 1 root root 64 2008-03-20 22:49 9 -> pipe:[1192423] > > I'm kind of at a loss as to what I'm looking for here. Again, this > > is only happening at 4:00am each day, and the only thing I can see > > happening in particular at that point is a bunch of cron jobs > > occurring at the same time.
I suggest the following: 1) Replicate the error on day, no need to wait 4.00 am! Just run the scripts from /etc/cron.daily/ (check /etc/crontab for exact time and check what runs in /etc/cron.d). I'm assuming the crontab is immutable (it does not matter if you run the crontabs afterhours). 2) Run strace and lsof to see what really is going on... Example bash code: # lsof -np $(pidof avahi-daemon | sed 's/ /,/') # strace -s1024 -fo /tmp/strace -p $(pidof avahi-daemon | sed 's/ / -p /g') You may put that in a crontab right before 4.00 am; or run it while you follow my suggestion 1). Put the files here, the important lines should be something like these (right before the "accept(): too many open files" message): 5292 read(3, "RESOLVE-HOSTNAME-IPV4 amartoq.local\n", 20480) = 36 > Hmm, maybe a couple of other daemons try to connect to Avahi at the > same time, and Avahi is configured to have only 30 fds around at the > same time? Does any of the other daemons running that might access > Avahi (cups, apache, ...) report a failure when contacting Avahi? Anyhow, this sound like a possible denial of service attack... don't you think? HTH, -- Aldrin Martoq <[EMAIL PROTECTED]> NUEVO: Episodio 002 (Lunes 24 Marzo)!! http://aldrinvideopodcast.podshow.com/ _______________________________________________ avahi mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/avahi
