InfosecAtom 0 Posted June 30, 2021 Share Posted June 30, 2021 We recently upgraded to ESET PROTECT Server 8.1 on Linux and we are noticing the ERAServer process slowly grows to consume all available file descriptors, hitting the open file limit for the process. I believe that is what then leads to the trace.log showing these messages: Quote 2021-06-30 18:43:26 Error: NetworkModule [Thread 7f77f587c700]: remote_endpoint: Bad file descriptor Taking a look at the file descriptors they all appear to be held open sockets from various endpoints. Bumping the client connect interval from 5 minutes to 15 minutes temporarily alleviated the issue, but it then reappeared. We did not seem to have this same problem on EP 8.0. We have about 800 active clients at any given moment, running on a host with 4 2.2GHz Xeon cores and 8 GB memory, so I don't feel it should be overloading the server. I searched to see if there was any guidance that recommended raising file descriptor limits per file, but didn't seem to see anything. Any ideas how we might better troubleshoot what is leading to ERAServer saturating all the available file descriptors? Link to comment Share on other sites More sharing options...
ESET Moderators Peter Randziak 1,130 Posted July 2, 2021 ESET Moderators Share Posted July 2, 2021 Hello @InfosecAtom, rising the limit would be only a temporary solution, we should check for the root cause. Can you please provide me (via a private message with a reference to this topic) with: full logs set from the server the list of open file descriptors for ESMC VA by running the following command: # ls -l /proc/[eraserver pid]/fd DB export, if possible? What is the memory consumption of the EP service? Peter Link to comment Share on other sites More sharing options...
ESET Staff MartinK 378 Posted July 7, 2021 ESET Staff Share Posted July 7, 2021 ESET PROTECT and AGENT will be trying to use persistent connection, but in this case it seems that it fails, and each time AGENT is connecting to EP, it opens new connection + the old one remains at least partially open. Could you please check, whether network components in-between AGENT and EP are capable of holding open TCP connection for longer time, even without activity (i.e. 5 minute interval means such components should not drop connections with 5minute inactivity). Link to comment Share on other sites More sharing options...
ProblemosUno 0 Posted July 15, 2021 Share Posted July 15, 2021 I have the same problem Quote Error: NetworkModule [Thread 7f4fe6f6a700]: remote_endpoint: Bad file descriptor Do you have any solution? I will add that this problem did not occur in the previous version - it appeared immediately after the upgrade Link to comment Share on other sites More sharing options...
ESET Moderators Peter Randziak 1,130 Posted July 29, 2021 ESET Moderators Share Posted July 29, 2021 Hello @InfosecAtom and @ProblemosUno I would recommend to collect the logs and answer to the MartinK's question and open a support ticket with local ESET support in order to investigate it properly... Peter Link to comment Share on other sites More sharing options...
Recommended Posts