search

honeynet / beeswarm

Honeypot deployment made easy
GNU General Public License v3.0
237 stars 64 forks source link

Too many open files - ZMQerror #230

Closed xraysmile closed 7 years ago

xraysmile commented 7 years ago

Hi,

I get this error - see screeshot ->

beeswarm_to_many_open_files

when im using the client bait. It occours after 2-3 days run time.

Any idea to handle this except for restarting every 24 hour?

Best regards

johnnykv commented 7 years ago

This does not seem to be a ZeroMQ problem, but rather a problem in one (or more) of the beeswarm capabilities. I will take a look at it, when I get time.

johnnykv commented 7 years ago

@xraysmile are you seeing this on a honeypot or client drone?

czardoz commented 7 years ago

Going by the traceback, seems to be the honeypot. A quick workaround would be to increase the limit of number of open files: http://unix.stackexchange.com/questions/8945/how-can-i-increase-open-files-limit-for-all-processes

If @xraysmile keeps running into this issue (even after increasing the open file limit), there's a good chance we're leaking open connections somewhere, @johnnykv

johnnykv commented 7 years ago

@czardoz yeah, think i might have found the leak... Trying to figure if occurs in all modes... Tricky debugging :-)

xraysmile commented 7 years ago

I see it both on the client and honeypot

johnnykv commented 7 years ago

fixed as of 7dd8fe1