Fluent-bit version 1.9.6 [ Error] timerfd: Too many open files, errno=24 at /__w/1/s/external/fluent-bit/lib/monkey/mk_core/mk_event_epoll.c:208

[NarineM]

Bug Report

Describe the bug
fluent-bit fails with these errors randomly. In result tail plugin that monitors log files on the machine does not work.

• Example log message if applicable:

Apr 28 01:00:55 [2633351]: [log] error opening log file /var/opt/testapp/log/fluentbit.log. Using stderr.
Apr 28 01:00:55 [2633351]: [2024/04/28 01:00:55] [  Error] timerfd: Too many open files, errno=24 at /__w/1/s/external/fluent-bit/lib/monkey/mk_core/mk_event_epoll.c:208
Apr 28 01:00:55 [2633351]: [2024/04/28 01:00:55] [error] [input collector] COLLECT_TIME registration failed
Apr 28 01:00:55 [2633351]: [log] error opening log file /var/opt/testapp/log/fluentbit.log. Using stderr.
Apr 28 01:00:55 [2633351]: [2024/04/28 01:00:55] [error] [input collector] COLLECT_TIME registration failed
Apr 28 01:00:55 j[2633351]: [2024/04/28 01:00:55] [  Error] timerfd: Too many open files, errno=24 at /__w/1/s/external/fluent-bit/lib/monkey/mk_core/mk_event_epoll.c:208
Apr 28 01:00:55 [2633351]: [log] error opening log file /var/opt/testapp/log/fluentbit.log. Using stderr.

• Steps to reproduce the problem:
  In my configuration fluent config has about 70 tail plugin configurations with each config monitoring one log file.
  Fluent-bit version 1.9.6

Expected behavior
no error , tail working as expected

• Version used: 1.9.6
• Configuration:
• Environment name and version (e.g. Kubernetes? What version?):
• Server type and version:
• Operating System and version: Ubuntu 22.04
• Filters and plugins: tail

Additional context
Need some workaround as in this setup fluent does not collect any logs.

[agup006]

Hi @NarineM could you check with the latest fluent bit? 1.9.x is no longer maintained

[NarineM]

@agup006 thanks for your response. What major version you recommend as known stable version ? Is this issue known to be fixed in versions 3? or starting 2.* ? newer version of fluent have been reported with cve: [A memory corruption vulnerability in Fluent Bit versions... · CVE-2024-4323 ·, see here: https://github.com/advisories/GHSA-68mr-468g-4wmg
Given this, do you know what version of fluent is not impacted by CVE but this issue with too many open files is fixed or not longer seen?

[NarineM]

Similar to #1777