Centos 7 中的ulimit -n 65535 对进程的文件句柄限制不生效？？

我会带着你远行 2023-07-18 11:18 9阅读 0赞

# Centos 7 中的ulimit -n 65535 对进程的文件句柄限制不生效？？ #

转载自 https://www.cnblogs.com/linuxk/p/11989559.html

今日闲来无事，就看群里大佬吹牛逼了，偶然一条技术疑问提出来了，神奇啊，作为广大老司机技术交流群体竟然还有这么深入的研究？

大佬问：这个文件句柄限制怎么设置了/etc/security/limits.conf对进程都无效呢？如图  
![img][]  
![img][img 1]

刚好看到了这方面的知识点，在修改/etc/security/limits.conf以及使用ulimit -n命令进行修改文件句柄数量时，是需要重新进入终端方可生效的，于是饶有兴趣地告诉大佬：重开终端吧！

大佬又回了一句：我服务器都重启了一遍了，就是不生效！！！

疑问来了，这是为什么呢？？？？？于是，自我实践验证修改，哎哟…还真不生效。如下一顿操作猛如虎：

[root@jenkins ~]# ulimit -a
    core file size          (blocks, -c) 0
    data seg size           (kbytes, -d) unlimited
    scheduling priority             (-e) 0
    file size               (blocks, -f) unlimited
    pending signals                 (-i) 3851
    max locked memory       (kbytes, -l) 64
    max memory size         (kbytes, -m) unlimited
    open files                      (-n) 1024
    pipe size            (512 bytes, -p) 8
    POSIX message queues     (bytes, -q) 819200
    real-time priority              (-r) 0
    stack size              (kbytes, -s) 8192
    cpu time               (seconds, -t) unlimited
    max user processes              (-u) 3851
    virtual memory          (kbytes, -v) unlimited
    file locks                      (-x) unlimited
    [root@jenkins ~]# vim /etc/security/limits.conf 
    [root@jenkins ~]# ulimit -n 65535
    [root@jenkins ~]# ulimit -a
    core file size          (blocks, -c) 0
    data seg size           (kbytes, -d) unlimited
    scheduling priority             (-e) 0
    file size               (blocks, -f) unlimited
    pending signals                 (-i) 3851
    max locked memory       (kbytes, -l) 64
    max memory size         (kbytes, -m) unlimited
    open files                      (-n) 65535
    pipe size            (512 bytes, -p) 8
    POSIX message queues     (bytes, -q) 819200
    real-time priority              (-r) 0
    stack size              (kbytes, -s) 8192
    cpu time               (seconds, -t) unlimited
    max user processes              (-u) 3851
    virtual memory          (kbytes, -v) unlimited
    file locks                      (-x) unlimited
    [root@jenkins ~]# exit
    logout
    
    # 再找个进程看一看，瞧一瞧，瞄一瞄
    
    [root@jenkins ~]# more /proc/973/limits 
    Limit                     Soft Limit           Hard Limit           Units     
    Max cpu time              unlimited            unlimited            seconds   
    Max file size             unlimited            unlimited            bytes     
    Max data size             unlimited            unlimited            bytes     
    Max stack size            8388608              unlimited            bytes     
    Max core file size        0                    unlimited            bytes     
    Max resident set          unlimited            unlimited            bytes     
    Max processes             3851                 3851                 processes 
    Max open files            1024                 4096                 files                 #哎哟，还真不生效喔！
    Max locked memory         65536                65536                bytes     
    Max address space         unlimited            unlimited            bytes     
    Max file locks            unlimited            unlimited            locks     
    Max pending signals       3851                 3851                 signals   
    Max msgqueue size         819200               819200               bytes     
    Max nice priority         0                    0                    
    Max realtime priority     0                    0                    
    Max realtime timeout      unlimited            unlimited            us

然后，继续百度，谷歌查找资料，据说还要修改/etc/security/limits.d/20-nproc.conf，/etc/security/limits.conf限制实际取决于 /etc/security/limits.d/20-nproc.conf的配置，也就是说哪怕/etc/security/limits.conf设置最大打开数是65535，而/etc/security/limits.d/20-nproc.conf里配的是4096，那最终结果还是用户最大只能打开4096个文件句柄，于是赶紧看了下/etc/security/limits.d/20-nproc.conf配置，果然是4096，满心欢喜喔，兴奋喔，又是一顿操作：

[root@jenkins ~]# cat /etc/security/limits.d/20-nproc.conf
    # Default limit for number of user's processes to prevent
    # accidental fork bombs.
    # See rhbz #432903 for reasoning.
    
    *          soft    nproc     4096
    root       soft    nproc     unlimited
    
    [root@jenkins ~]# vim /etc/security/limits.d/20-nproc.conf
    # Default limit for number of user's processes to prevent
    # accidental fork bombs.
    # See rhbz #432903 for reasoning.
    
    *          soft    nproc     65535
    root       soft    nproc     unlimited
    
    [root@jenkins ~]# more /proc/973/limits 
    Limit                     Soft Limit           Hard Limit           Units     
    ......
    Max open files            1024                 4096                 files     
    ......

然并卵…被骗了，没法相信百度出来的结果了，但是还是需要继续百度…最后有一个好的发现，说这个限制是在进程里面限制的，于是找了个httpd.service的启动脚本进程进行修改，如下：

[root@jenkins ~]# vim /usr/lib/systemd/system/httpd.service
    ......
    
    [Service]
    LimitNOFILE=20000
    [root@jenkins ~]# systemctl daemon-reload
    [root@jenkins ~]# systemctl restart httpd
    [root@jenkins ~]# ps -ef |grep httpd
    root     13069     1 36 14:36 ?        00:00:02 /usr/sbin/httpd -DFOREGROUND
    ...
    [root@jenkins ~]# more /proc/13069/limits 
    Limit                     Soft Limit           Hard Limit           Units     
    ...
    Max open files            20000                20000                files

哇喔…真的可以喔！！！但是要是我有100个进程，总不能修改100次吧，系统没这么傻逼吧，于是想到Centos7 系统是采用Systemd进行管理服务的，是否会和这个有所关系呢？

功夫不负有心人，经过层层百度得知：

在C7系统，进程改用了systemd代替之前SysV进行服务管理，原先的/etc/security/limits.conf文件配置的作用域缩小，只适用于通过PAM认证登录用户的资源显示，对systemd的service资源限制不生效的。在C7里面，要进行全局的配置进程打开文件数量，需要修改/etc/systemd/system.conf 和 /etc/systemd/user.conf 这两个，当然，如果只是进程修改system.conf即可，里面有两个默认值调整一下：

[root@jenkins ~]# vim /etc/systemd/system.conf
    DefaultLimitNOFILE=65535
    DefaultLimitNPROC=65535
    
    [root@jenkins ~]# more /proc/975/limits 
    Limit                     Soft Limit           Hard Limit           Units     
    Max cpu time              unlimited            unlimited            seconds   
    Max file size             unlimited            unlimited            bytes     
    Max data size             unlimited            unlimited            bytes     
    Max stack size            8388608              unlimited            bytes     
    Max core file size        0                    unlimited            bytes     
    Max resident set          unlimited            unlimited            bytes     
    Max processes             65535                65535                processes   
    Max open files            65535                65535                files         #出现了！！！！！
    Max locked memory         65536                65536                bytes     
    Max address space         unlimited            unlimited            bytes     
    Max file locks            unlimited            unlimited            locks     
    Max pending signals       3851                 3851                 signals   
    Max msgqueue size         819200               819200               bytes     
    Max nice priority         0                    0                    
    Max realtime priority     0                    0                    
    Max realtime timeout      unlimited            unlimited            us

原来如此！！！排查的过程是有趣的…学习更是美好的…

[img]: /images/20230528/2429e04701d643f39375e1cf6268ec72.png
[img 1]: /images/20230528/3893199c790244c2a137b1932bd4ac65.png