Troubleshoot Errors When Syncing All Accounts - EoL - Multi-Tenant Guide - 6.11 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Multi-Tenant Guide

Product
Cortex XSOAR
Version
6.11
Creation date
2022-12-12
Last date published
2024-07-16
Category
End of Life > EoL
Multi-Tenant Guide
Abstract

Fix sync errors for large scale Cortex XSOAR multi-tenant environments by editing demisto.service file on host to limit the number of open files.

When trying to sync all accounts in a large scale environment, the sync fails. The log shows that there are too many open files and the sync fails to open any additional files.

To resolve this issue, update the limit of the number of files on the Cortex XSOAR service level as follows:

  1. Open the demisto.service file on each host. It is located at /etc/systemd/system/demisto.service.

  2. Under [Service], update the following parameters with a number large enough to avoid the error. if these parameters do not exist, add them.

    • LimitNOFILE

    • LimitNOFILESoft

    For example:

    [Unit]
    Description=Demisto Server Service
    After=network.target
    
    [Service]
    LimitNOFILE=100000000
    LimitNOFILESoft=100000000
    WorkingDirectory=/usr/local/demisto
    Type=simple
    User=demisto
    ExecStart=/usr/local/demisto/server
    EnvironmentFile=/etc/environment
    Restart=always
    RestartPreventExitStatus=29
    
    [Install]
    WantedBy=multi-user.target
    				
  3. Reload the daemon.

    systemctl daemon-reload

  4. Restart the service.

    systemctl restart demisto