Troubleshoot Errors When Syncing All Accounts - Multi-Tenant Guide - EoL - 6.11 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Multi-Tenant Guide
Product
Cortex XSOAR
Version
6.11
Creation date
2022-12-12
Last date published
2024-07-16
Category
Multi-Tenant Guide
End of Life > EoL
Abstract

Fix sync errors for large scale Cortex XSOAR multi-tenant environments by editing demisto.service file on host to limit the number of open files.

When trying to sync all accounts in a large scale environment, the sync fails. The log shows that there are too many open files and the sync fails to open any additional files.

To resolve this issue, update the limit of the number of files on the Cortex XSOAR service level as follows:

  1. Open the demisto.service file on each host. It is located at /etc/systemd/system/demisto.service.

  2. Under [Service], update the following parameters with a number large enough to avoid the error. if these parameters do not exist, add them.

    • LimitNOFILE

    • LimitNOFILESoft

    For example:

    [Unit]
Description=Demisto Server Service
After=network.target

[Service]
LimitNOFILE=100000000
LimitNOFILESoft=100000000
WorkingDirectory=/usr/local/demisto
Type=simple
User=demisto
ExecStart=/usr/local/demisto/server
EnvironmentFile=/etc/environment
Restart=always
RestartPreventExitStatus=29

[Install]
WantedBy=multi-user.target

  3. Reload the daemon.

    systemctl daemon-reload

  4. Restart the service.

    systemctl restart demisto