#!/usr/bin/env bash # # JbTecWiz Support Centre -- generated fix script # # Fault : "bash: fork: retry: Resource temporarily unavailable" # Fix : Find the runaway and raise the right limit # Source: https://jbtecwiz.com/support/lnx-fork-resource # # Run as : Shell as root # Expect : 30 minutes # Risk : medium # Reversible : yes # # WHEN THIS IS THE RIGHT FIX # One account is affected. Keep any working root shell you have open -- # you may not get another. # # HOW TO UNDO IT # systemctl revert myapp.service; remove the limits.d file. # # Walks the fix one step at a time and asks before each. Steps with no # command are yours to do -- it prints those and waits. DRYRUN=1 prints # without executing; UNATTENDED=1 does not ask. # # -------------------------------------------------------------------- # NO WARRANTY - USE AT YOUR OWN RISK # # This script is provided by JbTecWiz as-is and with no warranty of any # kind, express or implied. You run it entirely at your own risk. # # JbTecWiz accepts no liability for any loss or damage arising from its # use, including but not limited to data loss, downtime, or configuration # changes that turn out to be wrong for your system. # # You are responsible for reading this script before running it, for # satisfying yourself that it suits the machine in front of you, and for # having a working backup first. Some steps cannot be undone. # -------------------------------------------------------------------- set -uo pipefail DRYRUN="${DRYRUN:-0}" UNATTENDED="${UNATTENDED:-0}" failed=0 if [ "$(id -u)" -ne 0 ]; then echo " This fix is documented as needing root. Re-run with sudo." >&2 exit 3 fi rule() { printf "\n%s\n" "$(printf '-%.0s' $(seq 1 70))"; if [ $# -gt 0 ]; then echo "$1"; fi; } prose() { echo "$1" | fold -s -w 74 | sed "s/^/ /"; } # Returns 0 when the caller should run the command, 1 when it should not. # A manual step always returns 1 -- there is nothing for the caller to run. step() { # step [command lines...] local n="$1" dotext="$2" why="$3" mode="$4"; shift 4 rule " Step $n of 6" prose "$dotext" if [ -n "$why" ]; then echo; prose "$why"; fi if [ "$mode" = "manual" ]; then echo; echo " -> Do this yourself, then press Enter to carry on." if [ "$UNATTENDED" = "0" ] && [ "$DRYRUN" = "0" ]; then read -r _; fi return 1 fi echo; printf " %s\n" "$@"; echo if [ "$DRYRUN" = "1" ]; then echo " (dry run -- not executed)"; return 1; fi if [ "$UNATTENDED" = "0" ]; then read -r -p " Run this step? [Y]es / [S]kip / [Q]uit " a case "$a" in [Qq]*) echo " Stopped at your request."; exit 0 ;; [Ss]*) echo " Skipped."; return 1 ;; esac fi return 0 } rule echo " "bash: fork: retry: Resource temporarily unavailable"" echo " Find the runaway and raise the right limit" echo echo " Risk: medium Reversible 30 minutes" echo prose 'No warranty. Use at your own risk - JbTecWiz accepts no liability. Read it before you run it, and have a backup.' rule echo if [ "$UNATTENDED" = "0" ] && [ "$DRYRUN" = "0" ]; then read -r -p " Ready? [y/N] " go case "$go" in [Yy]*) ;; *) echo " Nothing was changed."; exit 0;; esac fi if step 1 'Count processes per user. Use an existing shell; starting a pipeline may fail.' '' cmd 'ps -eo user= | sort | uniq -c | sort -rn | head'; then ps -eo user= | sort | uniq -c | sort -rn | head if [ $? -ne 0 ]; then failed=$((failed+1)) echo " Step 1 failed. The rest of the fix may depend on it." >&2 fi fi if step 2 'Look at the limits that apply to that user.' '' cmd 'sudo -u appuser bash -c '\''ulimit -u'\''' 'cat /proc/sys/kernel/threads-max'; then sudo -u appuser bash -c 'ulimit -u' cat /proc/sys/kernel/threads-max if [ $? -ne 0 ]; then failed=$((failed+1)) echo " Step 2 failed. The rest of the fix may depend on it." >&2 fi fi if step 3 'For a systemd service, the limit is TasksMax on the unit -- not limits.conf, which is why editing that appears to do nothing.' 'systemd applies a default TasksMax of 15% of pid_max to every unit. A service that forks per connection hits it long before any ulimit.' cmd 'systemctl show myapp.service -p TasksMax -p TasksCurrent'; then systemctl show myapp.service -p TasksMax -p TasksCurrent if [ $? -ne 0 ]; then failed=$((failed+1)) echo " Step 3 failed. The rest of the fix may depend on it." >&2 fi fi if step 4 'Raise it for that unit.' '' cmd 'sudo systemctl set-property myapp.service TasksMax=8192' 'sudo systemctl daemon-reload'; then sudo systemctl set-property myapp.service TasksMax=8192 sudo systemctl daemon-reload if [ $? -ne 0 ]; then failed=$((failed+1)) echo " Step 4 failed. The rest of the fix may depend on it." >&2 fi fi if step 5 'For an interactive user, raise nproc in the limits file.' '' cmd 'echo '\''appuser soft nproc 4096'\'' | sudo tee -a /etc/security/limits.d/90-nproc.conf' 'echo '\''appuser hard nproc 8192'\'' | sudo tee -a /etc/security/limits.d/90-nproc.conf'; then echo 'appuser soft nproc 4096' | sudo tee -a /etc/security/limits.d/90-nproc.conf echo 'appuser hard nproc 8192' | sudo tee -a /etc/security/limits.d/90-nproc.conf if [ $? -ne 0 ]; then failed=$((failed+1)) echo " Step 5 failed. The rest of the fix may depend on it." >&2 fi fi if step 6 'Then find why it needed so many. A limit raised without understanding the cause just moves the failure later.' '' cmd 'ps -eo pid,ppid,user,etime,cmd --sort=start_time | grep appuser | tail -30'; then ps -eo pid,ppid,user,etime,cmd --sort=start_time | grep appuser | tail -30 if [ $? -ne 0 ]; then failed=$((failed+1)) echo " Step 6 failed. The rest of the fix may depend on it." >&2 fi fi rule " Confirm it worked" prose 'The user can start processes and the count is stable.' if [ "$DRYRUN" = "0" ]; then systemctl show myapp.service -p TasksCurrent -p TasksMax fi rule if [ "$failed" -gt 0 ]; then echo " Finished with $failed failed step(s)." echo " Read the full write-up at https://jbtecwiz.com/support/lnx-fork-resource" else echo " Finished." fi echo prose 'To undo: systemctl revert myapp.service; remove the limits.d file.' rule