# Too many open files

**URL:** <https://discuss.elastic.co/t/too-many-open-files/1761>\
**Category:** Elasticsearch\
**Created:** [June 2, 2015, 5:08pm UTC](https://discuss.elastic.co/t/too-many-open-files/1761 "2015-06-02T17:08:21Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![erikhmeier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/erikhmeier/32/436_2.png) [@erikhmeier](https://discuss.elastic.co/u/erikhmeier)\
**Post date:** [June 2, 2015, 5:08pm UTC](https://discuss.elastic.co/t/too-many-open-files/1761/1 "2015-06-02T17:08:21Z")

</div>

We are running ElasticSearch 1.4.5 (CentOS 6/Java 7) and have run into an issue twice with too many open files on our staging cluster (limit set to 64k):

![](https://sea2.discourse-cdn.com/elastic/uploads/default/original/b/2/b276a937c6a903dd4fccb6eb3b70ec4e0ec9d3f8.png)

It seems to happen suddenly (nothing really busy on the cluster).

We are trying out Marvel and most of the open file handles seem to be for those indexes.

Restarting the cluster clears up the issue but it has now reappeared after a few days. Anyone else run into simliar issues?

---

<div class="post-metadata">

**Author:** ![otisg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/otisg/32/492_2.png) [@otisg](https://discuss.elastic.co/u/otisg)\
**Post date:** [June 2, 2015, 7:03pm UTC](https://discuss.elastic.co/t/too-many-open-files/1761/2 "2015-06-02T19:03:14Z")

</div>

Hi,

Running lsof will tell you which files are open. It's possible there are tons of Marvel-related indices/shards/segments/files, yes, but lsof will tell you exactly who has what open. If you are trying ES monitoring tools, have a look at SPM, it's got pretty nice ES monitoring/alerting/anomaly detection.

## Otis

Monitoring \* Alerting \* Anomaly Detection \* Centralized Log Management  
Solr & Elasticsearch Support \* [http://sematext.com/](http://sematext.com/)

---

<div class="post-metadata">

**Author:** ![erikhmeier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/erikhmeier/32/436_2.png) [@erikhmeier](https://discuss.elastic.co/u/erikhmeier)\
**Post date:** [June 2, 2015, 7:16pm UTC](https://discuss.elastic.co/t/too-many-open-files/1761/3 "2015-06-02T19:16:11Z")

</div>

Yeah, I am seeing lots of files like `/nodes/0/indices/.marvel-2015.05.27/0/translog/translog-1432684803614 (deleted)`

I'll try removing Marvel to see if that helps and try out some alternatives.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 12:10am UTC](https://discuss.elastic.co/t/too-many-open-files/1761/4 "2017-07-06T00:10:06Z")

</div>