I am trying to set the max open files on CentOS 7 for elasticsearch. I've read over and over again how to set this but it doesn't seem to be working. As I understand it:

  • limits.conf is irrelevant because elasticsearch user is set to /sbin/nologin and we're starting the daemon with system
  • I need to set LimitNOFILE=65535 in the systemd unit file.

So, I went ahead and did that, here's my unit file, it's provided by the elasticsearch puppet module:

Description=Starts and stops a single elasticsearch instance on this system

ExecStart=/usr/share/elasticsearch/bin/elasticsearch -d -p /var/run/elasticsearch/elasticsearch-graylog2.pid -Des.default.path.home=${ES_HOME} -Des.default.path.logs=${LOG_DIR} -Des.default.path.data=${DATA_DIR} -Des.default.path.work=${WORK_DIR} -Des.default.path.conf=${CONF_DIR}
# See MAX_OPEN_FILES in sysconfig
# See MAX_LOCKED_MEMORY in sysconfig, use "infinity" when MAX_LOCKED_MEMORY=unlimited and using bootstrap.mlockall: true

# Shutdown delay in seconds, before process is tried to be killed with KILL (if configured)


Note how limitNOFILE is set here. I have also set MAX_OPEN_FILES in my EnvironmentFile:


However, elasticsearch still reports that the max open files are 4096, both from within the app itself, and from with /proc/<pid>/limits

Does anyone know what I'm doing wrong here? I even tried setting this from within limits.conf but as I expected, no luck.

  • This smells like the work SELinux to me... – GregL Jan 5 '16 at 18:07
  • SELinux is disabled, first thing I checked. sestatus SELinux status: disabled – jaxxstorm Jan 5 '16 at 18:14
  • I have exact the same configs as you and it works fine on mine.. Sorry I can't be much help – GregL Jan 5 '16 at 18:18

I did this:

# Default limit for number of open files for elastic user
elastic hard nofile 65536

And included this in systemd like you did


seems to work fine

| improve this answer | |

User cannot be set to /sbin/nologin, this is the path to its shell. So you need to tune your limits.conf

| improve this answer | |
  • That's what I meant, the elasticsearch user has shell /sbin/nologin – jaxxstorm Jan 5 '16 at 18:14
  • Type of shell doesn't matter. Anyway you can try the following 1. Find out under which user elasticsearch is running. 2. In user's .bash_profile add 'ulimit -n unlimited' 3. If it works reduce 'unlimited' to reasonable value. – user1700494 Jan 5 '16 at 18:21
  • 1
    That didn't help, as I expected, because .bash_profile is only executed by a login shell – jaxxstorm Jan 5 '16 at 18:31
  • try to add in .bashrc as well – user1700494 Jan 5 '16 at 18:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.