Page MenuHomePhabricator

Junos file descriptors exhaustion
Closed, ResolvedPublic

Description

Symptoms

  • issues collecting interface data through gNMI or SNMP
  • TVP_PROC_STAT_FILE_OPEN_ERR: Error opening /proc/stat file in the logs
  • RANCID intermittently showing +# error: timeout waiting for response from localre instead of the show version (and others) command output
  • Presence of core dumps for agentd
  • show interfaces hangs

Root cause

From JTAC case 2026-0728-823648 the issue is tracked in PR1957004:

The fxpc process on a host os does not properly close file descriptors, leading to file descriptor exhaustion when the system is under ddos pressure. Once the maximum limit is reached, TVP_PROC_STAT_FILE_OPEN_ERR: Error opening /proc/stat file is seen repeatedly, causing a spike in CPU usage.
This file descriptor is tied to BRCM_PKT file logging.

Fix

  • What's the target release for the fix?

junos:24.2R2-S6 junos:24.2R2-S7 junos:25.2R2-S2 junos:25.4R2 junos:25.4R2-S1 junos:26.2R2 junos:26.3R1 junos:26.4R1
Firstly 25.2R2-S2 will be out approximately on 3rd week of October.

Yes, the fix is in 23.4R2-S8 and S9.
S8 is already released.

Workaround

  • How to "Disable logging and file logging for BRCM_PKT to prevent further descriptor usage." ?
start shell 
vty fpc0
show ukern_trace handles
get the ID of the BRCM_PKT trace handle
set ukern_trace <# of BRCM_PKT> file-logging disable 
set ukern_trace <# of BRCM_PKT> logging disable
NOTE: in my test, vty fpc0 hangs, so we most likely need to restart the host before applying the fix.
  • Is there a workaround that doesn't require a device reboot ? As that can be user impacting.

No, the above disables the BRCM_PKT file logging, but the file descriptors already open for each DDOS prior will not be cleared without a reboot.

Impacted switches

Looking at Logstash, the impacted switches (showing TVP_PROC_STAT_FILE_OPEN_ERR) are:

  • asw1-by27-esams (since a while)
  • asw1-bw27-esams
  • lsw1-a2-codfw (started recently, but also have an uptime of only 15 weeks)
  • asw1-b12-drmrs
  • asw1-b13-drmrs
  • asw1-b4-magru

Next steps

  • Reboot the "impacted switches"
  • Identify on which switches the workaround needs to be applied
  • Apply the workaround
    • asw1-b3-magru
    • asw1-b4-magru
    • asw1-by27-esams
    • asw1-bw27-esams
    • asw1-b12-drmrs
    • asw1-b13-drmrs
    • lsw1-a2-codfw
    • lsw1-a[3-8]-codfw
    • lsw1-b[2-8]-codfw
  • Discuss the need to upgrade the switches

Event Timeline

ayounsi triaged this task as High priority.
Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Mentioned in SAL (#wikimedia-operations) [2026-09-15T08:25:48Z] <XioNoX> asw1-b3-magru - Disable logging and file logging for BRCM_PKT - T437984

Deployed the workaround on asw1-b3-magru (not showing signs of issues yet)

ayounsi@asw1-b3-magru> start shell user root 
Password:
root@asw1-b3-magru:RE:0% vty fpc0
Switching platform (2199 Mhz Pentium processor, 644MB memory, 0KB flash)
FPC0(asw1-b3-magru vty)# show ukern_trace handles
Ukernel Trace Info:
ID     Name             Level     Printf Logging Size   Wrap  Filter-id
-----  ---------------  ---------  -----  -----  -----  ----- ---------
[...]
17     BRCM_PKT         none       Off    On     1048576     54     -
[...]
FPC0(asw1-b3-magru vty)# set ukern_trace 17 file-logging disable 
FPC0(asw1-b3-magru vty)# [Tue Sep 15 08:25:56.533 LOG: Info] ukern_trace_set_file_logging File Logging is already in the disabled state
FPC0(asw1-b3-magru vty)# set ukern_trace 17 logging disable
FPC0(asw1-b3-magru vty)#

Mentioned in SAL (#wikimedia-operations) [2026-09-15T09:00:58Z] <ayounsi@cumin1003> START - Cookbook sre.dns.admin DNS admin: depool esams [reason: switches reboot, T437984]

Mentioned in SAL (#wikimedia-operations) [2026-09-15T09:01:01Z] <ayounsi@cumin1003> END (PASS) - Cookbook sre.dns.admin (exit_code=0) DNS admin: depool esams [reason: switches reboot, T437984]

Icinga downtime and Alertmanager silence (ID=a4925aa6-63a3-4037-92db-c71b5a881bd3) set by ayounsi@cumin1003 for 2:00:00 on 12 host(s) and their services with reason: Switch maintenance

cp[3067,3069,3071,3073,3075,3077,3079,3081].esams.wmnet,dns3003.wikimedia.org,ganeti[3005,3007].esams.wmnet,lvs3009.esams.wmnet

Icinga downtime and Alertmanager silence (ID=c96fe5ee-ddcb-4a50-935b-5314cd5dd078) set by ayounsi@cumin1003 for 2:00:00 on 3 host(s) and their services with reason: Switch maintenance

asw1-by27-esams,asw1-by27-esams IPv6,asw1-by27-esams.mgmt

Mentioned in SAL (#wikimedia-operations) [2026-09-15T09:31:24Z] <XioNoX> asw1-by27-esams> request system reboot - T437984

Mentioned in SAL (#wikimedia-operations) [2026-09-15T09:39:47Z] <ayounsi@cumin1003> START - Cookbook sre.dns.admin DNS admin: pool esams [reason: switches reboot, T437984]

Mentioned in SAL (#wikimedia-operations) [2026-09-15T09:39:51Z] <ayounsi@cumin1003> END (PASS) - Cookbook sre.dns.admin (exit_code=0) DNS admin: pool esams [reason: switches reboot, T437984]

FWIW I tried this on lsw1-a2-codfw but my session just hangs when I try to enter the FPC vty session:

cmooney@lsw1-a2-codfw> start shell user root 
Password:
root@lsw1-a2-codfw:RE:0% 
root@lsw1-a2-codfw:RE:0% 
root@lsw1-a2-codfw:RE:0% vty fpc0

Switch still seems fine but that connection has been stuck now for 15 mins like that so doesn't seem to be working. I can CTRL-C out of it fine.

The process went fine on lsw1-a3-codfw though so I'll continue and do a few more.

My bad on the above - I'd missed lsw1-a2-codfw was one of the affected devices, so the above shouldn't have been a surprise.

Mentioned in SAL (#wikimedia-operations) [2026-09-15T12:11:19Z] <ayounsi@cumin1003> START - Cookbook sre.dns.admin DNS admin: depool magru [reason: switch reboot, T437984]

Mentioned in SAL (#wikimedia-operations) [2026-09-15T12:11:22Z] <ayounsi@cumin1003> END (PASS) - Cookbook sre.dns.admin (exit_code=0) DNS admin: depool magru [reason: switch reboot, T437984]

Icinga downtime and Alertmanager silence (ID=570b3d05-b9aa-4423-a573-fd2ba45efa0e) set by ayounsi@cumin1003 for 2:00:00 on 3 host(s) and their services with reason: Switch maintenance

asw1-b4-magru,asw1-b4-magru IPv6,asw1-b4-magru.mgmt

Icinga downtime and Alertmanager silence (ID=c23e4a3d-f23f-4d8e-9e59-d286e2d71734) set by ayounsi@cumin1003 for 2:00:00 on 12 host(s) and their services with reason: Switch maintenance

cp[7002,7004,7006,7008,7010,7012,7014,7016].magru.wmnet,dns7002.wikimedia.org,ganeti[7002,7004].magru.wmnet,lvs7002.magru.wmnet

Mentioned in SAL (#wikimedia-operations) [2026-09-15T12:29:28Z] <XioNoX> asw1-b4-magru> request system reboot - T437984

Mentioned in SAL (#wikimedia-operations) [2026-09-15T12:40:53Z] <ayounsi@cumin1003> START - Cookbook sre.dns.admin DNS admin: pool magru [reason: network maintenance finished, T437984]

Mentioned in SAL (#wikimedia-operations) [2026-09-15T12:42:35Z] <ayounsi@cumin1003> END (PASS) - Cookbook sre.dns.admin (exit_code=0) DNS admin: pool magru [reason: network maintenance finished, T437984]

I've run the workaround on codfw lsw1-a[3-8] now. Appeared to work fine on all of them.

FWIW the BRCM_PKT process ID was 17 on all of them. And on every one it said "file-logging" was already disabled to the first command.

ayounsi renamed this task from Junos file descriptors exhautions to Junos file descriptors exhaustion.Mon, Sep 21, 3:09 PM
ayounsi updated the task description. (Show Details)

Mentioned in SAL (#wikimedia-operations) [2026-09-22T07:59:26Z] <ayounsi@cumin1004> START - Cookbook sre.dns.admin DNS admin: depool esams [reason: switch reboot, T437984]

Mentioned in SAL (#wikimedia-operations) [2026-09-22T07:59:29Z] <ayounsi@cumin1004> END (PASS) - Cookbook sre.dns.admin (exit_code=0) DNS admin: depool esams [reason: switch reboot, T437984]

Icinga downtime and Alertmanager silence (ID=0b63e0fc-c67d-42da-a806-56ac1e145157) set by ayounsi@cumin1004 for 2:00:00 on 3 host(s) and their services with reason: Switch reboot

asw1-bw27-esams,asw1-bw27-esams IPv6,asw1-bw27-esams.mgmt

Icinga downtime and Alertmanager silence (ID=b0de275b-4fb3-4a76-b054-678595c0ceaf) set by ayounsi@cumin1004 for 2:00:00 on 13 host(s) and their services with reason: Switch reboot

cp[3066,3068,3070,3072,3074,3076,3078,3080].esams.wmnet,dns3004.wikimedia.org,ganeti[3006,3008].esams.wmnet,lvs[3008,3010].esams.wmnet

Mentioned in SAL (#wikimedia-operations) [2026-09-22T08:29:56Z] <XioNoX> asw1-bw27-esams> request system reboot - T437984

Mentioned in SAL (#wikimedia-operations) [2026-09-22T08:45:53Z] <ayounsi@cumin1004> START - Cookbook sre.dns.admin DNS admin: pool esams [reason: switch reboot, T437984]

Mentioned in SAL (#wikimedia-operations) [2026-09-22T08:45:55Z] <ayounsi@cumin1004> END (PASS) - Cookbook sre.dns.admin (exit_code=0) DNS admin: pool esams [reason: switch reboot, T437984]

Mentioned in SAL (#wikimedia-operations) [2026-09-24T07:52:13Z] <ayounsi@cumin1004> START - Cookbook sre.dns.admin DNS admin: depool drmrs [reason: switch upgrade, T437984]

Mentioned in SAL (#wikimedia-operations) [2026-09-24T07:52:16Z] <ayounsi@cumin1004> END (PASS) - Cookbook sre.dns.admin (exit_code=0) DNS admin: depool drmrs [reason: switch upgrade, T437984]

Icinga downtime and Alertmanager silence (ID=21ede500-1983-4730-b871-1c7ca225b230) set by ayounsi@cumin1004 for 2:00:00 on 20 host(s) and their services with reason: Switches upgrade

bast6003.wikimedia.org,cp[6001,6003,6005,6007,6009,6011,6013,6015].drmrs.wmnet,dns6001.wikimedia.org,doh6001.wikimedia.org,durum6001.drmrs.wmnet,ganeti[6001,6003].drmrs.wmnet,hcaptcha-proxy6001.wikimedia.org,install6003.wikimedia.org,lvs[6001,6003].drmrs.wmnet,ncredir6001.drmrs.wmnet,tcp-proxy6001.drmrs.wmnet

Icinga downtime and Alertmanager silence (ID=728b2b9e-70ae-4304-acc5-5669decbb5dd) set by ayounsi@cumin1004 for 2:00:00 on 3 host(s) and their services with reason: Switch upgrade

asw1-b12-drmrs,asw1-b12-drmrs IPv6,asw1-b12-drmrs.mgmt

Mentioned in SAL (#wikimedia-operations) [2026-09-24T08:22:07Z] <XioNoX> asw1-b12-drmrs> request system reboot - T437984

Icinga downtime and Alertmanager silence (ID=3ba5e2c1-099e-4219-85d1-7c50f64c9b83) set by ayounsi@cumin1004 for 2:00:00 on 3 host(s) and their services with reason: Switch upgrade

asw1-b13-drmrs,asw1-b13-drmrs IPv6,asw1-b13-drmrs.mgmt

Icinga downtime and Alertmanager silence (ID=5d53fa31-8467-4252-9f52-e7035b9810c9) set by ayounsi@cumin1004 for 2:00:00 on 19 host(s) and their services with reason: Switches upgrade

cp[6002,6004,6006,6008,6010,6012,6014,6016].drmrs.wmnet,dns6002.wikimedia.org,doh6002.wikimedia.org,durum6002.drmrs.wmnet,ganeti[6002,6004].drmrs.wmnet,hcaptcha-proxy6002.wikimedia.org,lvs6002.drmrs.wmnet,ncredir6002.drmrs.wmnet,netflow6001.drmrs.wmnet,prometheus6002.drmrs.wmnet,tcp-proxy6002.drmrs.wmnet

Mentioned in SAL (#wikimedia-operations) [2026-09-24T09:01:20Z] <XioNoX> asw1-b13-drmrs> request system reboot - T437984

Mentioned in SAL (#wikimedia-operations) [2026-09-24T09:27:11Z] <ayounsi@cumin1004> START - Cookbook sre.dns.admin DNS admin: pool drmrs [reason: switch upgrade, T437984]

Mentioned in SAL (#wikimedia-operations) [2026-09-24T09:27:13Z] <ayounsi@cumin1004> END (PASS) - Cookbook sre.dns.admin (exit_code=0) DNS admin: pool drmrs [reason: switch upgrade, T437984]

ayounsi claimed this task.
ayounsi updated the task description. (Show Details)

All done!