# Nginx mod\_security leaks file descriptors

**URL:** <https://www.ruby-forum.com/t/nginx-mod-security-leaks-file-descriptors/236288>\
**Category:** NGINX\
**Created:** [August 22, 2013, 1:26pm UTC](https://www.ruby-forum.com/t/nginx-mod-security-leaks-file-descriptors/236288 "2013-08-22T13:26:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![addis\_a](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/c4cdca/32.png) [@addis\_a](https://www.ruby-forum.com/u/addis_a)\
**Post date:** [August 22, 2013, 1:26pm UTC](https://www.ruby-forum.com/t/nginx-mod-security-leaks-file-descriptors/236288/1 "2013-08-22T13:26:48Z")

</div>

Hi,

I have a problem with nginx and mod\_security module. After reloading  
nginx configuration (kill -HUP ) all files opened by  
mod\_security are opened once again without closing the old ones. That  
means at some point we hit the limit of open file descriptors, in my  
real life scenario I leak over 300 files on each reload.

# Here are my sample configs just to illustrate the problem:

nginx.conf  
user www-data www-data;  
worker\_processes 6;  
worker\_rlimit\_nofile 200000;

error\_log /var/log/nginx/error.log debug;

events {  
worker\_connections 16384;  
multi\_accept on;  
use epoll;  
}

http {  
server {  
listen 80;  
location / {  
ModSecurityEnabled on;  
ModSecurityConfig modsecurity.conf;  
return 555;  
}  
}  
}

============================================================  
modsecurity.conf:

# Debug log

# SecDebugLog /var/log/waf/events.log

In this situation after each configuration reload I am leaking open  
files:

www-data@dev03 ~ # lsof | grep nginx | wc -l; kill -HUP `ps aux | grep 'nginx: master process' | grep -v grep | awk '{print $2}'`; sleep 2;  
lsof | grep nginx | wc -l  
361  
368

I am using Ubuntu 12.04 LTS and nginx \_openresty 1.4.2.1

(DEPLOY)www-data@dev03:~# nginx -V  
nginx version: ngx\_openresty/1.4.2.1  
built by gcc 4.6.3 (Ubuntu/Linaro 4.6.3-1ubuntu5)  
TLS SNI support enabled

Does someone else have the same problem?

I will be happy to provide other information if necessary.

Regards,  
Kiril

---

<div class="post-metadata">

**Author:** ![Kiril\_Kalchev](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/ad7895/32.png) [@Kiril\_Kalchev](https://www.ruby-forum.com/u/Kiril_Kalchev)\
**Post date:** [August 22, 2013, 5:17pm UTC](https://www.ruby-forum.com/t/nginx-mod-security-leaks-file-descriptors/236288/2 "2013-08-22T17:17:35Z")

</div>

Hi Kiril,

I think the better place to make this question its on modsecurity users  
list, because apparently its a problem in modsecurity module and don’t  
in NGINX.

Regards,

Alan

---

<div class="post-metadata">

**Author:** ![Kiril\_Kalchev](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/ad7895/32.png) [@Kiril\_Kalchev](https://www.ruby-forum.com/u/Kiril_Kalchev)\
**Post date:** [August 22, 2013, 5:21pm UTC](https://www.ruby-forum.com/t/nginx-mod-security-leaks-file-descriptors/236288/3 "2013-08-22T17:21:41Z")

</div>

* * *

nginx mailing list  
removed\_email\_address@domain.invalid  
[http://mailman.nginx.org/mailman/listinfo/nginx](http://mailman.nginx.org/mailman/listinfo/nginx)