Increasing allowed nproc in Centos 7

Posted on February 20, 2020 • 2 minutes • 417 words • Suggest Changes

The nproc are the number of proces units a user can start; This is managed in the file : /etc/security/limits.confbut can be overwritten in /etc/security/limits.d/ normally in /etc/security/limits.d/20-nproc.conf which has priority over the limits.conf file. To check how many nproc’s you are using, you need to include the amount of threads, this can be seen using :

[root@server ~]# ps -lfu root | wc -l
603

The default limit for Centos 7 is 4096 for a user and unlimited for root;

# Default limit for number of user's processes to prevent
# accidental fork bombs.
# See rhbz #432903 for reasoning.

*          soft    nproc     4096
root       soft    nproc     unlimited

On Centos 5 this was based on the amount of threads-max the kernel could handle; (50% of that)

[root@server ~]# sysctl -a | grep threads-max
kernel.threads-max = 1029577

In Centos 6 the limit was 1024; and on Centos 7 the limit got increased to 4096; While its already higher, we could argue to increase it even further; As threads are relatively cheap.

I increased it to a randomly selected 10000 hard and 8192 soft; Except for the root, although a limit might be useful, I’m afraid if a fork bomb happens, you need the unlimited power to stop it … (perhaps soft ?)

cat /etc/security/limits.d/20-nproc.conf
# Default limit for number of user's processes to prevent
# accidental fork bombs.
# See rhbz #432903 for reasoning.

*          soft    nproc     8192
*          hard    nproc     10000
root       soft    nproc     unlimited
root       hard    nproc     unlimited

A similar thing can be done for open files per user; since there is no specific number (yet?) I used 30-nofile.conf You could base this on the maximum open files the system can handle cat /proc/sys/fs/file-max but that seems a bit excessive !

cat /etc/security/limits.d/30-nofile.conf
# max cat /proc/sys/fs/file-max
# 13163513
*       soft    nofile  100000
*       hard    nofile  100001

How to activate it ? Just open a new shell, and the limits are active; check :

[root@server ~]# ulimit -a
core file size          (blocks, -c) 0
data seg size           (kbytes, -d) unlimited
scheduling priority             (-e) 0
file size               (blocks, -f) unlimited
pending signals                 (-i) 514788
max locked memory       (kbytes, -l) unlimited
max memory size         (kbytes, -m) unlimited
open files                      (-n) 100000
pipe size            (512 bytes, -p) 8
POSIX message queues     (bytes, -q) 819200
real-time priority              (-r) 0
stack size              (kbytes, -s) 8192
cpu time               (seconds, -t) unlimited
max user processes              (-u) 20001
virtual memory          (kbytes, -v) unlimited
file locks                      (-x) unlimited

Useful links :

all ulimit options