Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

NautheraServerFileDescriptorsHigh

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

A nauthera-server replica uses more than 80% of its file descriptor limit.

Meaning

process_open_fds / process_max_fds has been above the threshold (0.8) for ten minutes on one replica. Every client connection, database connection, cache connection, outbound request (back-channel logout, a hosted captcha, SMTP) and open file holds a descriptor. A steady climb without more traffic points to a leak; a jump with traffic points to many idle or slow client connections.

Impact

Nothing fails yet. At the limit the replica can accept no new connection and open no new database or cache connection, so sign-in, token and admin requests routed to it fail until it is restarted.

Diagnosis

  1. Which replica, and how fast it is growing: process_open_fds{job="<name>"} and process_max_fds{job="<name>"}.
  2. Compare with what holds descriptors: nauthera_http_in_flight_requests{job="<name>"}, go_sql_open_connections{job="<name>",db_name="nauthera"} (at most database.max_open_conns, 20 by default) and nauthera_grpc_in_flight_requests.
  3. Many connections from one client address: the http_request log lines carry client_ip; a slow or idle-connection flood shows as many connections and few completed requests.
  4. Check whether the climb started with a rollout: kubectl -n <ns> rollout history deploy/<name>.

Mitigation

  • Relieve the replica: kubectl -n <ns> delete pod <pod>; the Deployment replaces it.
  • A connection flood: limit it at the ingress or load balancer in front of the server.
  • Legitimate load: add replicas (replicaCount, or autoscaling).
  • A climb that tracks a new version: roll back with helm rollback <release>.

Escalation

If descriptors grow steadily while traffic is flat, or come back after a restart, it is likely a leak: escalate to the identity platform owner and open an issue with graphs of process_open_fds, nauthera_http_in_flight_requests and go_sql_open_connections over the same window, and the server version (nauthera_build_info).

Alert runbooks · Generated from internal/runbook/alerts.yaml and operator/internal/runbook/alerts.yaml in nauthera-server.