# NautheraServerFileDescriptorsHigh

A nauthera-server replica uses more than 80% of its file descriptor limit.

## Meaning

`process_open_fds / process_max_fds` has been above the threshold (0.8) for ten minutes on
one replica. Every client connection, database connection, cache connection, outbound
request (back-channel logout, a hosted captcha, SMTP) and open file holds a descriptor.
A steady climb without more traffic points to a leak; a jump with traffic points to many
idle or slow client connections.

## Impact

Nothing fails yet. At the limit the replica can accept no new connection and open no new
database or cache connection, so sign-in, token and admin requests routed to it fail
until it is restarted.

## Diagnosis

1. Which replica, and how fast it is growing:
   `process_open_fds{job="<name>"}` and `process_max_fds{job="<name>"}`.
2. Compare with what holds descriptors: `nauthera_http_in_flight_requests{job="<name>"}`,
   `go_sql_open_connections{job="<name>",db_name="nauthera"}` (at most
   `database.max_open_conns`, 20 by default) and `nauthera_grpc_in_flight_requests`.
3. Many connections from one client address: the `http_request` log lines carry
   `client_ip`; a slow or idle-connection flood shows as many connections and few
   completed requests.
4. Check whether the climb started with a rollout:
   `kubectl -n <ns> rollout history deploy/<name>`.

## Mitigation

- Relieve the replica: `kubectl -n <ns> delete pod <pod>`; the Deployment replaces it.
- A connection flood: limit it at the ingress or load balancer in front of the server.
- Legitimate load: add replicas (`replicaCount`, or `autoscaling`).
- A climb that tracks a new version: roll back with `helm rollback <release>`.

## Escalation

If descriptors grow steadily while traffic is flat, or come back after a restart, it is
likely a leak: escalate to the identity platform owner and open an issue with graphs of
`process_open_fds`, `nauthera_http_in_flight_requests` and `go_sql_open_connections` over
the same window, and the server version (`nauthera_build_info`).

---

[Alert runbooks](https://www.nauthera.io/docs/v1/runbooks/alerts) · Generated from [`internal/runbook/alerts.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/alerts.yaml) and [`operator/internal/runbook/alerts.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/alerts.yaml) in nauthera-server.