On Wed, Jun 8, 2022 at 11:31 AM Gal Rosen <gal.rosen@xxxxxxxxxxxxxx> wrote: > > Hi Jack, > > Can you provide details on the reason I sometimes get read errors on events that I get from FANOTIFY ? > My user space program watches on all mount points in the system and sometimes when in parallel I run full scan with another application on all my files in the endpoint, I get a read error when trying to read from the FANOTIFY fd on a new event. > The errno is sometimes EPERM (Operation not permitted) and sometimes EMFILE (Too many open files). > Hi Gal, EPERM is a bit surprising assuming that your process has CAP_SYS_ADMIN, so needs investigating, but EMFILE is quite obvious. Every event read needs to open a fd to place in event->fd. If you exceed your configured limit, this error is expected. You can bump the limit as CAP_SYS_ADMIN if that helps. > The last time I saw these errors, it was on RHEL 8.5, kernel 4.18.0-348.23.1.el8_5.x86_64. Does your application even use permission events? If it doesn't then watching with a newer kernel (>5.1) and FAN_ERPORT_FID is going to be more efficient in resources and you wont need to worry about open files limits. Thanks, Amir.
