Red Hat Training

A Red Hat training course is available for Red Hat Enterprise Linux

Chapter 11. Setting Shell Limits for the Oracle User

Most shells like Bash provide control over various resources like the maximum allowable number of open file descriptors or the maximum number of processes available to a user.
To see all shell limits, run: 
ulimit -a
For more information on ulimit for the Bash shell, see man bash and search for ulimit.

Note

On some Linux systems setting "hard" and "soft" limits in the following examples might not work properly when you log in as user oracle via SSH. It might work if you log in as root and su to oracle. If you have this problem try to set UsePrivilegeSeparation to "no" in /etc/ssh/sshd_config and restart the SSH daemon by executing service sshd restart. The privilege separation does not work properly with PAM on some Linux systems. Make sure to talk to the people in charge of security before disabling the SSH security feature "Privilege Separation".

11.1. Limiting Maximum Number of Open File Descriptors for the Oracle User

After /proc/sys/fs/file-max has been changed, see Chapter 9, Setting File Handles, there is still a per user limit of maximum open file descriptors: 
$ su - oracle
$ ulimit -n
1024
$
To change this limit, edit the /etc/security/limits.conf file as root and make the following changes or add the following lines, respectively: 
oracle           soft    nofile          4096
oracle           hard    nofile          63536
The "soft limit" in the first line defines the number of file handles or open files that the Oracle user will have after they log in. If the Oracle user gets error messages about running out of file handles, then the Oracle user can increase the number of file handles like in this example up to 63536 ("hard limit") by executing the following command: 
ulimit -n 63536
You can set the "soft" and "hard" limits higher if necessary.

Note

It is not recommend to set the "hard" limit for nofile for the oracle user equal to /proc/sys/fs/file-max. If you do that and the user uses up all the file handles, then the entire system will run out of file handles. This may prevent users logging in as the system cannot open any PAM modules that are required for the login process. That is why the hard limit should be set to 63536 and not 65536.
That these limits work you also need to ensure that pam_limits is configured in the /etc/pam.d/system-auth file, or in /etc/pam.d/sshd for ssh, /etc/pam.d/su for su, or /etc/pam.d/login for local access and telnet and disable telnet for all log in methods. Here are examples of the two session entries in the /etc/pam.d/system-auth file: 
session     required      /lib/security/$ISA/pam_limits.so
session     required      /lib/security/$ISA/pam_unix.so
Log in to the oracle user account since the changes will become effective for new login sessions only. Note the ulimit options are different for other shells. 
$ su - oracle
$ ulimit -n
4096
$
The default limit for oracle is now 4096 and the oracle user can increase the number of file handles up to 63536: 
$ su - oracle
$ ulimit -n
4096
$ ulimit -n 63536
$ ulimit -n
63536
$
To make this change permanent, you could add "ulimit -n 63536" ,for bashbash, to the ~oracle/.bash_profile file which is the user start up file for the bash shell on Red Hat Enterprise Linux (to verify your shell execute echo $SHELL). To do this you could simply copy and paste the following commands for oracle's bash shell: 
su - oracle
cat >> ~oracle/.bash_profile << EOF
ulimit -n 63536
EOF
To make the above changes permanent, you could also set the soft limit equal to the hard limit in /etc/security/limits.conf: 
oracle           soft    nofile          63536
oracle           hard    nofile          63536