I recently issued this command:
find . -type f | wc -l
To count how many files are in my public_html folder.
Shortly after, Nginx returned 500 internal server error and error.log was being flooded with "too many open files" error. I thought maybe this could be the source of this problem?
Looking at strace -eopen find . -type f with GNU find (4.4.2 from Debian Squeeze) the answer appears to be "no, find does not open files", but it does open directories:
open("details", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 5
open("..", O_RDONLY|O_NOCTTY|O_NONBLOCK|O_DIRECTORY|O_NOFOLLOW) = 5
open("..", O_RDONLY|O_NOCTTY|O_NONBLOCK|O_DIRECTORY|O_NOFOLLOW) = 5
open("..", O_RDONLY|O_NOCTTY|O_NONBLOCK|O_DIRECTORY|O_NOFOLLOW) = 5
open("..", O_RDONLY|O_NOCTTY|O_NONBLOCK|O_DIRECTORY|O_NOFOLLOW) = 5
open("..", O_RDONLY|O_NOCTTY|O_NONBLOCK|O_DIRECTORY|O_NOFOLLOW) = 5
open("..", O_RDONLY|O_NOCTTY|O_NONBLOCK|O_DIRECTORY|O_NOFOLLOW) = 5
open("..", O_RDONLY|O_NOCTTY|O_NONBLOCK|O_DIRECTORY|O_NOFOLLOW) = 5
open("..", O_RDONLY|O_NOCTTY|O_NONBLOCK|O_DIRECTORY|O_NOFOLLOW) = 5
open(".uml", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 5
open("..", O_RDONLY|O_NOCTTY|O_NONBLOCK|O_DIRECTORY|O_NOFOLLOW) = 5
open(".dbus", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 5
etc. Of course all of these commands returned the same filehandle # which strongly implies that find is closing them again. I made a pretty deep set of directories and it seems that find uses .. to go up a directory rather than holding the directory open.
It does seem like a really remarkable coincidence though.
Files ARE directories, of course, and if find weren't closing them as it went along, you'd still theoretically be at some tiny risk on some Unixen. Run the full
strace find . -type f
and look at the sequence (from linux):
openat(AT_FDCWD, "a", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 6
fchdir(6) = 0
getdents(6, /* 4 entries */, 32768) = 104
getdents(6, /* 0 entries */, 32768) = 0
close(6)
...
