ulimit Calculator
Recommend a ulimit -n (open files) value for a workload based on concurrent connections and files per connection.
Inputs
Include sockets, log files, temp files opened per connection
Multiplier for headroom above the raw calculated need
Recommended ulimit -n
22,500
Rounded Recommendation
23,000
Raw Requirement
15,000
limits.conf Entry
* soft nofile 23000 * hard nofile 23000
Step by step
Values used
Concurrent Connections = 5,000; Average Files/Sockets per Connection = 3; Safety Factor = 1.50
Recommended ulimit
recommended = connections × files_per_connection × safety_factor
Recommended ulimit -n
= 22,500
Rounded Recommendation
= 23,000
Raw Requirement
= 15,000
limits.conf Entry
= * soft nofile 23000 * hard nofile 23000
How it works
Every socket, log file and temp file a server opens consumes one file descriptor, so a high-concurrency service can exhaust the default 1024 ulimit -n very quickly. The raw requirement multiplies expected concurrent connections by the average files/sockets each one opens, and a safety factor is applied on top to absorb bursts, slow-closing connections and auxiliary file handles that are easy to undercount.
Formula
Recommended ulimit
recommended = connections × files_per_connection × safety_factor
- c
- concurrent connections
- f
- average files/sockets per connection
- k
- safety factor
Frequently Asked Questions
What is the default ulimit -n on most Linux distributions?
Most distributions default the soft limit to 1024 file descriptors per process, which is far too low for high-concurrency servers like web servers, databases or message brokers handling thousands of simultaneous connections.
What safety factor should I use?
A factor of 1.5-2x over the raw calculated need is common, providing headroom for connection spikes, slow-closing sockets (TIME_WAIT), and file handles opened for logging or temporary files that are easy to forget when estimating.
Where do I actually set the ulimit for a systemd service?
Add LimitNOFILE=<value> under the [Service] section of the unit file (or a drop-in), then run `systemctl daemon-reload` and restart the service — this is more reliable than /etc/security/limits.conf for services not started through a login shell.