Too many open files: find the leak before raising the limit

Too many open files usually triggers a nofile bump. That buys time, not a fix.

ls /proc/1234/fd | wc -l
ls -l /proc/1234/fd | awk '{print $11}' | sort | uniq -c | sort -rn | head

The second line shows whether a thousand descriptors point at the same socket, the same file, or anonymous socket:[...] inodes. All sockets means connections are not closed; all the same file means a missing close.

Remember there are three layers: systemd's LimitNOFILE, the session's limits.conf, and fs.file-max. Change the wrong one and ulimit -n looks right while the service still gets the old value. systemctl show app -p LimitNOFILE is what the process actually received.