Strange behaviour of Leap 15.4

OpenSuse Leap 15.4 is increasingly causing problems on a notebook Lenovo Thinkpad X1 Yoga, 16 GB Ram, 1 TB SSD.

  1. Daily and frequently, but at irregular intervals a black screen appears with the message that the screen lock is not working properly, a command line console should be opened (e.g. with Ctrl+Alt+F7) and the session should be unlocked typing “loginctl unlock-session 3” (see screenshot, errror message in German). However, the keys for opening the console do not work. The machine has to be switched off and rebooted by pressing the on/off-switch for 10 seconds.

  2. Before the black screen appears, many applications refuse to start. They all have a common error message: Too many instances of windows are opened, such that no further instance can be opened. Sometimes even Dolphin refuses to open.

Does anyone have a hint, where thes problems come from? Could it be a virus or something similar?
I envision to upgrade to Leap 15.5 but if it is a virus and infected files are on the /home partition these problems will resurface again.

That suggestion is awful. F7 is the standard location for X, though some configurations move it elsewhere. I suggest any of F3-F6. F1 is where Gnome reputedly lives, at least in some distros, while F2 is where some sessions show up instead of on F7, or F1. Both Alt-F7 and Ctrl-Alt-F7 will take most users from a shell session to X, if it’s running.

The link from @hui gives good information on this limit but I think it is indeed a good idea to check why you did hit this limit.

I did try on my Tumbleweed system with ~10 programs open.

The number of open “files”.

$ lsof -d '^cwd,^err,^ltx,^mem,^mmap,^pd,^rtd,^txt' +c 15  | wc -l

The limits:

$ ulimit -n
$ ulimit -u

The number of open “programs” is:

$ lsof -d '^cwd,^err,^ltx,^mem,^mmap,^pd,^rtd,^txt' +c 15 | awk '{print $1}' | uniq -c | sort -nr | wc -l

(remove the end “| wc -l” and replace it by “| head” to get the “programs” with the most files open, for me the top-10 is:

737 firefox
527 chrome
418 Isolated\x20Web
400 plasmashell
347 plasma-systemmo
283 thunderbird-bin
251 firefox
177 Web\x20Content
176 Isolated\x20Web
165 Isolated\x20Web

What is this returning for you?

Thank you for these helpful commands. The problem is that this machine is a notebook with exactly one person logged in. So, there is no obvious reason why so many files are open. Here are the results of the commands suggested by you:

$ ulimit -n
$ ulimit -u
lsof -d ‘^cwd,^err,^ltx,^mem,^mmap,^pd,^rtd,^txt’ +c 15 | wc -l
$ lsof -d ‘^cwd,^err,^ltx,
^mem,^mmap,^pd,^rtd,^txt’ +c 15 | awk ‘{print $1}’ | uniq -c
| sort -nr | wc -l
$ lsof -d ‘^cwd,^err,^ltx,^mem,^mmap,^pd,^rtd,^txt’ +c 15 | awk ‘{print $1}’ | uniq -c | sort -nr | head
1323 kmozillahelper
926 ksmserver
450 kmozillahelper
301 firefox
264 dbus-daemon
263 plasmashell
162 kmozillahelper
125 kwin_x11
110 Web\x20Content
83 plasma-browser-

What is looking strange to me (although I am not an expert) are the relatively large numbers of “kmozillahelper”. Presently I am writing this text on the X1-Yoga notebook with these problems. Firefox is running with only 2 tabs opened plus 3 shell sessions and the notebook is freshly booted.

Here is an example. I just tried to start vlc media player from the command line and got this error message:

VLC media player 3.0.18 Vetinari (revision 3.0.13-8-g41878ff4f2)
Maximum number of clients reachedMaximum number of clients reached[000055738ddac730] main interface error: no suitable interface module
[000055738dcc6d30] main libvlc error: interface “globalhotkeys,none” initialization failed
[000055738dcc6d30] main libvlc: VLC wird mit dem Standard-Interface ausgeführt. Benutzen Sie ‘cvlc’, um VLC ohne Interface zu verwenden.
Maximum number of clients reachedMaximum number of clients reachedMaximum number of clients reachedMaximum number of clients reached[000055738ddac730] skins2 interface error: cannot initialize OSFactory
[000055738dd59290] main playlist: playlist is empty
[000055738ddac730] [cli] lua interface: Listening on host “*console”.

This “Maximum number of clients reached”-message on a recently booted system is very strange.

I forgot the number of open programs:

$ lsof -d ‘^cwd,^err,^ltx,^mem,^mmap,^pd,^rtd,^txt’ +c 15 | wc -l

This is well below the limit.

You may want to remove the content of ~/.config/ (if you are using Plasma) as mentioned here:

If you don’t want it,you can test with a fresh user account first…

Firefox with 6 tabs open:

$ lsof -d '^cwd,^err,^ltx,^mem,^mmap,^pd,^rtd,^txt' +c 15 | awk '{print $1}' | uniq -c | sort -nr | grep -P '(firefox|mozilla)'
    778 firefox
    270 firefox
     21 kmozillahelper
     18 kmozillahelper
     17 kmozillahelper

I searched a bit and found this question for a similar problem on Tumblweed. The (long) “ss command” in the answer gives me (top 10):

  4 "firefox"
  3 "kmozillahelper"
  3 "kglobalaccel5"
  3 "kded5"
  2 "xdg-desktop-por"
  2 "thunderbird-bin"
  2 "kwin_x11"
  2 "ksmserver"
  2 "kscreen_backend"
  1 "xsettingsd"

I have, hopefully, solved the problem. But I did not find the cause. I was lucky that the problem occurred only with the user-id that was used regularly. In the end I created a new user-id, moved all files to the new home directory and set it up according to the specifics of the faulty id and I was done.

I suspect that the culprit was Firefox: When I ran the script from the similar problem on Tumblweed with the faulty id it showed me more than 200 instances of “kmozillahelpers”. The same script used with the other non-faulty id showed only two.

Linux is not vulnerable to attacks, however, Firefox is. It might be interesting, that this was probably the second time for me that Firefox was attacked under Linux. A few months ago Firefox on my PC (Scientific Linux 7.9, 16 MB RAM) began to consume all resources resulting in a system stall when all resources were exhausted. I could observe it very well with the system monitoring tool. The remedy here was to reset Firefox to its original status and reinstall all extensions.

1 Like