Failed to add /run/systemd/ask-password to directory watch

[Mac]

Hi there

Hope all is well

I am running up to date server Debian 9 

On a couple of servers I have found via ssh trying to run any systemctl commands 

Returns this error:

Failed to add /run/systemd/ask-password to directory watch: No space left on device

Running df-h and df-i show there are plenty or resources 

Googling the error suggested running
lsof -K | grep inotify | (less||more||pg)

The results were:

wazuh-sys 11362 11364     root    8r  a_inode               0,11        0       7527 inotify
wazuh-sys 11362 11366     root    8r  a_inode               0,11        0       7527 inotify
wazuh-sys 11362 12318     root    8r  a_inode               0,11        0       7527 inotify
wazuh-sys 11362 12319     root    8r  a_inode               0,11        0       7527 inotify
wazuh-sys 11362 12320     root    8r  a_inode               0,11        0       7527 inotify

I could not stop wazuh-agent via ssh but once I did manage everything worked again as expected.

Any advice on what to do about this would be most welcomed 

Kind regards

Brad 

[Pablo Ariel Gonzalez]

Hi Mac, nice to meet you. I don't know if you still have this problem so we can analyze it together. If so, I will consult you some data to be able to analyze this problem.

You tell us that this error has occurred on some servers. Has it happened to you on all the servers where you have the wazuh agent or in a specific group? If it was only in a specific group, do the servers have any similarities between them? (OS version, Wazuh agent version, they all failed at the same time, etc.).

My understanding is that the "watch" directory is a location within your servers, is it part of the root (/) or is it mounted to a specific location?

With these data we could investigate what is the cause of this inconvenience.

Thanks you,