Cribl Edge File Monitor Causes Excessive Linux NAS Automounts

Symptom

On Linux hosts, a Cribl Edge File Monitor source can trigger automounts for many NAS file systems under /net and /nas. If another process keeps probing those mounts, they never idle out, and the host slows down or commands hang. File Monitor logs may show Unknown system error -116.

Environment

• Cribl Edge File Monitor source
• Linux host using automount for NAS file systems
• File Monitor source with Search path set to / and Max depth set to 10

Resolution

1. Navigate to Products > Edge.
2. Select the affected Fleet.
3. Select More > Sources > File Manager.
4. Select the File Monitor source.
5. Disable the source, or narrow the Search path and Max depth to only the directories you need to monitor.
6. Select Save.
7. Select Commit.
8. Select Commit & Deploy.
9. Verify that the change took effect by checking the source's enabled state on an affected node. A commit that did not complete leaves the source running.
10. Ask your Linux administrator to restart automountd to clear mounts that are already stuck.

Cause

The suspected cause is a File Monitor source scanning from / to a Max depth of 10. This reaches /net and /nas, and touching those paths is enough to trigger an automount. If another process, such as a monitoring agent, periodically probes the same mounts, the OS never gets an idle window to unmount them automatically.