Set Memcached limits and leave shutdown disabled

The fix/etc/memcached.conf

-m 1024
-c 1024
# deliberately absent: -A

If you see this

failed to set rlimit for open files. Try starting as root or requesting smaller maxconns value.

The -c value needs more file descriptors than the process may allocate. Raise LimitNOFILE in the unit file rather than lowering -c blindly, and never solve it by running as root. — memcached/memcached.c

Why this is rated low

It is availability and housekeeping, not access control. Nothing here stops anyone reading your cache — binding and authentication do that, and they are the pages worth your attention first.

It earns a place on the checklist because the defaults are conservative in a way that surprises people, and because one flag deserves to stay off.

The memory limit is smaller than you think

-m sets the item memory in megabytes and defaults to 64. That is not a typo and it is not scaled to your host — a server with 128 GB of RAM still caches 64 MB unless told otherwise.

The failure this produces is not a crash. It is eviction: memcached silently drops the least recently used items to stay under the limit, so the cache appears to work while the hit rate quietly sits far below what you assumed. That is a performance problem masquerading as a working system.

Set it deliberately, and leave the host real headroom — -m counts item storage only, so actual process memory runs above it:

-m 1024

-M returns an error instead of evicting. Useful for diagnosis, wrong for production, where an error is worse than a miss.

Connections

-c defaults to 1024 simultaneous connections. Enough for most deployments, and the number that matters when an application server pool with generous per-process connection settings scales out — the ceiling arrives suddenly and looks like a network fault.

Raising it needs file descriptors to match, which is what the error at the top of this page is about. On systemd the fix is LimitNOFILE in the unit, not ulimit in a shell:

/etc/systemd/system/memcached.service.d/override.conf

[Service]
LimitNOFILE=8192

Never solve that error by running as root — see run as a non-root user, and note the error text suggests it precisely because memcached cannot tell whether you meant to.

The commands that need no credential

Worth being explicit, because it is the part people do not expect. On a daemon with no authentication enabled, these are available to anyone who can connect:

• flush_all — invalidates every item in the cache, instantly. One line, no credential, and the backing database absorbs the entire read load. It is a denial-of-service primitive that looks like a normal protocol command.
• stats items and stats slabs — enumerate what is cached, which turns a blind read into a targeted one.
• shutdown — stops the daemon outright. This one is off by default and requires -A to enable.

Leave -A off. It exists for controlled environments and there is no good reason for a cache to accept a remote stop command. Its absence from the fix block above is the point.

None of these can be individually disabled — memcached has no ACL system like Redis’s. The only control over them is the one at the front door, which is the argument for treating binding as load-bearing.

Verify it worked

Read the limits the running server resolved:

printf 'stats settings\r\n' | nc 127.0.0.1 11211 | grep -E 'maxbytes|maxconns|shutdown'

maxbytes is in bytes — 67108864 is the 64 MB default and usually means -m was never set.

Check whether eviction is happening, which is what tells you the limit is wrong:

printf 'stats\r\n' | nc 127.0.0.1 11211 | grep -E 'evictions|get_hits|get_misses|curr_connections'

A climbing evictions counter with a poor hit ratio means raise -m. curr_connections approaching -c means raise the connection limit and the file descriptors together.

Confirm the shutdown command is not enabled:

grep -rn '^-A\|enable-shutdown' /etc/memcached.conf /etc/sysconfig/memcached 2>/dev/null

Expect no output.

Before you apply this

-m too high is the one that bites. Memcached’s process footprint exceeds the item limit, so setting -m near total RAM invites the OOM killer — which takes out the daemon and, on a badly tuned host, something more important. Leave headroom, and change it in steps while watching:

free -m
ps -o rss= -C memcached

Lowering -m on a running system forces immediate eviction down to the new limit, so a large reduction is effectively a partial cache flush and a load spike behind it.

Every change here is a restart, and a restart empties the cache entirely — which is the bigger event. Sizing changes are worth batching with any other memcached work rather than taking a cold cache for a tuning tweak.

If you are raising -c, raise LimitNOFILE in the same change or the daemon may refuse to start with the error at the top of this page:

sudo systemctl daemon-reload && sudo systemctl restart memcached

Related

• Bind Memcached to localhost — the only thing standing between flush_all and a stranger.
• Run as a non-root user — why the descriptor error should not be solved with privileges.