Uresourced 461312 inotify watches: normal?

I had an issue recently in which the maximum number of inotify watches (which was set to 524288) was exceeded. Upon researching who was allocating these watches via inotify-info, I found these top 3 consumers:

        Pid  App                        Watches   Instances
       11013 uresourced                     461312   1
     1428145 fsnotifier                     49634   1
       26771 cgroupify                      12699   1

Clearly, uresourced is taking the bulk here, at 461312. fsnotifier is a development IDE process and uses a lot normally so not too concerned with those. cgroupify is taking quite a few too.

Is this number of watches by uresourced and cgroupify normal?

Also meeting this, at least 5 times. I could not figure out the cause. Currently workaround by running systemctl restart --user uresourced.service occasionally.

------------------------------------------------------------------------------
INotify Limits:
  max_queued_events    16384
  max_user_instances   128
  max_user_watches     123407
------------------------------------------------------------------------------
       Pid App                                      Watches  Instances
   2296983 uresourced                                122936          1
   3399975 xdg-desktop-portal-gnome                      55          1
   3400439 gsd-xsettings (deleted)                       49          1
   3400031 xdg-desktop-portal-gtk                        48          1
   3399490 gnome-software (deleted)                      23          1
   3399254 gnome-shell (deleted)                         14          1
   3408781 tracker-miner-fs-3                             8          1
   3408719 gvfsd-trash                                    7          1
   3399188 gnome-session-binary                           6          2

Edit: after restart and 12 hours (it’s my workstation, running ~10 podman containers), the count growed again to a quite large number

------------------------------------------------------------------------------
INotify Limits:
  max_queued_events    16384
  max_user_instances   128
  max_user_watches     123407
------------------------------------------------------------------------------
       Pid App                                      Watches  Instances
   1422648 uresourced                                 11764          1
   3399975 xdg-desktop-portal-gnome                      55          1
   3400439 gsd-xsettings (deleted)                       49          1
   3400031 xdg-desktop-portal-gtk                        48          1
   3399490 gnome-software (deleted)                      23          1
   3399254 gnome-shell (deleted)                         14          1
   3408781 tracker-miner-fs-3                             8          1
   3408719 gvfsd-trash                                    7          1
   3399188 gnome-session-binary                           6          2
------------------------------------------------------------------------------
Total inotify Watches:   12027
Total inotify Instances: 53
------------------------------------------------------------------------------

Both uresourced and cgroupify come from the uresourced package.

As far as I can tell from a quick look at the code they’re using inotify to monitor the cgroup hierarchy under /sys/fs/cgroup/user.slice which is only a few thousand files which doesn’t explain the vast number of watches they seem to have or why that number drops to next to nothing on a restart.

My guess is that there is some sort of leak with watches not being released as tasks end.

Thanks for confirming the issue is not specific to my machine. I’ve created this bug report: 2258599 – Leak in uresourced inotify watches. Feel free to comment there with any additional information you think might be relevant.