I think I got it: With "pidof udevd" I determined the udev subprocess which runs the callouts and rules, straced it, and now see the cause:
9782 open("/sys/devices/pci0000:00/0000:00:1f.2/host1/target1:0:0/1:0:0:0/block", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = -1 EMFILE (Too many open files) 9782 open("/sys/devices/pci0000:00/0000:00:1f.2/host1/target1:0:0/1:0:0:0/block/*/uevent", O_WRONLY|O_CREAT|O_TRUNC, 0666) = -1 EMFILE (Too many open files) 9782 socket(PF_FILE, 0x80002 /* SOCK_??? */, 0) = -1 EMFILE (Too many open files) 9782 open("/dev/console", O_WRONLY|O_NOCTTY) = -1 EMFILE (Too many open files) 9782 unlink("/dev/.udev/db/scsi:1:0:0:0") = -1 ENOENT (No such file or directory) 9782 socket(PF_FILE, SOCK_DGRAM, 0) = -1 EMFILE (Too many open files) 9782 socket(PF_FILE, 0x80002 /* SOCK_??? */, 0) = -1 EMFILE (Too many open files) 9782 open("/dev/console", O_WRONLY|O_NOCTTY) = -1 EMFILE (Too many open files) [...]
That explains why restarting udev cures this. It seems that there is an fd leak somewhere.
I think I got it: With "pidof udevd" I determined the udev subprocess which runs the callouts and rules, straced it, and now see the cause:
9782 open("/ sys/devices/ pci0000: 00/0000: 00:1f.2/ host1/target1: 0:0/1:0: 0:0/block" , O_RDONLY| O_NONBLOCK| O_DIRECTORY| O_CLOEXEC) = -1 EMFILE (Too many open files) sys/devices/ pci0000: 00/0000: 00:1f.2/ host1/target1: 0:0/1:0: 0:0/block/ */uevent" , O_WRONLY| O_CREAT| O_TRUNC, 0666) = -1 EMFILE (Too many open files) dev/console" , O_WRONLY|O_NOCTTY) = -1 EMFILE (Too many open files) "/dev/. udev/db/ scsi:1: 0:0:0") = -1 ENOENT (No such file or directory) dev/console" , O_WRONLY|O_NOCTTY) = -1 EMFILE (Too many open files)
9782 open("/
9782 socket(PF_FILE, 0x80002 /* SOCK_??? */, 0) = -1 EMFILE (Too many open files)
9782 open("/
9782 unlink(
9782 socket(PF_FILE, SOCK_DGRAM, 0) = -1 EMFILE (Too many open files)
9782 socket(PF_FILE, 0x80002 /* SOCK_??? */, 0) = -1 EMFILE (Too many open files)
9782 open("/
[...]
That explains why restarting udev cures this. It seems that there is an fd leak somewhere.