Hot answers tagged

10

I've gotten an initial explanation about this test case from Stefan Seyfried, who wrote the paper this example was taken from. The problem here is that the CPU scheduler parts of cgroups always aims to keep any available CPU busy; it doesn't ever enforce a hard limit if everything will fit at once. In the case where two processes (high and low here) are ...


8

A better and safer solution is to install cgmanager and run it with systemctl start cgmanager (on a systemd-based distro). You can than have your root user, or if you have sudo rights on the host create cgroups for your unprivileged user in all controllers with: sudo cgm create all $USER sudo cgm chown all $USER $(id -u $USER) $(id -g $USER) Once they ...


6

The easiest way is using systemd which may be responsible for your sshd anyway (depending on the distribution). You can easily configure the limits in the sshd unit file. systemd puts all services in separate cgroups anyway. Without systemd the easiest solution is probably a modification to the sshd start script (pay attention that it's not overwritten by ...


6

From the kernel documentation concerning memory.swappiness: 5.3 swappiness Similar to /proc/sys/vm/swappiness, but affecting a hierarchy of groups only. Following cgroups' swappiness can't be changed. - root cgroup (uses /proc/sys/vm/swappiness). - a cgroup which uses hierarchy and it has other cgroup(s) below it. - a cgroup which ...


6

Since posting this question I have studied the entire guide that I linked to above, as well as the majority of the cgroups.txt documentation and cpusets.txt. I now know more than I ever expected to learn about cgroups, so I'll answer my own question here. There are multiple approaches you can take. Our company's contact at Red Hat (a Technical Architect) ...


5

As far as I'm concerned, I think cgroups would be overkill here. However, I tend to use ulimit whenever I run something witk a fork system call in it (bad experiences made it a habit...) : $ ulimit -u 2500 $ ./mypotentiallydeadlyprogram This way, I put a 2500 processes limit on my current shell. Thanks to this, my fork calls will end up failing if they ...


5

There are several uses for cgroups. From the system administration probably the most important one is limiting resources - the classical example here being is the cpu access. If you create a group for e.g. sshd and give it some non-negligible CPU time share (compared to other groups or the default under which fall all unsorted processes), you are guaranteed ...


4

The time slice used will matter for CPU intensive jobs that require cache persistency, unless you lock a particular core to each PID. You can increase the time slice with schedular policy SCHED_BATCH and improve performance up to 300% in some cases, while reducing interactive responsiveness. The opposite effect of smaller time slices occurs with SCHED_RR (...


4

Well, for the CPU affinity bit, that's usually intended to solve a different set of problems that pertain to the physical CPU's that are executing the program. That's why you have to specify which particular CPU's you're talking about with CPU affinity. From the fact that you don't care which CPU's get used, I'm guessing you're just trying to get time ...


4

Someone suggested in your hear cgroups. Well, try to seek that direction as it can provide you with: applied to a group of task you choose (thus not system wide but neither per process) the limits are set for the group the limits are static they can enforce hard limit on memory and/or memory+swap Something like that could bring you closer to your goals: ...


4

You're looking in the wrong place, because this isn't really to do with the mount command itself. What you're doing is mounting a special filesystem, in this case, a cgroups hierarchy, and the options happen to be how you attach different cgroup subsystems like cpu or memory. Red Hat* has some good documentation on cgroups in general and the mount options ...


4

You don't need to be root to start a user-scoped group with systemd-run: $ systemd-run --user --scope /bin/bash Running scope as unit run-23318.scope. $ sleep 999 & [1] 23369 You can see the unit: $ systemctl --user status run-23318.scope * run-23318.scope - /bin/bash Loaded: loaded (/run/user/1000/systemd/user/run-23318.scope; static; ...


3

There has been no release of iptables with cgroup support so far. Latest iptables is 1.4.21, which was released back in Nov 2013 (afaik). Cgroups support was added later, and never released officially. That's probably the reason there is no new iptables in vast majority of distributives (including e.g. Arch).


3

The problem here is that you need to use the fair scheduler, I was using the wrong scheduler, and had mis-read a setting (thought I was using fair scheduler, but really wasn't). Swapping to the correct IO scheduler fixed the problem. To change the IO scheduler (taken from here): echo cfq > /sys/block/{DEVICE-NAME}/queue/scheduler


3

A big thanks to Red Hat, I finally tracked down the reference documentation I was looking for in their documentation. I expect that there's no difference between Red Hat and other distros on this point. https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Resource_Management_Guide/ch-Subsystems_and_Tunable_Parameters.html


3

you could limt memory usege with /etc/security/limits.conf in this file you put : domain type item value where the domain is the @groupname, type is hard or soft where hard is limt that cannot be exceeded under any circumstances. item is the item field specifies what type of item is being limited. Examples ‚Äč include core (the size of core files), data (...


3

Remember how I said: The system uses lxc containers for compartmentalisation, but that shouldn't matter here. Well, turns out it did matter. Or rather, the cgroups at the heart of lxc matter. The host machine only sees reboots for kernel upgrades. So, what were the last kernels used? 3.19, replaced by 4.0.5 2 months ago and yesterday with 4.1.3. And ...


2

Blkio in cgroup terminology stands for access to I/O on block devices. It does not seem to be about regulating all the different ways software developers have at hand for I/O-related purposes. It seems to be targeted mainly to I/O on devices, not on the way software has access to devices. It can limit the number of iops, the bandwidth or a weight with ...


2

You can run your command(s) via systemd-run --scope. This creates a transient (ie temporary) cgroup for your command. You can then modify the cgroup to your needs. Use systemd-cgls to find your process in the cgroup hierarchy under /sys/fs/cgroup. According to the systemd-run manpage systemd-run may be used to create and start a transient .service or a ...


2

You may need to specify a specific lifetime for your group; you may want it on after computer startup and deleted after shutdown. So it's not a bad idea to add it to your /etc/rc scripts .


2

cgroups is still quite in flux in the Linux kernel. Probably the best documentation is LWN's coverage, perhaps H-online or Kernelnewbies have something to say. Currently systemd is the most prolific user.


2

Check out net_cls cgroup controller. It basically attaches special tag (defined in /mntpoint/net_cls.classid to each packet that originates on socket associated with an application in that cgroup. You can later use this 'tag' as classid in the filter attached to the qdisc to pass the traffic to different classes based on the cgroup the traffic comes from. ...


2

Adding a whitelist rule through lxc-cgroup is not persistent, in testing my LXC containers I reset the container at some point and did not re-add the rule. The device node is created in the container correctly even without lxc white-listing (c *:* m is a default lxc rule) but the lxc container is denied access to the device when it tries to use it, without ...


2

Cgroups are hierarhical and they are inherited by all subprocesses. So all processes must be in some cgroup. By default it's the root cgroup and by default it has 1024 shares which is twice as A and B in Your example. CPU time is shared betwean cgroups according to weight assigned to them in cpu.shares. If A had 1024 shares and B 512 and C 256 and D 256, ...


2

You recompile your kernel with CONFIG_CFS_BANDWIDTH=y. There is a feature request about this already.


2

1) A multi-threaded process has a single line in ps aux output, when each thread is a task. Compare ps -auxH | wc -l


2

Because Vagrant by default edits the sudoers file to give itself sudo privileges without requiring a password. Look at the file /etc/sudoers.d/vagrant and you'll see a line like: vagrant ALL=(ALL) NOPASSWD:ALL You can give your user1 the same privileges by doing sudoedit /etc/sudoers and adding the line: user1 ALL=(ALL) NOPASSWD:ALL Note: you must use ...


1

Did you try the man pages? Both cgconfig.conf(5) and cgrules.conf(5) have nice examples, it shouldn't be difficult modifying those to match your needs. You will probably want to start from something like (be warned I have not tested it): In /etc/cgrules.conf: root:sshd * sshdcg/ * * default/ and /etc/...


1

Arch Linux' kernel has the swap accounting disabled by default (cf. the kernel config file). You can enable it by booting with swapaccount=1 in your kernel cmdline (cf. the kernels Kconfig documentation.


1

I came up with a systemtap script which is close to what I wanted to do, but it does not track writes. The code is on a gist: https://gist.github.com/Martiusweb/10633360



Only top voted, non community-wiki answers of a minimum length are eligible