Hot answers tagged

10

I've gotten an initial explanation about this test case from Stefan Seyfried, who wrote the paper this example was taken from. The problem here is that the CPU scheduler parts of cgroups always aims to keep any available CPU busy; it doesn't ever enforce a hard limit if everything will fit at once. In the case where two processes (high and low here) are ...


7

A better and safer solution is to install cgmanager and run it with systemctl start cgmanager (on a systemd-based distro). You can than have your root user, or if you have sudo rights on the host create cgroups for your unprivileged user in all controllers with: sudo cgm create all $USER sudo cgm chown all $USER $(id -u $USER) $(id -g $USER) Once they ...


6

From the kernel documentation concerning memory.swappiness: 5.3 swappiness Similar to /proc/sys/vm/swappiness, but affecting a hierarchy of groups only. Following cgroups' swappiness can't be changed. - root cgroup (uses /proc/sys/vm/swappiness). - a cgroup which uses hierarchy and it has other cgroup(s) below it. - a cgroup which ...


6

The easiest way is using systemd which may be responsible for your sshd anyway (depending on the distribution). You can easily configure the limits in the sshd unit file. systemd puts all services in separate cgroups anyway. Without systemd the easiest solution is probably a modification to the sshd start script (pay attention that it's not overwritten by ...


6

Since posting this question I have studied the entire guide that I linked to above, as well as the majority of the cgroups.txt documentation and cpusets.txt. I now know more than I ever expected to learn about cgroups, so I'll answer my own question here. There are multiple approaches you can take. Our company's contact at Red Hat (a Technical Architect) ...


5

As far as I'm concerned, I think cgroups would be overkill here. However, I tend to use ulimit whenever I run something witk a fork system call in it (bad experiences made it a habit...) : $ ulimit -u 2500 $ ./mypotentiallydeadlyprogram This way, I put a 2500 processes limit on my current shell. Thanks to this, my fork calls will end up failing if they ...


4

Well, for the CPU affinity bit, that's usually intended to solve a different set of problems that pertain to the physical CPU's that are executing the program. That's why you have to specify which particular CPU's you're talking about with CPU affinity. From the fact that you don't care which CPU's get used, I'm guessing you're just trying to get time ...


4

There are several uses for cgroups. From the system administration probably the most important one is limiting resources - the classical example here being is the cpu access. If you create a group for e.g. sshd and give it some non-negligible CPU time share (compared to other groups or the default under which fall all unsorted processes), you are guaranteed ...


4

Someone suggested in your hear cgroups. Well, try to seek that direction as it can provide you with: applied to a group of task you choose (thus not system wide but neither per process) the limits are set for the group the limits are static they can enforce hard limit on memory and/or memory+swap Something like that could bring you closer to your goals: ...


4

The time slice used will matter for CPU intensive jobs that require cache persistency, unless you lock a particular core to each PID. You can increase the time slice with schedular policy SCHED_BATCH and improve performance up to 300% in some cases, while reducing interactive responsiveness. The opposite effect of smaller time slices occurs with SCHED_RR ...


3

you could limt memory usege with /etc/security/limits.conf in this file you put : domain type item value where the domain is the @groupname, type is hard or soft where hard is limt that cannot be exceeded under any circumstances. item is the item field specifies what type of item is being limited. Examples ‚Äč include core (the size of core files), data ...


3

A big thanks to Red Hat, I finally tracked down the reference documentation I was looking for in their documentation. I expect that there's no difference between Red Hat and other distros on this point. https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Resource_Management_Guide/ch-Subsystems_and_Tunable_Parameters.html


3

The problem here is that you need to use the fair scheduler, I was using the wrong scheduler, and had mis-read a setting (thought I was using fair scheduler, but really wasn't). Swapping to the correct IO scheduler fixed the problem. To change the IO scheduler (taken from here): echo cfq > /sys/block/{DEVICE-NAME}/queue/scheduler


3

Remember how I said: The system uses lxc containers for compartmentalisation, but that shouldn't matter here. Well, turns out it did matter. Or rather, the cgroups at the heart of lxc matter. The host machine only sees reboots for kernel upgrades. So, what were the last kernels used? 3.19, replaced by 4.0.5 2 months ago and yesterday with 4.1.3. And ...


3

There has been no release of iptables with cgroup support so far. Latest iptables is 1.4.21, which was released back in Nov 2013 (afaik). Cgroups support was added later, and never released officially. That's probably the reason there is no new iptables in vast majority of distributives (including e.g. Arch).


2

You recompile your kernel with CONFIG_CFS_BANDWIDTH=y. There is a feature request about this already.


2

Blkio in cgroup terminology stands for access to I/O on block devices. It does not seem to be about regulating all the different ways software developers have at hand for I/O-related purposes. It seems to be targeted mainly to I/O on devices, not on the way software has access to devices. It can limit the number of iops, the bandwidth or a weight with ...


2

cgroups is still quite in flux in the Linux kernel. Probably the best documentation is LWN's coverage, perhaps H-online or Kernelnewbies have something to say. Currently systemd is the most prolific user.


2

Check out net_cls cgroup controller. It basically attaches special tag (defined in /mntpoint/net_cls.classid to each packet that originates on socket associated with an application in that cgroup. You can later use this 'tag' as classid in the filter attached to the qdisc to pass the traffic to different classes based on the cgroup the traffic comes from. ...


2

You may need to specify a specific lifetime for your group; you may want it on after computer startup and deleted after shutdown. So it's not a bad idea to add it to your /etc/rc scripts .


2

You can run your command(s) via systemd-run --scope. This creates a transient (ie temporary) cgroup for your command. You can then modify the cgroup to your needs. Use systemd-cgls to find your process in the cgroup hierarchy under /sys/fs/cgroup. According to the systemd-run manpage systemd-run may be used to create and start a transient .service or a ...


2

1) A multi-threaded process has a single line in ps aux output, when each thread is a task. Compare ps -auxH | wc -l


2

Because Vagrant by default edits the sudoers file to give itself sudo privileges without requiring a password. Look at the file /etc/sudoers.d/vagrant and you'll see a line like: vagrant ALL=(ALL) NOPASSWD:ALL You can give your user1 the same privileges by doing sudoedit /etc/sudoers and adding the line: user1 ALL=(ALL) NOPASSWD:ALL Note: you must use ...


1

It's a feature of the cgroup filesystem, not a feature of the mkdir command. The mkdir command just invokes the mkdir system call. The mkdir system call invokes the VFS layer in the kernel, which performs some analysis on the command and in particular determines on what filesystem the directory is to be created by analyzing the hierarchy of mount points in ...


1

/etc/cgconfig.conf contains information about your control groups. There isn't any useful default content. So the package doesn't come with a configuration file in /etc. You seem to be using a Debian-based distribution. There is a sample configuration file in /usr/share/doc/cgroup-tools/examples/cgconfig.conf (containing only comments with examples). You ...


1

I got a solution in ServerFault systemctl set-property user-1000.slice CPUShares=100


1

Something more basic: start sshd on a specific port with a very low nice level, which might help. # nice -20 /usr/sbin/sshd -p 2222 IF the problem is due to DOS throttling the network, then you have to use network-shaping rules outside the box (ie, on the switch).


1

There is another way to jail it down: iptables using the owner match extension! With iptables it is possible to block outgoing (OUTPUT) network traffic by all processes of the slave-user. This is very easy to setup, i.e. it is convenient. That means that with this easy setup you can jail your slave-process from filesystem locations and the network. $ ...


1

Under Ubuntu, another way of jailing is apparmor! It is a path based mandatory access control (MAC) Linux Security Module (LSM). In Ubuntu 10.04 it is enabled by default for selected services. The documentation is quite fragmented. The Ubuntu documentation could be ... better. Even the upstream documentation does not give a good introduction. The reference ...


1

I'm guessing there is something wrong with your /etc/cgconfig.conf file. This setup works for me: [root@localhost cgroup]# cat /etc/cgconfig.conf mount { memory = /cgroup/memory; } [root@localhost cgroup]# service cgconfig start Starting cgconfig service: [ OK ] [root@localhost cgroup]# ls memory [root@localhost ...



Only top voted, non community-wiki answers of a minimum length are eligible