Tag Info

Hot answers tagged

8

I've gotten an initial explanation about this test case from Stefan Seyfried, who wrote the paper this example was taken from. The problem here is that the CPU scheduler parts of cgroups always aims to keep any available CPU busy; it doesn't ever enforce a hard limit if everything will fit at once. In the case where two processes (high and low here) are ...


6

The easiest way is using systemd which may be responsible for your sshd anyway (depending on the distribution). You can easily configure the limits in the sshd unit file. systemd puts all services in separate cgroups anyway. Without systemd the easiest solution is probably a modification to the sshd start script (pay attention that it's not overwritten by ...


4

From the kernel documentation concerning memory.swappiness: 5.3 swappiness Similar to /proc/sys/vm/swappiness, but affecting a hierarchy of groups only. Following cgroups' swappiness can't be changed. - root cgroup (uses /proc/sys/vm/swappiness). - a cgroup which uses hierarchy and it has other cgroup(s) below it. - a cgroup which ...


4

Well, for the CPU affinity bit, that's usually intended to solve a different set of problems that pertain to the physical CPU's that are executing the program. That's why you have to specify which particular CPU's you're talking about with CPU affinity. From the fact that you don't care which CPU's get used, I'm guessing you're just trying to get time ...


4

The time slice used will matter for CPU intensive jobs that require cache persistency, unless you lock a particular core to each PID. You can increase the time slice with schedular policy SCHED_BATCH and improve performance up to 300% in some cases, while reducing interactive responsiveness. The opposite effect of smaller time slices occurs with SCHED_RR ...


4

Someone suggested in your hear cgroups. Well, try to seek that direction as it can provide you with: applied to a group of task you choose (thus not system wide but neither per process) the limits are set for the group the limits are static they can enforce hard limit on memory and/or memory+swap Something like that could bring you closer to your goals: ...


3

There are several uses for cgroups. From the system administration probably the most important one is limiting resources - the classical example here being is the cpu access. If you create a group for e.g. sshd and give it some non-negligible CPU time share (compared to other groups or the default under which fall all unsorted processes), you are guaranteed ...


2

You may need to specify a specific lifetime for your group; you may want it on after computer startup and deleted after shutdown. So it's not a bad idea to add it to your /etc/rc scripts .


2

A big thanks to Red Hat, I finally tracked down the reference documentation I was looking for in their documentation. I expect that there's no difference between Red Hat and other distros on this point. https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/html/Resource_Management_Guide/ch-Subsystems_and_Tunable_Parameters.html


2

cgroups is still quite in flux in the Linux kernel. Probably the best documentation is LWN's coverage, perhaps H-online or Kernelnewbies have something to say. Currently systemd is the most prolific user.


2

As far as I'm concerned, I think cgroups would be overkill here. However, I tend to use ulimit whenever I run something witk a fork system call in it (bad experiences made it a habit...) : $ ulimit -u 2500 $ ./mypotentiallydeadlyprogram This way, I put a 2500 processes limit on my current shell. Thanks to this, my fork calls will end up failing if they ...


1

There is a system.conf configuration option, DefaultControllers, that controls which cgroup hierarchies are attached to. By default it's cpu. I set it to null and /proc/$$$/cgroup no longer lists the getty process under cpuacct,cpu, and the test program works. Why the same configuration file -- I was using the default which is in use on both systems -- ...


1

Exactly what aren't they supposed to "escape" from? You might want to take a look at chroot and jails (Darwin is a BSD derivative, so this last BSDism might be available). Be careful, really putting a process in a cage it can't escape from is not trivial.


1

Arch Linux' kernel has the swap accounting disabled by default (cf. the kernel config file). You can enable it by booting with swapaccount=1 in your kernel cmdline (cf. the kernels Kconfig documentation.


1

Adding a whitelist rule through lxc-cgroup is not persistent, in testing my LXC containers I reset the container at some point and did not re-add the rule. The device node is created in the container correctly even without lxc white-listing (c *:* m is a default lxc rule) but the lxc container is denied access to the device when it tries to use it, without ...


1

I came up with a systemtap script which is close to what I wanted to do, but it does not track writes. The code is on a gist: https://gist.github.com/Martiusweb/10633360


1

If each process has its own core then there's no priority constraints. However, if you schedule a process which takes 30 minutes to run every 15 minutes, you will start to have a need to prioritize as the process will start overlapping. There's no "best" scheduling policy however. They really depend on what you want to achieve. But in the beginning, I ...


1

you could limt memory usege with /etc/security/limits.conf in this file you put : domain type item value where the domain is the @groupname, type is hard or soft where hard is limt that cannot be exceeded under any circumstances. item is the item field specifies what type of item is being limited. Examples ‚Äč include core (the size of core files), data ...


1

Blkio in cgroup terminology stands for access to I/O on block devices. It does not seem to be about regulating all the different ways software developers have at hand for I/O-related purposes. It seems to be targeted mainly to I/O on devices, not on the way software has access to devices. It can limit the number of iops, the bandwidth or a weight with ...


1

Under Ubuntu, another way of jailing is apparmor! It is a path based mandatory access control (MAC) Linux Security Module (LSM). In Ubuntu 10.04 it is enabled by default for selected services. The documentation is quite fragmented. The Ubuntu documentation could be ... better. Even the upstream documentation does not give a good introduction. The reference ...


1

There is another way to jail it down: iptables using the owner match extension! With iptables it is possible to block outgoing (OUTPUT) network traffic by all processes of the slave-user. This is very easy to setup, i.e. it is convenient. That means that with this easy setup you can jail your slave-process from filesystem locations and the network. $ ...


1

Check out net_cls cgroup controller. It basically attaches special tag (defined in /mntpoint/net_cls.classid to each packet that originates on socket associated with an application in that cgroup. You can later use this 'tag' as classid in the filter attached to the qdisc to pass the traffic to different classes based on the cgroup the traffic comes from. ...



Only top voted, non community-wiki answers of a minimum length are eligible