<div dir="ltr"> <div>Create the cgroups *through systemd*, by creating .slice units for that purpose.</div><div><br></div><div>You can either create individual slices for each user, or you can enable Delegate= on a slice and then systemd will allow you to manage your own sub-cgroups inside.</div> </div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, May 5, 2023 at 10:16 AM jaimin bhaduri <<a href="mailto:jaimin@webuzo.com">jaimin@webuzo.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">I created a cgroup named mycgroup using 'mkdir /sys/fs/cgroup/mycgroup'.<div>'ls /sys/fs/cgroup/mycgroup' shows only memory and pid files. The io and cpu files were missing.</div><div><br></div><div>They are visible after I execute 'echo +cpu +io > /sys/fs/cgroup/cgroup.subtree_control'.</div><div><br></div><div>But 'systemctl daemon-reload' again deletes the cpu and io files.</div><div>Executing 'echo +cpu +io > /sys/fs/cgroup/cgroup.subtree_control' again brings the files back but the values of cpu.max and io.max files are now reset to default.<br></div><div><br></div><div>This happens to all the cgroups I create.</div><div>How do I enable cpu, io, memory, pids for the entire cgroups directory so that daemon reload or any other event does not delete those files for any of my created cgroup?</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, May 2, 2023 at 12:54 PM jaimin bhaduri <<a href="mailto:jaimin@webuzo.com" target="_blank">jaimin@webuzo.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Ok I am understanding.<div><br></div><div>Using php, I created cgroups for every user with their username in /sys/fs/cgroup and set values in their cpu.max, memory.high, memory.high, pids.max, etc.</div><div>I made the below service file where I am moving pids of users to their cgroups. For example, pids of user5 will be appended to /sys/fs/cgroup/user5/cgroup.procs.</div><div>I am doing this for all users in loop after every 5 seconds as per the below configuration.<br><div><br></div><div><u>Content of /etc/systemd/system/cgroups.service:</u></div><div><b>[Unit]<br>Description=Move processes of user to cgroup<br><br>[Service]<br>Type=simple<br>User=root<br>ExecStart=/bin/bash -c 'while true; do <br>pgrep -u user1 | grep -vxFf /sys/fs/cgroup/user1/cgroup.procs | xargs -I{} sh -c "echo {} >> /sys/fs/cgroup/user1/cgroup.procs";<br>pgrep -u user2 | grep -vxFf /sys/fs/cgroup/user2/cgroup.procs | xargs -I{} sh -c "echo {} >> /sys/fs/cgroup/user2/cgroup.procs";<br>pgrep -u user3 | grep -vxFf /sys/fs/cgroup/user3/cgroup.procs | xargs -I{} sh -c "echo {} >> /sys/fs/cgroup/user3/cgroup.procs";<br>pgrep -u user4 | grep -vxFf /sys/fs/cgroup/user4/cgroup.procs | xargs -I{} sh -c "echo {} >> /sys/fs/cgroup/user4/cgroup.procs";<br>pgrep -u user5 | grep -vxFf /sys/fs/cgroup/user5/cgroup.procs | xargs -I{} sh -c "echo {} >> /sys/fs/cgroup/user5/cgroup.procs";<br>sleep 5; done'<br><br>[Install]<br>WantedBy=multi-user.target</b><br></div><div><b><br></b></div><div>This solution is working. But is this a good way to enforce resource limits on users? There can be more than 100 users also in some cases.</div><div><br></div><div><b><br></b></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Apr 25, 2023 at 9:33 AM Mantas Mikulėnas <<a href="mailto:grawity@gmail.com" target="_blank">grawity@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="auto"><div><br><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Apr 25, 2023, 06:44 jaimin bhaduri <<a href="mailto:jaimin@webuzo.com" target="_blank">jaimin@webuzo.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><b>/etc/systemd/system/user-1000.slice.d/override.conf:<br></b>[Unit]<br>Description=User Slice for UID 1000<br><br>[Slice]<br>CPUAccounting=1<br>MemoryAccounting=1<br>IOAccounting=1<br>TasksAccounting=1<br>CPUQuota=55%<br>MemoryMax=<br>MemoryHigh=1G<br>IOReadBandwidthMax=<br>IOWriteBandwidthMax=<br>IOReadIOPSMax=<br>IOWriteIOPSMax=<br>TasksMax=100<br><br>[Install]<br>WantedBy=multi-user.target<br><div><br></div><div><b>/etc/system/user/aa.service:</b></div><div>[Unit]<br>Description=Resource limits for user aa<br><br>[Service]<br>Slice=user-1000.slice<br>Environment=USER_UID=1000<br>User=%i<br>WorkingDirectory=%h<br>Type=simple<br>ExecStart=/bin/bash -c 'echo "User %EUID %USER_UID" && sudo -u \#$USER_UID $SHELL'<br>Restart=always<br>RestartSec=10<br><br>[Install]<br>WantedBy=default.target<br></div><div><br></div><div><br></div><div>I made the above mentioned override.conf(slice file) and aa.service file for the user named 'aa'.</div><div>Then I executed 'systemctl --user enable aa.service', 'systemctl --user daemon-reload' and 'systemctl daemon-reload'.</div><div>From user's terminal I executed 'stress -c 1'. In the root terminal, I saw the cpulimit did not exceed 55% using 'top' command.</div><div>But from root's terminal doing su aa, the cpu usage was 100%.</div><div><b>What mistake am I doing? Is there some syntax or coding error in my service file?</b></div></div></blockquote></div></div><div dir="auto"><br></div><div dir="auto">Doing `su aa` doesn't start aa.service! I don't know where you got the idea that it would. Users aren't services.</div><div dir="auto"><br></div><div dir="auto"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>There may be cronjobs of that user which may get executed at night 12 am.</div></div></blockquote></div></div><div dir="auto"><br></div><div dir="auto">Cron calls pam_systemd, so it should be fine.</div><div dir="auto"><br></div><div dir="auto"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Or there may be scheduled backups of that user which may run every month/week at some particular time using php script.</div></div></blockquote></div></div><div dir="auto"><br></div><div dir="auto">Why is *that* not a cronjob, or even a service?</div><div dir="auto"><br></div><div dir="auto"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>I just want the user's processes to follow the resource limits that are set in the slice file no matter how and where they start from or no matter if that user is logged in or not.<br></div></div></blockquote></div></div><div dir="auto"><br></div><div dir="auto">There is no nice way to achieve this. If a process isn't in the cgroup then it just isn't in the cgroup – something has to *deliberately* move it into that cgroup for its limits to apply.</div><div dir="auto"><br></div><div dir="auto">The kernel has no such functionality built in, as far as I know. Processes deliberately stay in the cgroup they were spawned in, so that they couldn't *escape* limits.</div><div dir="auto"><br></div><div dir="auto">Maybe check if there is some external daemon (cgmanager, maybe?) that would scan all newly created processes and would move them to the desired cgroup as quick as it can.</div><div dir="auto"><br></div><div dir="auto"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div></div><div>I am new to this. Please some help.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Apr 24, 2023 at 11:54 AM Mantas Mikulėnas <<a href="mailto:grawity@gmail.com" rel="noreferrer" target="_blank">grawity@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Apr 24, 2023 at 7:04 AM jaimin bhaduri <<a href="mailto:jaimin@webuzo.com" rel="noreferrer" target="_blank">jaimin@webuzo.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Cgroups v2 is enabled in almalinux 9.1 with 5.14.0-70.22.1.el9_0.x86_64 kernel and systemd 250 (250-12.el9_1.3).<div><br><div>Content of /etc/systemd/system/user-1002.slice.d/override.conf:<div><b>[Unit]<br>Description=User Slice for UID 1002<br><br>[Slice]<br>CPUAccounting=1<br>MemoryAccounting=1<br>IOAccounting=1<br>TasksAccounting=1<br>CPUQuota=70%<br>MemoryMax=1G<br>MemoryHigh=1G<br>IOReadBandwidthMax=/ 1G<br>IOWriteBandwidthMax=/ 1G<br>IOReadIOPSMax=/ 1000<br>IOWriteIOPSMax=/ 1000<br>TasksMax=200<br><br>[Install]<br>WantedBy=multi-user.target</b><br></div></div></div><div><b><br></b></div><div>I execute systemctl daemon-reload after saving the slice file.</div><div>Every value is getting enforced for the user when I test them by running some commands from the user's terminal.</div><div>But they dont work after I run the same commands from the root's terminal after doing su to that user.</div><div>They also dont work when a user's process is started from a php script using putenv('user_uid');.</div><div>How do I make them work for all the user's processes no matter how they start?</div></div></blockquote><div><br></div><div>Using cgroup-based limits means that something needs to actually *move* the process into the appropriate cgroup. (They are not uid-based limits!)<br></div><div><br></div><div>As php-fpm does not support cgroup management on its own, you might need to run multiple instances of php-fpm@.service (not just multiple pools in the same instance), each instance specifying "Slice=user-%i.slice" similar to how user@.service does it.</div><div><br></div><div>For `su`, you would need to configure its PAM stack to invoke pam_systemd, but this is usually *deliberately* not done, as doing so would cause other issues, especially for scripts that use `su` for non-interactive purposes. (Besides that, systemd-logind does not allow creating a new session from within another one, so the only time `su` would be allowed to do this is exactly the time when it would be undesirable...)<br></div><div><br></div><div>Instead, `machinectl shell foo@` or `systemd-run --user -M foo@.host --pty ...` could be used if you need to manually run something as another user (but as soon you need to do it twice, you should just make a .service with Slice=, or even a --user service).<br></div></div><br><span>-- </span><br><div dir="ltr"><div dir="ltr">Mantas Mikulėnas</div></div></div> </blockquote></div> </blockquote></div></div></div> </blockquote></div> </blockquote></div> </blockquote></div><br clear="all"><br><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature"><div dir="ltr">Mantas Mikulėnas</div></div>