Re: [RFC] rlimit exceed notification events

[Jiri Olsa]

On Fri, Aug 19, 2016 at 05:41:20PM +0300, Yauheni Kaliuta wrote:
> Hi!
> 
> At the moment there is no clear indication if a process exceeds resource
> limit. In some cases the problematic syscall can return a error, in some cases
> the process can be just killed.
> 
> I'm trying to implement some sort of monitoring of such events and have a
> question, what way would be acceptable.

> 
> 1) The straight forward solution would be to instrument every such a place with
> a printk (something related implemented, for example, by
> d977d56ce5b3e8842236f2f9e7483d4914c9592e).
> 
> It has some concerns about reliablity and performance (giving a way to flood
> printk buffer because of bad application, for example).
> 
> 2) Using tracepoints. I've used a simple program, which dup()s until gets the
> error 3 times:

just to start up the discussion.. ;-)

I'd think this one (2) is the proper way, but generaly you need to
come with good justification/usecase to add new tracepoint

also rlimit seems to be difficult to add tracepoints to,
because the checks are spread all over the code.. 

can't think of a good solution ATM

> $ sudo ./perf record -e rlimit:rlimit_exceeded ./a.out
> Couldn't dup file: Too many open files, iteration 1020
> Couldn't dup file: Too many open files, iteration 1021
> Couldn't dup file: Too many open files, iteration 1022
> [ perf record: Woken up 1 times to write data ]
> [ perf record: Captured and wrote 0.010 MB perf.data (3 samples) ]
> 
> $ sudo ./perf report                                  
> # To display the perf.data header info, please use --header/--header-only options.
> #
> #
> # Total Lost Samples: 0
> #
> # Samples: 3  of event 'rlimit:rlimit_exceeded'
> # Event count (approx.): 3
> #
> # Overhead  Trace output                                            
> # ........  ........................................................
> #
>    100.00%  RLIMIT NOFILE violation. Current 1024, requested Unknown
> 
> The code to demonstrate the idea below:
> 
> diff --git a/fs/file.c b/fs/file.c
> index 6b1acdfe59da..a358de041ac4 100644
> --- a/fs/file.c
> +++ b/fs/file.c
> @@ -947,6 +947,9 @@ SYSCALL_DEFINE1(dup, unsigned int, fildes)
>  		else
>  			fput(file);
>  	}
> +	if (ret == -EMFILE)
> +		rlimit_exceeded(RLIMIT_NOFILE,
> +				rlimit(RLIMIT_NOFILE), (u64)-1);
>  	return ret;

how about other places? alloc_fd/get_unused_fd_flags/replace_fd..

jirka