Re: [RFC] rlimit exceed notification events
From: Jiri Olsa
Date: Wed Aug 24 2016 - 07:24:36 EST
On Fri, Aug 19, 2016 at 05:41:20PM +0300, Yauheni Kaliuta wrote:
> At the moment there is no clear indication if a process exceeds resource
> limit. In some cases the problematic syscall can return a error, in some cases
> the process can be just killed.
> I'm trying to implement some sort of monitoring of such events and have a
> question, what way would be acceptable.
> 1) The straight forward solution would be to instrument every such a place with
> a printk (something related implemented, for example, by
> It has some concerns about reliablity and performance (giving a way to flood
> printk buffer because of bad application, for example).
> 2) Using tracepoints. I've used a simple program, which dup()s until gets the
> error 3 times:
just to start up the discussion.. ;-)
I'd think this one (2) is the proper way, but generaly you need to
come with good justification/usecase to add new tracepoint
also rlimit seems to be difficult to add tracepoints to,
because the checks are spread all over the code..
can't think of a good solution ATM
> $ sudo ./perf record -e rlimit:rlimit_exceeded ./a.out
> Couldn't dup file: Too many open files, iteration 1020
> Couldn't dup file: Too many open files, iteration 1021
> Couldn't dup file: Too many open files, iteration 1022
> [ perf record: Woken up 1 times to write data ]
> [ perf record: Captured and wrote 0.010 MB perf.data (3 samples) ]
> $ sudo ./perf report
> # To display the perf.data header info, please use --header/--header-only options.
> # Total Lost Samples: 0
> # Samples: 3 of event 'rlimit:rlimit_exceeded'
> # Event count (approx.): 3
> # Overhead Trace output
> # ........ ........................................................
> 100.00% RLIMIT NOFILE violation. Current 1024, requested Unknown
> The code to demonstrate the idea below:
> diff --git a/fs/file.c b/fs/file.c
> index 6b1acdfe59da..a358de041ac4 100644
> --- a/fs/file.c
> +++ b/fs/file.c
> @@ -947,6 +947,9 @@ SYSCALL_DEFINE1(dup, unsigned int, fildes)
> + if (ret == -EMFILE)
> + rlimit_exceeded(RLIMIT_NOFILE,
> + rlimit(RLIMIT_NOFILE), (u64)-1);
> return ret;
how about other places? alloc_fd/get_unused_fd_flags/replace_fd..