The resource controls facility is configured through the project database. See About Projects and Tasks. Resource controls and other attributes are set in the final field of the project database entry. The values associated with each resource control are enclosed in parentheses, and appear as plain text separated by commas. The values in parentheses constitute an action clause. Each action clause is composed of a privilege level, a threshold value, and an action that is associated with the particular threshold. Each resource control can have multiple action clauses, which are also separated by commas.
The following entry defines a per-task lightweight process limit and a per-process maximum CPU time limit on a project entity. The process.max-cpu-time value would send a process a SIGTERM after the process ran for 1 hour, and a SIGKILL if the process continued to run for a total of 1 hour and 1 minute. See Figure 3, Table 3, Signals Available to Resource Control Values.
Typed as one line: development:101:Developers:::task.max-lwps=(privileged,10,deny); process.max-cpu-time=(basic,3600,signal=TERM),(priv,3660,signal=KILL)
The rctladm command allows you to make runtime interrogations of and modifications to the resource controls facility, with global scope. The prctl command allows you to make runtime interrogations of and modifications to the resource controls facility, with local scope.
For more information, see Global and Local Actions on Resource Control Values and the rctladm(8) and prctl(1) man pages.
The table describes the resource that is constrained by each control. The table also identifies the default units that are used by the project database for that resource. The default units are of two types:
Quantities represent a limited amount.
Indexes represent a maximum valid identifier.
Thus, project.cpu-shares resource control specifies the number of shares to which the project is entitled. The process.max-file-descriptor resource control specifies the highest file number that can be assigned to a process by the open system call.
You can display the default values for resource controls on a system that does not have any resource controls set or changed. Such a system contains no non-default entries in the /etc/system file or the project database. To display values, use the prctl command.
Zone-wide resource controls limit the total resource usage of all process entities within a zone. Zone-wide resource controls can also be set using global property names as described in Configurable Resource Types and Global Properties in Oracle Solaris Zones Configuration Resources.
For information about configuring zone-wide resource controls, see Configuring Resource Controls and Attributes and Setting Zone-Wide Resource Controls in Oracle Solaris Zones Configuration Resources.
Note that it is possible to apply a zone-wide resource control to the global zone.
Global flags that identify resource control types are defined for all resource controls. The flags are used by the system to communicate basic type information to applications such as the prctl command. Applications use the information to determine the following:
The unit strings that are appropriate for each resource control
The correct scale to use when interpreting scaled values
The following global flags are available:
Resource control type string: bytes
Resource control type string: seconds
Resource control type string: count
Scaled values can be used with resource controls. The following example shows a scaled threshold value:
Basic, which can be modified by the owner of the calling process
Privileged, which can be modified only by privileged (root) callers
System, which is fixed for the duration of the operating system instance
A resource control is guaranteed to have one system value, which is defined by the system, or resource provider. The system value represents how much of the resource the current implementation of the operating system is capable of providing.
Any number of privileged values can be defined, and only one basic value is allowed. Operations that are performed without specifying a privilege value are assigned a basic privilege by default.
The privilege level for a resource control value is defined in the privilege field of the resource control block as RCTL_BASIC, RCTL_PRIVILEGED, or RCTL_SYSTEM. See the setrctl(2) man page for more information. You can use the prctl command to modify values that are associated with basic and privileged levels.
Global actions apply to resource control values for every resource control on the system. You can use the rctladm command described in the rctladm(8) man page to perform the following actions:
Display the global state of active system resource controls
Set global logging actions
You can disable or enable the global logging action on resource controls. You can set the syslog action to a specific degree by assigning a severity level, syslog=level. The possible settings for level are as follows:
By default, there is no global logging of resource control violations. The level n/a indicates resource controls on which no global action can be configured.
Local actions are taken on a process that attempts to exceed the control value. For each threshold value that is placed on a resource control, you can associate one or more actions. There are three types of local actions: deny, none, and signal=. These three actions are used as follows:
You can deny resource requests for an amount that is greater than the threshold. For example, a task.max-lwps resource control with action deny causes a fork system call to fail if the new process would exceed the control value. See the fork(2) man page.
No action is taken on resource requests for an amount that is greater than the threshold. This action is useful for monitoring resource usage without affecting the progress of applications. You can also enable a global message that displays when the resource control is exceeded, although the process exceeding the threshold is not affected.
You can enable a global signal message action when the resource control is exceeded. A signal is sent to the process when the threshold value is exceeded. Additional signals are not sent if the process consumes additional resources. Available signals are listed in Figure 3, Table 3, Signals Available to Resource Control Values.
Not all of the actions can be applied to every resource control. For example, a process cannot exceed the number of CPU shares assigned to the project of which it is a member. Therefore, a deny action is not allowed on the project.cpu-shares resource control.
Due to implementation restrictions, the global properties of each control can restrict the range of available actions that can be set on the threshold value. (See the rctladm(8) man page.) A list of available signal actions is presented in the following table. For additional information about signals, see the signal(3HEAD) man page.
Each resource control on the system has a certain set of associated properties. This set of properties is defined as a set of flags, which are associated with all controlled instances of that resource. Global flags cannot be modified, but the flags can be retrieved by using either rctladm or the getrctl system call.
Local flags define the default behavior and configuration for a specific threshold value of that resource control on a specific process or process collective. The local flags for one threshold value do not affect the behavior of other defined threshold values for the same resource control. However, the global flags affect the behavior for every value associated with a particular control. Local flags can be modified, within the constraints supplied by their corresponding global flags, by the prctl command or the setrctl system call. For more information, see the setrctl(2) man page.
For the complete list of local flags, global flags, and their definitions, see the rctlblk_set_value(3C) man page.
To determine system behavior when a threshold value for a particular resource control is reached, use the rctladm command to display the global flags for the resource control . For example, to display the values for the process.max-cpu-time resource control, type the following:
$ rctladm process.max-cpu-time process.max-cpu-time syslog=off [ lowerable no-deny cpu-time inf seconds ]
The global flags indicate the following.
Unit of size for the resource control.
A count (integer) value for the resource control.
SIGXCPU is available to be sent when threshold values of this resource are reached.
Always deny request for resource when threshold values are exceeded.
Superuser privileges are not required to lower the privileged values for this control.
Resource control values with the privilege type basic cannot be set. Only privileged resource control values are allowed.
Even when threshold values are exceeded, access to the resource is never denied.
A local signal action cannot be set on resource control values.
The global syslog message action may not be set for this resource control.
The time value for the resource control.
Use the prctl command to display local values and actions for the resource control.
$ prctl -n process.max-cpu-time $$ process 353939: -ksh NAME PRIVILEGE VALUE FLAG ACTION RECIPIENT process.max-cpu-time privileged 18.4Es inf signal=XCPU - system 18.4Es inf none
The max (RCTL_LOCAL_MAXIMAL) flag is set for both threshold values, and the inf (RCTL_GLOBAL_INFINITE) flag is defined for this resource control. An inf value has an infinite quantity. The value is never enforced. Hence, as configured, both threshold quantities represent infinite values that are never exceeded.
More than one resource control can exist on a resource. A resource control can exist at each containment level in the process model. If resource controls are active on the same resource at different container levels, the smallest container's control is enforced first. Thus, action is taken on process.max-cpu-time before task.max-cpu-time if both controls are encountered simultaneously.
Figure 3 Process Collectives, Container Relationships, and Their Resource Control Sets
Often, the resource consumption of processes is unknown. To get more information, try using the global resource control actions that are available with the rctladm command. Use rctladm to establish a syslog action on a resource control. Then, if any entity managed by that resource control encounters a threshold value, a system message is logged at the configured logging level. See Administering Resource Controls Tasks and the rctladm(8) man page for more information.