Projects

Projects in OpenSolaris allow you to group processes together so that you can apply resource management (kernel settings, memory & CPU limits) to the group.

There are 5 projects predefined on a clean installation of OpenSolaris:

bleonard@os200906:~$ projects -l
system
	projid : 0
	comment: ""
	users  : (none)
	groups : (none)
	attribs: 
user.root
	projid : 1
	comment: ""
	users  : (none)
	groups : (none)
	attribs: 
noproject
	projid : 2
	comment: ""
	users  : (none)
	groups : (none)
	attribs: 
default
	projid : 3
	comment: ""
	users  : (none)
	groups : (none)
	attribs: 
group.staff
	projid : 10
	comment: ""
	users  : (none)
	groups : (none)
	attribs: 

And none of them have any attributes set, which is how the management of resources are applied.

To see which of these 5 projects the processes on your system are currently assigned, run ps, formatting the output to include project information:

bleonard@os200906:~$ ps -eo user,pid,project,args
    USER   PID  PROJECT COMMAND
    root     0   system sched
    root     1   system /sbin/init
    root     2   system pageout
    root     3   system fsflush
    root   368   system /usr/lib/rmvolmgr -s
    root     7   system /lib/svc/bin/svc.startd
    root     9   system /lib/svc/bin/svc.configd
    root    59   system devfsadmd
   dladm    16   system /sbin/dlmgmtd
  daemon    42   system /lib/crypto/kcfd
    root    23   system /lib/inet/nwamd
    root   440   system /usr/lib/utmpd
bleonard   722 group.staff /usr/lib/notification-area-applet --oaf-activate-iid=OAFIID:GNOME_NotificationA
...

 Process are assigned to a project using the following series of rules:

  1. The project is assigned to the user starting the process in the /etc/user_attr file. The default /etc/user_attr file has no projects defined this way.

  2. A project is named user.{username}. To see this in action:
    bleonard@os200906:~$ pfexec su
    bleonard@os200906:~# ps -o user,pid,project,args
        USER   PID  PROJECT COMMAND
        root   848 user.root bash
        root   851 user.root ps -o user,pid,project,args
    
  3. A project is named group.{username}. This is how processes started by my userid, bleonard, are assigned to the project group.staff (staff is my group).

  4. If none of the above 3 rules apply, the processes are assigned to the project named default.

Alternatively, for processes that are managed by SMF, you can also specify in the SMF manifest the project that the processes should be run under. As an example, I'm going to use Apache, which has several processes running.

If Apache isn't already installed:

bleonard@os200906:~$ pfexec pkg install SUNWapch22
DOWNLOAD                                    PKGS       FILES     XFER (MB)
Completed                                    4/4     892/892     4.44/4.44 

PHASE                                        ACTIONS
Install Phase                              1121/1121 

Then enable Apache:

bleonard@os200906:~$ svcadm enable apache22
bleonard@os200906:~$ ps -eo user,pid,project,args | grep httpd
webservd   921   system /usr/apache2/2.2/bin/httpd -k start
webservd   923   system /usr/apache2/2.2/bin/httpd -k start
webservd   922   system /usr/apache2/2.2/bin/httpd -k start
    root   920   system /usr/apache2/2.2/bin/httpd -k start
webservd   924   system /usr/apache2/2.2/bin/httpd -k start
webservd   925   system /usr/apache2/2.2/bin/httpd -k start

You can see that the Apache processes are running under the system project. If you wanted to exact more control over the resources Apache used, you would first want to group the Apache process under their own project.

So let's create a new project for Apache. I'm going to call it webservd just to be consistent with the user name.

bleonard@os200906:~$ pfexec projadd webservd

Then we can add this project to Apache's SMF manifest. First, look at the existing properties for starting Apache:

bleonard@os200906:~$ svccfg -s apache22
vc:/network/http:apache22> listprop start
start                  method
start/exec             astring  "/lib/svc/method/http-apache22 start"
start/timeout_seconds  count    60
start/type             astring  method
svc:/network/http:apache22> exit

Then, save the following to a text file. I'm going to call mine apache_cfg:

bleonard@os200906:~$ cat apache_cfg 
setprop start/project = astring: webservd
setprop start/user = astring: root
setprop start/group = astring: :default
setprop start/privileges = astring: :default
setprop start/limit_privileges = astring: :default
setprop start/use_profile = boolean: false
setprop start/supp_groups = astring: :default
setprop start/working_directory = astring: :default
setprop start/resource_pool = astring: :default
end

The key properties being set are start/project and start/user, however, all of the properties being set above need to be there for this to work properly. To learn how to run Apache as a user other than root, see Locking Down Apache.

Apply the settings to the Apache SMF configuration:

bleonard@os200906:~$ svccfg -f apache_cfg

Then you can confirm the changes took effect:

bleonard@os200906:~$ svccfg -s apache22 
svc:/network/http:apache22> listprop start
start                    method
start/exec               astring  "/lib/svc/method/http-apache22 start"
start/timeout_seconds    count    60
start/type               astring  method
start/project            astring  webservd
start/user               astring  root
start/group              astring  :default
start/privileges         astring  :default
start/limit_privileges   astring  :default
start/use_profile        boolean  false
start/supp_groups        astring  :default
start/working_directory  astring  :default
start/resource_pool      astring  :default
svc:/network/http:apache22> exit

Now refresh and restart the Apache service:

bleonard@os200906:~$ svcadm refresh apache22
bleonard@os200906:~$ svcadm restart apache22
bleonard@os200906:~$ ps -eo user,pid,project,args | grep httpd
webservd  1144 webservd /usr/apache2/2.2/bin/httpd -k start
webservd  1143 webservd /usr/apache2/2.2/bin/httpd -k start
webservd  1145 webservd /usr/apache2/2.2/bin/httpd -k start
    root  1142 webservd /usr/apache2/2.2/bin/httpd -k start
webservd  1147 webservd /usr/apache2/2.2/bin/httpd -k start
webservd  1146 webservd /usr/apache2/2.2/bin/httpd -k start

Now you can do various things like monitor the processes that are just part of the project:

bleonard@os200906:~$ prstat -j webservd
 
   PID USERNAME  SIZE   RSS STATE  PRI NICE      TIME  CPU PROCESS/NLWP       
  1321 webservd   13M 3216K run     39    0   0:00:02 4.4% httpd/1
  1330 webservd   13M 3216K run     39    0   0:00:01 4.4% httpd/1
  1320 webservd   13M 3216K sleep   59    0   0:00:02 4.3% httpd/1
  1323 webservd   13M 3216K sleep   59    0   0:00:02 4.2% httpd/1
  1329 webservd   13M 3216K sleep   59    0   0:00:01 4.1% httpd/1
  1324 webservd   13M 3220K run     44    0   0:00:01 4.1% httpd/1
  1325 webservd   13M 3216K run     44    0   0:00:01 4.0% httpd/1
  1328 webservd   13M 3220K run     39    0   0:00:01 3.9% httpd/1
  1326 webservd   13M 3216K sleep   59    0   0:00:01 3.9% httpd/1
  1327 webservd   13M 3216K sleep   44    0   0:00:01 3.8% httpd/1
  1319 webservd   13M 3216K sleep   54    0   0:00:01 3.8% httpd/1
  1322 webservd   13M 3216K sleep   59    0   0:00:01 3.5% httpd/1
  1318 root       13M 7020K sleep   59    0   0:00:00 0.4% httpd/1

Total: 13 processes, 13 lwps, load averages: 8.03, 4.20, 1.74

Then say for example I wanted to cap the number of LWPs Apache could spawn. I could add a resource control to the project as follows:

bleonard@os200906:~$ pfexec projmod -K "project.max-lwps=(privileged,4,deny)" webservd

Here we're capping the number of LWPs that can be spawned by the webservd project at 4 and denying requests to fork additional processes. Looking at prstat again for the webservd project you'll notice only 4 processes are spawned. You'll also notice the CPU utilization for each process how gone up as well, as the limited number of processes tries to cope with the load:

bleonard@os200906:~$ prstat -j webservd

   PID USERNAME  SIZE   RSS STATE  PRI NICE      TIME  CPU PROCESS/NLWP       
  1382 webservd   13M 3200K run     22    0   0:00:20  22% httpd/1
  1381 webservd   13M 3200K run     21    0   0:00:19  21% httpd/1
  1380 webservd   13M 3200K run     12    0   0:00:19  20% httpd/1
  1379 root       13M 6968K sleep   59    0   0:00:00 0.0% httpd/1

Total: 4 processes, 4 lwps, load averages: 2.57, 2.11, 1.67

Check out the resource_controls(5) man page to learn more about applying constraints to your projects.

Comments:

My main motivation for using projects is to replace /etc/system entries. Being able to adjust settings without rebooting is a major plus :-)

Posted by Paul Duncan on May 13, 2010 at 03:03 AM GMT #

very nice article! thanks a lot!

Posted by Nikolai Maslov on May 25, 2010 at 05:28 AM GMT #

Post a Comment:
  • HTML Syntax: NOT allowed
About

The Observatory is a blog for users of Oracle Solaris. Tune in here for tips, tricks and more as we explore the Solaris operating system from Oracle.

Connect with Oracle Solaris:


Search

Archives
« April 2014
SunMonTueWedThuFriSat
  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
   
       
Today