X

News, tips, partners, and perspectives for the Oracle Solaris operating system

Projects

Guest Author

Projects in OpenSolaris allow you to group processes together so that you can apply resource management (kernel settings, memory & CPU limits) to the group.

There are 5 projects predefined on a clean installation of OpenSolaris:

bleonard@os200906:~$ projects -l
system

projid : 0

comment: ""

users : (none)

groups : (none)

attribs:
user.root

projid : 1

comment: ""

users : (none)

groups : (none)

attribs:
noproject

projid : 2

comment: ""

users : (none)

groups : (none)

attribs:
default

projid : 3

comment: ""

users : (none)

groups : (none)

attribs:
group.staff

projid : 10

comment: ""

users : (none)

groups : (none)

attribs:

And none of them have any attributes set, which is how the management of resources are applied.

To see which of these 5 projects the processes on your system are currently assigned, run ps, formatting the output to include project information:

bleonard@os200906:~$ ps -eo user,pid,project,args
USER PID PROJECT COMMAND
root 0 system sched
root 1 system /sbin/init
root 2 system pageout
root 3 system fsflush
root 368 system /usr/lib/rmvolmgr -s
root 7 system /lib/svc/bin/svc.startd
root 9 system /lib/svc/bin/svc.configd
root 59 system devfsadmd
dladm 16 system /sbin/dlmgmtd
daemon 42 system /lib/crypto/kcfd
root 23 system /lib/inet/nwamd
root 440 system /usr/lib/utmpd
bleonard 722 group.staff /usr/lib/notification-area-applet --oaf-activate-iid=OAFIID:GNOME_NotificationA
...

 Process are assigned to a project using the following series of rules:

  1. The project is assigned to the user starting the process in the /etc/user_attr file. The default /etc/user_attr file has no projects defined this way.

  2. A project is named user.{username}. To see this in action:
    bleonard@os200906:~$ pfexec su
    bleonard@os200906:~# ps -o user,pid,project,args
    USER PID PROJECT COMMAND
    root 848 user.root bash
    root 851 user.root ps -o user,pid,project,args
  3. A project is named group.{username}. This is how processes started by my userid, bleonard, are assigned to the project group.staff (staff is my group).

  4. If none of the above 3 rules apply, the processes are assigned to the project named default.

Alternatively, for processes that are managed by SMF, you can also specify in the SMF manifest the project that the processes should be run under. As an example, I'm going to use Apache, which has several processes running.

If Apache isn't already installed:

bleonard@os200906:~$ pfexec pkg install SUNWapch22
DOWNLOAD PKGS FILES XFER (MB)
Completed 4/4 892/892 4.44/4.44
PHASE ACTIONS
Install Phase 1121/1121

Then enable Apache:

bleonard@os200906:~$ svcadm enable apache22
bleonard@os200906:~$ ps -eo user,pid,project,args | grep httpd
webservd 921 system /usr/apache2/2.2/bin/httpd -k start
webservd 923 system /usr/apache2/2.2/bin/httpd -k start
webservd 922 system /usr/apache2/2.2/bin/httpd -k start
root 920 system /usr/apache2/2.2/bin/httpd -k start
webservd 924 system /usr/apache2/2.2/bin/httpd -k start
webservd 925 system /usr/apache2/2.2/bin/httpd -k start

You can see that the Apache processes are running under the system project. If you wanted to exact more control over the resources Apache used, you would first want to group the Apache process under their own project.

So let's create a new project for Apache. I'm going to call it webservd just to be consistent with the user name.

bleonard@os200906:~$ pfexec projadd webservd

Then we can add this project to Apache's SMF manifest. First, look at the existing properties for starting Apache:

bleonard@os200906:~$ svccfg -s apache22
vc:/network/http:apache22> listprop start
start method
start/exec astring "/lib/svc/method/http-apache22 start"
start/timeout_seconds count 60
start/type astring method
svc:/network/http:apache22> exit

Then, save the following to a text file. I'm going to call mine apache_cfg:

bleonard@os200906:~$ cat apache_cfg 
setprop start/project = astring: webservd
setprop start/user = astring: root
setprop start/group = astring: :default
setprop start/privileges = astring: :default
setprop start/limit_privileges = astring: :default
setprop start/use_profile = boolean: false
setprop start/supp_groups = astring: :default
setprop start/working_directory = astring: :default
setprop start/resource_pool = astring: :default
end

The key properties being set are start/project and start/user, however, all of the properties being set above need to be there for this to work properly. To learn how to run Apache as a user other than root, see Locking Down Apache.

Apply the settings to the Apache SMF configuration:

bleonard@os200906:~$ svccfg -f apache_cfg

Then you can confirm the changes took effect:

bleonard@os200906:~$ svccfg -s apache22 
svc:/network/http:apache22> listprop start
start method
start/exec astring "/lib/svc/method/http-apache22 start"
start/timeout_seconds count 60
start/type astring method
start/project astring webservd
start/user astring root
start/group astring :default
start/privileges astring :default
start/limit_privileges astring :default
start/use_profile boolean false
start/supp_groups astring :default
start/working_directory astring :default
start/resource_pool astring :default
svc:/network/http:apache22> exit

Now refresh and restart the Apache service:

bleonard@os200906:~$ svcadm refresh apache22
bleonard@os200906:~$ svcadm restart apache22
bleonard@os200906:~$ ps -eo user,pid,project,args | grep httpd
webservd 1144 webservd /usr/apache2/2.2/bin/httpd -k start
webservd 1143 webservd /usr/apache2/2.2/bin/httpd -k start
webservd 1145 webservd /usr/apache2/2.2/bin/httpd -k start
root 1142 webservd /usr/apache2/2.2/bin/httpd -k start
webservd 1147 webservd /usr/apache2/2.2/bin/httpd -k start
webservd 1146 webservd /usr/apache2/2.2/bin/httpd -k start

Now you can do various things like monitor the processes that are just part of the project:

bleonard@os200906:~$ prstat -j webservd
PID USERNAME SIZE RSS STATE PRI NICE TIME CPU PROCESS/NLWP
1321 webservd 13M 3216K run 39 0 0:00:02 4.4% httpd/1
1330 webservd 13M 3216K run 39 0 0:00:01 4.4% httpd/1
1320 webservd 13M 3216K sleep 59 0 0:00:02 4.3% httpd/1
1323 webservd 13M 3216K sleep 59 0 0:00:02 4.2% httpd/1
1329 webservd 13M 3216K sleep 59 0 0:00:01 4.1% httpd/1
1324 webservd 13M 3220K run 44 0 0:00:01 4.1% httpd/1
1325 webservd 13M 3216K run 44 0 0:00:01 4.0% httpd/1
1328 webservd 13M 3220K run 39 0 0:00:01 3.9% httpd/1
1326 webservd 13M 3216K sleep 59 0 0:00:01 3.9% httpd/1
1327 webservd 13M 3216K sleep 44 0 0:00:01 3.8% httpd/1
1319 webservd 13M 3216K sleep 54 0 0:00:01 3.8% httpd/1
1322 webservd 13M 3216K sleep 59 0 0:00:01 3.5% httpd/1
1318 root 13M 7020K sleep 59 0 0:00:00 0.4% httpd/1
Total: 13 processes, 13 lwps, load averages: 8.03, 4.20, 1.74

Then say for example I wanted to cap the number of LWPs Apache could spawn. I could add a resource control to the project as follows:

bleonard@os200906:~$ pfexec projmod -K "project.max-lwps=(privileged,4,deny)" webservd

Here we're capping the number of LWPs that can be spawned by the webservd project at 4 and denying requests to fork additional processes. Looking at prstat again for the webservd project you'll notice only 4 processes are spawned. You'll also notice the CPU utilization for each process how gone up as well, as the limited number of processes tries to cope with the load:

bleonard@os200906:~$ prstat -j webservd
PID USERNAME SIZE RSS STATE PRI NICE TIME CPU PROCESS/NLWP
1382 webservd 13M 3200K run 22 0 0:00:20 22% httpd/1
1381 webservd 13M 3200K run 21 0 0:00:19 21% httpd/1
1380 webservd 13M 3200K run 12 0 0:00:19 20% httpd/1
1379 root 13M 6968K sleep 59 0 0:00:00 0.0% httpd/1
Total: 4 processes, 4 lwps, load averages: 2.57, 2.11, 1.67

Check out the resource_controls(5) man page to learn more about applying constraints to your projects.

Join the discussion

Comments ( 2 )
  • Paul Duncan Thursday, May 13, 2010

    My main motivation for using projects is to replace /etc/system entries. Being able to adjust settings without rebooting is a major plus :-)


  • Nikolai Maslov Tuesday, May 25, 2010

    very nice article! thanks a lot!


Please enter your name.Please provide a valid email address.Please enter a comment.CAPTCHA challenge response provided was incorrect. Please try again.Captcha