Limit processor/mem usage on per user basis

[CyberNerd]

I need to limit the amount of resources a user can use in two situations.

 

1) on a linux vmware host that has two windows servers. Each windows server runs as a different user. I want to prevent either server from using too much resources and slowing the host or the other server.

 

2) on an (experimental) LTSP - I want to stop any one user from using all system resources eg - launching an application 100 times and hammering the server.

 

Google led me to the ulimit command and then to /etc/security/limits.conf

 

I'm unsure of what would be sensible defaults in the limits.conf file in either of these situations

 

# /etc/security/limits.conf
#
#Each line describes a limit for a user in the form:
#
#            
#
#Where:
# can be:
#        - an user name
#        - a group name, with @group syntax
#        - the wildcard *, for default entry
#        - the wildcard %, can be also used with %group syntax,
#                 for maxlogin limit
#
# can have the two values:
#        - "soft" for enforcing the soft limits
#        - "hard" for enforcing hard limits
#
# can be one of the following:
#        - core - limits the core file size (KB)
#        - data - max data size (KB)
#        - fsize - maximum filesize (KB)
#        - memlock - max locked-in-memory address space (KB)
#        - nofile - max number of open files
#        - rss - max resident set size (KB)
#        - stack - max stack size (KB)
#        - cpu - max CPU time (MIN)
#        - nproc - max number of processes
#        - as - address space limit
#        - maxlogins - max number of logins for this user
#        - priority - the priority to run user process with
#        - locks - max number of file locks the user can hold
#        - sigpending - max number of pending signals
#        - msgqueue - max memory used by POSIX message queues (bytes)
#
#                 

 

While some settings are self-explanatory, some I don't havea clue about. Any suggested reading? I don't have man limits.conf either

Does anyone have experience of this and could maybe suggest something reasonable.

 

also, whats the difference between 'soft' and 'hard' limit ?

 

TIA.

[Geoff]

some I don't havea clue about

 

Which ones?

 

Any suggested reading?

 

http://gentoo-wiki.com/SECURITY_Limit_User_Processes

http://www.gentoo.org/doc/en/security/security-handbook.xml?part=1&chap=5

 

I don't have man limits.conf either

 

http://www.die.net/doc/linux/man/man5/limits.conf.5.html

 

whats the difference between 'soft' and 'hard' limit ?

 

when the user hits the soft limit they simply get a warning. When they hit the hard limit they will be refused further resources.

[CyberNerd]

Quote:

some I don't havea clue about

 

Which ones?

 

I think I only need :

nproc, maxlogins, priority and maximum memory size (memlock??) on the LTSP and priority on the virtual machines as vmware should control memory.

Things like 'resident set size' 'core size' 'address apace limit' I'm completey fluxed by, the others I just wouldn't know how or why to implement.

 

edit: is rss the amount of memory per process, and memlock the total max memory per user ?

 

Quote:

Any suggested reading?

 

gentoo-wiki.com/SECURI..._Processes

http://www.gentoo.org/doc/en/...t=1&chap=5

 

Thanks, It's a nice feature but I can see why people complain linux documentation is missing, probably I need a book or CS degree to really understand this.

 

Quote:

I don't have man limits.conf either

 

http://www.die.net/doc/linux/...onf.5.html

 

ditto

Quote:

whats the difference between 'soft' and 'hard' limit ?

 

 

when the user hits the soft limit they simply get a warning. When they hit the hard limit they will be refused further resources.

 

Understood. So soft and hard limits on my users and just soft on my virtual machines.

[Geoff]

resident set size

 

It's the amount of RAM actually used by the process - as opposed

to that which has been paged (swapped) out. For example, a 10 MB

process might have an RSS of 8 MB; this means that 8 MB of the

process' virtual memory is in RAM, and the other 2 MB is paged

out to disk.

 

It correlates with the 'RES' column in 'top'

 

core size

 

Limits the size the core files.

 

address apace limit

 

Logical address space limits. So where as RSS deals with physical limits. This setting limits total memory usage. Including shared + swapped memory.

 

It correlates with the 'virt' column in 'top'.

[CyberNerd]

Thanks Geoff. Those definitions have helped immensely

I'll have a virtual play and see what I can break.