16ec54a57SEdward Tomasz Napierala.\"- 26ec54a57SEdward Tomasz Napierala.\" Copyright (c) 2009 Edward Tomasz Napierala 36ec54a57SEdward Tomasz Napierala.\" 46ec54a57SEdward Tomasz Napierala.\" Redistribution and use in source and binary forms, with or without 56ec54a57SEdward Tomasz Napierala.\" modification, are permitted provided that the following conditions 66ec54a57SEdward Tomasz Napierala.\" are met: 76ec54a57SEdward Tomasz Napierala.\" 1. Redistributions of source code must retain the above copyright 86ec54a57SEdward Tomasz Napierala.\" notice, this list of conditions and the following disclaimer. 96ec54a57SEdward Tomasz Napierala.\" 2. Redistributions in binary form must reproduce the above copyright 106ec54a57SEdward Tomasz Napierala.\" notice, this list of conditions and the following disclaimer in the 116ec54a57SEdward Tomasz Napierala.\" documentation and/or other materials provided with the distribution. 126ec54a57SEdward Tomasz Napierala.\" 136ec54a57SEdward Tomasz Napierala.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 146ec54a57SEdward Tomasz Napierala.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 156ec54a57SEdward Tomasz Napierala.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 166ec54a57SEdward Tomasz Napierala.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR THE VOICES IN HIS HEAD BE 176ec54a57SEdward Tomasz Napierala.\" LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 186ec54a57SEdward Tomasz Napierala.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 196ec54a57SEdward Tomasz Napierala.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 206ec54a57SEdward Tomasz Napierala.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 216ec54a57SEdward Tomasz Napierala.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 226ec54a57SEdward Tomasz Napierala.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 236ec54a57SEdward Tomasz Napierala.\" POSSIBILITY OF SUCH DAMAGE. 246ec54a57SEdward Tomasz Napierala.\" 25f9f0cd1fSEdward Tomasz Napierala.Dd February 26, 2018 266ec54a57SEdward Tomasz Napierala.Dt RCTL 8 276ec54a57SEdward Tomasz Napierala.Os 286ec54a57SEdward Tomasz Napierala.Sh NAME 296ec54a57SEdward Tomasz Napierala.Nm rctl 306ec54a57SEdward Tomasz Napierala.Nd display and update resource limits database 316ec54a57SEdward Tomasz Napierala.Sh SYNOPSIS 326ec54a57SEdward Tomasz Napierala.Nm 336ec54a57SEdward Tomasz Napierala.Op Fl h 346ec54a57SEdward Tomasz Napierala.Op Fl n 350971623eSEdward Tomasz Napierala.Op Ar filter Ar ... 366ec54a57SEdward Tomasz Napierala.Nm 376ec54a57SEdward Tomasz Napierala.Fl a 380971623eSEdward Tomasz Napierala.Ar rule Ar ... 396ec54a57SEdward Tomasz Napierala.Nm 40c0a04e01SBryan Drewery.Fl l 416ec54a57SEdward Tomasz Napierala.Op Fl h 426ec54a57SEdward Tomasz Napierala.Op Fl n 430971623eSEdward Tomasz Napierala.Ar filter Ar ... 446ec54a57SEdward Tomasz Napierala.Nm 456ec54a57SEdward Tomasz Napierala.Fl r 460971623eSEdward Tomasz Napierala.Ar filter Ar ... 476ec54a57SEdward Tomasz Napierala.Nm 486ec54a57SEdward Tomasz Napierala.Fl u 49c0a04e01SBryan Drewery.Op Fl h 500971623eSEdward Tomasz Napierala.Ar filter Ar ... 516ec54a57SEdward Tomasz Napierala.Sh DESCRIPTION 526ec54a57SEdward Tomasz NapieralaWhen called without options, the 536ec54a57SEdward Tomasz Napierala.Nm 546ec54a57SEdward Tomasz Napieralacommand writes currently defined RCTL rules to standard output. 556ec54a57SEdward Tomasz Napierala.Pp 566ec54a57SEdward Tomasz NapieralaIf a 576ec54a57SEdward Tomasz Napierala.Ar filter 586ec54a57SEdward Tomasz Napieralaargument is specified, only rules matching the filter are displayed. 596ec54a57SEdward Tomasz NapieralaThe options are as follows: 606ec54a57SEdward Tomasz Napierala.Bl -tag -width indent 616ec54a57SEdward Tomasz Napierala.It Fl a Ar rule 626ec54a57SEdward Tomasz NapieralaAdd 636ec54a57SEdward Tomasz Napierala.Ar rule 646ec54a57SEdward Tomasz Napieralato the RCTL database. 656ec54a57SEdward Tomasz Napierala.It Fl l Ar filter 666ec54a57SEdward Tomasz NapieralaDisplay rules applicable to the process defined by 676ec54a57SEdward Tomasz Napierala.Ar filter . 68aeb99b56SEdward Tomasz NapieralaNote that this is different from showing the rules when called without 69aeb99b56SEdward Tomasz Napieralaany options, as it shows not just the rules with subject equal to that 70aeb99b56SEdward Tomasz Napieralaof process, but also rules for the user, jail, and login class applicable 71aeb99b56SEdward Tomasz Napieralato the process. 726ec54a57SEdward Tomasz Napierala.It Fl r Ar filter 736ec54a57SEdward Tomasz NapieralaRemove rules matching 746ec54a57SEdward Tomasz Napierala.Ar filter 756ec54a57SEdward Tomasz Napieralafrom the RCTL database. 766ec54a57SEdward Tomasz Napierala.It Fl u Ar filter 77859f4b70SEdward Tomasz NapieralaDisplay resource utilization for a subject 78c0a04e01SBryan Drewery.Po 79c0a04e01SBryan Drewery.Sy process , 80c0a04e01SBryan Drewery.Sy user , 81c0a04e01SBryan Drewery.Sy loginclass 82c0a04e01SBryan Dreweryor 83c0a04e01SBryan Drewery.Sy jail 84c0a04e01SBryan Drewery.Pc 85c0a04e01SBryan Drewerymatching the 866ec54a57SEdward Tomasz Napierala.Ar filter . 876ec54a57SEdward Tomasz Napierala.It Fl h 886ec54a57SEdward Tomasz Napierala"Human-readable" output. 896ec54a57SEdward Tomasz NapieralaUse unit suffixes: Byte, Kilobyte, Megabyte, 906ec54a57SEdward Tomasz NapieralaGigabyte, Terabyte and Petabyte. 916ec54a57SEdward Tomasz Napierala.It Fl n 926ec54a57SEdward Tomasz NapieralaDisplay user IDs numerically rather than converting them to a user name. 93b2e52cedSUlrich Spörlein.El 94c0a04e01SBryan Drewery.Pp 95c0a04e01SBryan DreweryModifying rules affects all currently running and future processes matching 96c0a04e01SBryan Drewerythe rule. 976ec54a57SEdward Tomasz Napierala.Sh RULE SYNTAX 986ec54a57SEdward Tomasz NapieralaSyntax for a rule is subject:subject-id:resource:action=amount/per. 996ec54a57SEdward Tomasz Napierala.Pp 100c0a04e01SBryan Drewery.Bl -tag -width "subject-id" -compact -offset indent 101c0a04e01SBryan Drewery.It subject 102c0a04e01SBryan Drewerydefines the kind of entity the rule applies to. 103c0a04e01SBryan DreweryIt can be either 104c0a04e01SBryan Drewery.Sy process , 105c0a04e01SBryan Drewery.Sy user , 106c0a04e01SBryan Drewery.Sy loginclass , 107c0a04e01SBryan Dreweryor 108c0a04e01SBryan Drewery.Sy jail . 109c0a04e01SBryan Drewery.It subject-id 110c0a04e01SBryan Dreweryidentifies the 111c0a04e01SBryan Drewery.Em subject . 112c0a04e01SBryan DreweryIt can be a process ID, user name, numerical user ID, login class name from 113c0a04e01SBryan Drewery.Xr login.conf 5 , 114aeb99b56SEdward Tomasz Napieralaor jail name. 115c0a04e01SBryan Drewery.It resource 116c0a04e01SBryan Dreweryidentifies the resource the rule controls. 117c0a04e01SBryan DrewerySee the 118c0a04e01SBryan Drewery.Sx RESOURCES 119c0a04e01SBryan Drewerysection below for details. 120c0a04e01SBryan Drewery.It action 121c0a04e01SBryan Drewerydefines what will happen when a process exceeds the allowed 122c0a04e01SBryan Drewery.Em amount . 123c0a04e01SBryan DrewerySee the 124c0a04e01SBryan Drewery.Sx ACTIONS 125c0a04e01SBryan Drewerysection below for details. 126c0a04e01SBryan Drewery.It amount 127c0a04e01SBryan Drewerydefines how much of the resource a process can use before 128c0a04e01SBryan Drewerythe defined 129c0a04e01SBryan Drewery.Em action 130c0a04e01SBryan Drewerytriggers. 131c0a04e01SBryan DreweryResources which limit bytes may use prefixes from 132c0a04e01SBryan Drewery.Xr expand_number 3 . 133c0a04e01SBryan Drewery.It per 134c0a04e01SBryan Drewerydefines what entity the 135c0a04e01SBryan Drewery.Em amount 136c0a04e01SBryan Drewerygets accounted for. 137*bd67d6b2SEitan AdlerFor example, rule "loginclass:users:vmemoryuse:deny=100M/process" means 1386ec54a57SEdward Tomasz Napieralathat each process of any user belonging to login class "users" may allocate 1396ec54a57SEdward Tomasz Napieralaup to 100MB of virtual memory. 140*bd67d6b2SEitan AdlerRule "loginclass:users:vmemoryuse:deny=100M/user" would mean that for each 1416ec54a57SEdward Tomasz Napieralauser belonging to the login class "users", the sum of virtual memory allocated 14220d3bac0SEdward Tomasz Napieralaby all the processes of that user will not exceed 100MB. 143*bd67d6b2SEitan AdlerRule "loginclass:users:vmemoryuse:deny=100M/loginclass" would mean that the sum of 1446ec54a57SEdward Tomasz Napieralavirtual memory allocated by all processes of all users belonging to that login 1456ec54a57SEdward Tomasz Napieralaclass will not exceed 100MB. 146c0a04e01SBryan Drewery.El 1476ec54a57SEdward Tomasz Napierala.Pp 148c0a04e01SBryan DreweryA valid rule has all those fields specified, except for 149c0a04e01SBryan Drewery.Em per , 150c0a04e01SBryan Drewerywhich defaults 151c0a04e01SBryan Dreweryto the value of 152c0a04e01SBryan Drewery.Em subject . 1536ec54a57SEdward Tomasz Napierala.Pp 154c0a04e01SBryan DreweryA filter is a rule for which one of more fields other than 155c0a04e01SBryan Drewery.Em per 156c0a04e01SBryan Dreweryis left empty. 1576ec54a57SEdward Tomasz NapieralaFor example, a filter that matches every rule could be written as ":::=/", 1586ec54a57SEdward Tomasz Napieralaor, in short, ":". 1596ec54a57SEdward Tomasz NapieralaA filter that matches all the login classes would be "loginclass:". 160c0a04e01SBryan DreweryA filter that matches all defined rules for 161c0a04e01SBryan Drewery.Sy maxproc 162c0a04e01SBryan Dreweryresource would be 163a29460e0SEdward Tomasz Napierala"::maxproc". 164c0a04e01SBryan Drewery.Sh SUBJECTS 165c0a04e01SBryan Drewery.Bl -column -offset 3n "pseudoterminals" ".Sy username or numerical User ID" 166c0a04e01SBryan Drewery.It Sy process Ta numerical Process ID 167c0a04e01SBryan Drewery.It Sy user Ta user name or numerical User ID 168c0a04e01SBryan Drewery.It Sy loginclass Ta login class from 169c0a04e01SBryan Drewery.Xr login.conf 5 170c0a04e01SBryan Drewery.It Sy jail Ta jail name 171c0a04e01SBryan Drewery.El 1726ec54a57SEdward Tomasz Napierala.Sh RESOURCES 17385a2f1b4SEdward Tomasz Napierala.Bl -column -offset 3n "pseudoterminals" 174c0a04e01SBryan Drewery.It Sy cputime Ta "CPU time, in seconds" 175c0a04e01SBryan Drewery.It Sy datasize Ta "data size, in bytes" 176c0a04e01SBryan Drewery.It Sy stacksize Ta "stack size, in bytes" 177c0a04e01SBryan Drewery.It Sy coredumpsize Ta "core dump size, in bytes" 178c0a04e01SBryan Drewery.It Sy memoryuse Ta "resident set size, in bytes" 179c0a04e01SBryan Drewery.It Sy memorylocked Ta "locked memory, in bytes" 180c0a04e01SBryan Drewery.It Sy maxproc Ta "number of processes" 181c0a04e01SBryan Drewery.It Sy openfiles Ta "file descriptor table size" 182c0a04e01SBryan Drewery.It Sy vmemoryuse Ta "address space limit, in bytes" 183c0a04e01SBryan Drewery.It Sy pseudoterminals Ta "number of PTYs" 184d051ac80SEdward Tomasz Napierala.It Sy swapuse Ta "swap space that may be reserved or used, in bytes" 185c0a04e01SBryan Drewery.It Sy nthr Ta "number of threads" 186c0a04e01SBryan Drewery.It Sy msgqqueued Ta "number of queued SysV messages" 187c0a04e01SBryan Drewery.It Sy msgqsize Ta "SysV message queue size, in bytes" 188c0a04e01SBryan Drewery.It Sy nmsgq Ta "number of SysV message queues" 189c0a04e01SBryan Drewery.It Sy nsem Ta "number of SysV semaphores" 190c0a04e01SBryan Drewery.It Sy nsemop Ta "number of SysV semaphores modified in a single semop(2) call" 191c0a04e01SBryan Drewery.It Sy nshm Ta "number of SysV shared memory segments" 192c0a04e01SBryan Drewery.It Sy shmsize Ta "SysV shared memory size, in bytes" 193c0a04e01SBryan Drewery.It Sy wallclock Ta "wallclock time, in seconds" 194c0a04e01SBryan Drewery.It Sy pcpu Ta "%CPU, in percents of a single CPU core" 195ae34b6ffSEdward Tomasz Napierala.It Sy readbps Ta "filesystem reads, in bytes per second" 196ae34b6ffSEdward Tomasz Napierala.It Sy writebps Ta "filesystem writes, in bytes per second" 197ae34b6ffSEdward Tomasz Napierala.It Sy readiops Ta "filesystem reads, in operations per second" 198ae34b6ffSEdward Tomasz Napierala.It Sy writeiops Ta "filesystem writes, in operations per second" 1996ec54a57SEdward Tomasz Napierala.El 2006ec54a57SEdward Tomasz Napierala.Sh ACTIONS 20185a2f1b4SEdward Tomasz Napierala.Bl -column -offset 3n "pseudoterminals" 202c0a04e01SBryan Drewery.It Sy deny Ta deny the allocation; not supported for 203ae34b6ffSEdward Tomasz Napierala.Sy cputime , 204ae34b6ffSEdward Tomasz Napierala.Sy wallclock , 205ae34b6ffSEdward Tomasz Napierala.Sy readbps , 206ae34b6ffSEdward Tomasz Napierala.Sy writebps , 207ae34b6ffSEdward Tomasz Napierala.Sy readiops , 208c0a04e01SBryan Dreweryand 209ae34b6ffSEdward Tomasz Napierala.Sy writeiops 210c0a04e01SBryan Drewery.It Sy log Ta "log a warning to the console" 211c0a04e01SBryan Drewery.It Sy devctl Ta "send notification to" 2126ec54a57SEdward Tomasz Napierala.Xr devd 8 213c0a04e01SBryan Dreweryusing 214c0a04e01SBryan Drewery.Sy system 215c0a04e01SBryan Drewery= "RCTL", 216c0a04e01SBryan Drewery.Sy subsystem 217c0a04e01SBryan Drewery= "rule", 218c0a04e01SBryan Drewery.Sy type 219c0a04e01SBryan Drewery= "matched" 220c0a04e01SBryan Drewery.It sig* e.g. 221c0a04e01SBryan Drewery.Sy sigterm ; 222c0a04e01SBryan Drewerysend a signal to the offending process. 2236ec54a57SEdward Tomasz NapieralaSee 2246ec54a57SEdward Tomasz Napierala.Xr signal 3 225c0a04e01SBryan Dreweryfor a list of supported signals 226ae34b6ffSEdward Tomasz Napierala.It Sy throttle Ta "slow down process execution"; only supported for 227ae34b6ffSEdward Tomasz Napierala.Sy readbps , 228ae34b6ffSEdward Tomasz Napierala.Sy writebps , 229ae34b6ffSEdward Tomasz Napierala.Sy readiops , 230ae34b6ffSEdward Tomasz Napieralaand 231ae34b6ffSEdward Tomasz Napierala.Sy writeiops . 232c0a04e01SBryan Drewery.El 2336ec54a57SEdward Tomasz Napierala.Pp 2346ec54a57SEdward Tomasz NapieralaNot all actions are supported for all resources. 235c0a04e01SBryan DreweryAttempting to add a rule with an action not supported by a given resource will 236c0a04e01SBryan Dreweryresult in error. 2376ec54a57SEdward Tomasz Napierala.Sh EXIT STATUS 2386ec54a57SEdward Tomasz Napierala.Ex -std 2396ec54a57SEdward Tomasz Napierala.Sh EXAMPLES 2400a44395eSBryan DreweryPrevent user "joe" from allocating more than 1GB of virtual memory: 2410a44395eSBryan Drewery.Dl Nm Fl a Ar user:joe:vmemoryuse:deny=1g 2426ec54a57SEdward Tomasz Napierala.Pp 2430a44395eSBryan DreweryRemove all RCTL rules: 2440a44395eSBryan Drewery.Dl Nm Fl r Ar \&: 2456ec54a57SEdward Tomasz Napierala.Pp 246859f4b70SEdward Tomasz NapieralaDisplay resource utilization information for jail named "www": 2470a44395eSBryan Drewery.Dl Nm Fl hu Ar jail:www 2486ec54a57SEdward Tomasz Napierala.Pp 2490a44395eSBryan DreweryDisplay all the rules applicable to process with PID 512: 2500a44395eSBryan Drewery.Dl Nm Fl l Ar process:512 251c0a04e01SBryan Drewery.Pp 252c0a04e01SBryan DreweryDisplay all rules: 253c0a04e01SBryan Drewery.Dl Nm 254c0a04e01SBryan Drewery.Pp 255c0a04e01SBryan DreweryDisplay all rules matching user "joe": 256c0a04e01SBryan Drewery.Dl Nm Ar user:joe 257c0a04e01SBryan Drewery.Pp 258c0a04e01SBryan DreweryDisplay all rules matching login classes: 259c0a04e01SBryan Drewery.Dl Nm Ar loginclass: 2606ec54a57SEdward Tomasz Napierala.Sh SEE ALSO 261f9f0cd1fSEdward Tomasz Napierala.Xr cpuset 1 , 262f2e34224SEdward Tomasz Napierala.Xr rctl 4 , 263d8c4c833SEdward Tomasz Napierala.Xr rctl.conf 5 2646ec54a57SEdward Tomasz Napierala.Sh HISTORY 2656ec54a57SEdward Tomasz NapieralaThe 2666ec54a57SEdward Tomasz Napierala.Nm 2676ec54a57SEdward Tomasz Napieralacommand appeared in 2686ec54a57SEdward Tomasz Napierala.Fx 9.0 . 2696ec54a57SEdward Tomasz Napierala.Sh AUTHORS 2706ec54a57SEdward Tomasz Napierala.An -nosplit 2716ec54a57SEdward Tomasz NapieralaThe 2726ec54a57SEdward Tomasz Napierala.Nm 2731de5b5ebSEdward Tomasz Napieralawas developed by 2742b7af31cSBaptiste Daroussin.An Edward Tomasz Napierala Aq Mt trasz@FreeBSD.org 2751de5b5ebSEdward Tomasz Napieralaunder sponsorship from the FreeBSD Foundation. 276c0a04e01SBryan Drewery.Sh BUGS 277c0a04e01SBryan DreweryLimiting 278c0a04e01SBryan Drewery.Sy memoryuse 279c0a04e01SBryan Drewerymay kill the machine due to thrashing. 280ae34b6ffSEdward Tomasz Napierala.Pp 281ae34b6ffSEdward Tomasz NapieralaThe 282ae34b6ffSEdward Tomasz Napierala.Sy readiops 283ae34b6ffSEdward Tomasz Napieralaand 284ae34b6ffSEdward Tomasz Napierala.Sy writeiops 285ae34b6ffSEdward Tomasz Napieralacounters are only approximations. 286ae34b6ffSEdward Tomasz NapieralaLike 287ae34b6ffSEdward Tomasz Napierala.Sy readbps 288ae34b6ffSEdward Tomasz Napieralaand 289ae34b6ffSEdward Tomasz Napierala.Sy writebps , 290ae34b6ffSEdward Tomasz Napieralathey are calculated in the filesystem layer, where it is difficult 291ae34b6ffSEdward Tomasz Napieralaor even impossible to observe actual disk device operations. 292ae34b6ffSEdward Tomasz Napierala.Pp 293ae34b6ffSEdward Tomasz NapieralaThe 294ae34b6ffSEdward Tomasz Napierala.Sy writebps 295ae34b6ffSEdward Tomasz Napieralaand 296ae34b6ffSEdward Tomasz Napierala.Sy writeiops 297ae34b6ffSEdward Tomasz Napieralaresources generally account for writes to the filesystem cache, 298ae34b6ffSEdward Tomasz Napieralanot to actual devices. 299