16ec54a57SEdward Tomasz Napierala.\"- 26ec54a57SEdward Tomasz Napierala.\" Copyright (c) 2009 Edward Tomasz Napierala 36ec54a57SEdward Tomasz Napierala.\" All rights reserved. 46ec54a57SEdward Tomasz Napierala.\" 56ec54a57SEdward Tomasz Napierala.\" Redistribution and use in source and binary forms, with or without 66ec54a57SEdward Tomasz Napierala.\" modification, are permitted provided that the following conditions 76ec54a57SEdward Tomasz Napierala.\" are met: 86ec54a57SEdward Tomasz Napierala.\" 1. Redistributions of source code must retain the above copyright 96ec54a57SEdward Tomasz Napierala.\" notice, this list of conditions and the following disclaimer. 106ec54a57SEdward Tomasz Napierala.\" 2. Redistributions in binary form must reproduce the above copyright 116ec54a57SEdward Tomasz Napierala.\" notice, this list of conditions and the following disclaimer in the 126ec54a57SEdward Tomasz Napierala.\" documentation and/or other materials provided with the distribution. 136ec54a57SEdward Tomasz Napierala.\" 146ec54a57SEdward Tomasz Napierala.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 156ec54a57SEdward Tomasz Napierala.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 166ec54a57SEdward Tomasz Napierala.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 176ec54a57SEdward Tomasz Napierala.\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR THE VOICES IN HIS HEAD BE 186ec54a57SEdward Tomasz Napierala.\" LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 196ec54a57SEdward Tomasz Napierala.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 206ec54a57SEdward Tomasz Napierala.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 216ec54a57SEdward Tomasz Napierala.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 226ec54a57SEdward Tomasz Napierala.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 236ec54a57SEdward Tomasz Napierala.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 246ec54a57SEdward Tomasz Napierala.\" POSSIBILITY OF SUCH DAMAGE. 256ec54a57SEdward Tomasz Napierala.\" 266ec54a57SEdward Tomasz Napierala.\" $FreeBSD$ 276ec54a57SEdward Tomasz Napierala.\" 28*ae34b6ffSEdward Tomasz Napierala.Dd January 30, 2016 296ec54a57SEdward Tomasz Napierala.Dt RCTL 8 306ec54a57SEdward Tomasz Napierala.Os 316ec54a57SEdward Tomasz Napierala.Sh NAME 326ec54a57SEdward Tomasz Napierala.Nm rctl 336ec54a57SEdward Tomasz Napierala.Nd display and update resource limits database 346ec54a57SEdward Tomasz Napierala.Sh SYNOPSIS 356ec54a57SEdward Tomasz Napierala.Nm 366ec54a57SEdward Tomasz Napierala.Op Fl h 376ec54a57SEdward Tomasz Napierala.Op Fl n 380971623eSEdward Tomasz Napierala.Op Ar filter Ar ... 396ec54a57SEdward Tomasz Napierala.Nm 406ec54a57SEdward Tomasz Napierala.Fl a 410971623eSEdward Tomasz Napierala.Ar rule Ar ... 426ec54a57SEdward Tomasz Napierala.Nm 43c0a04e01SBryan Drewery.Fl l 446ec54a57SEdward Tomasz Napierala.Op Fl h 456ec54a57SEdward Tomasz Napierala.Op Fl n 460971623eSEdward Tomasz Napierala.Ar filter Ar ... 476ec54a57SEdward Tomasz Napierala.Nm 486ec54a57SEdward Tomasz Napierala.Fl r 490971623eSEdward Tomasz Napierala.Ar filter Ar ... 506ec54a57SEdward Tomasz Napierala.Nm 516ec54a57SEdward Tomasz Napierala.Fl u 52c0a04e01SBryan Drewery.Op Fl h 530971623eSEdward Tomasz Napierala.Ar filter Ar ... 54c0a04e01SBryan Drewery.Pp 55c0a04e01SBryan Drewery.Nm 56c0a04e01SBryan Dreweryrequires the kernel to be compiled with: 57c0a04e01SBryan Drewery.Bd -ragged -offset indent 58c0a04e01SBryan Drewery.Cd "options RACCT" 59c0a04e01SBryan Drewery.Cd "options RCTL" 60c0a04e01SBryan Drewery.Ed 616ec54a57SEdward Tomasz Napierala.Sh DESCRIPTION 626ec54a57SEdward Tomasz NapieralaWhen called without options, the 636ec54a57SEdward Tomasz Napierala.Nm 646ec54a57SEdward Tomasz Napieralacommand writes currently defined RCTL rules to standard output. 656ec54a57SEdward Tomasz Napierala.Pp 666ec54a57SEdward Tomasz NapieralaIf a 676ec54a57SEdward Tomasz Napierala.Ar filter 686ec54a57SEdward Tomasz Napieralaargument is specified, only rules matching the filter are displayed. 696ec54a57SEdward Tomasz NapieralaThe options are as follows: 706ec54a57SEdward Tomasz Napierala.Bl -tag -width indent 716ec54a57SEdward Tomasz Napierala.It Fl a Ar rule 726ec54a57SEdward Tomasz NapieralaAdd 736ec54a57SEdward Tomasz Napierala.Ar rule 746ec54a57SEdward Tomasz Napieralato the RCTL database. 756ec54a57SEdward Tomasz Napierala.It Fl l Ar filter 766ec54a57SEdward Tomasz NapieralaDisplay rules applicable to the process defined by 776ec54a57SEdward Tomasz Napierala.Ar filter . 78aeb99b56SEdward Tomasz NapieralaNote that this is different from showing the rules when called without 79aeb99b56SEdward Tomasz Napieralaany options, as it shows not just the rules with subject equal to that 80aeb99b56SEdward Tomasz Napieralaof process, but also rules for the user, jail, and login class applicable 81aeb99b56SEdward Tomasz Napieralato the process. 826ec54a57SEdward Tomasz Napierala.It Fl r Ar filter 836ec54a57SEdward Tomasz NapieralaRemove rules matching 846ec54a57SEdward Tomasz Napierala.Ar filter 856ec54a57SEdward Tomasz Napieralafrom the RCTL database. 866ec54a57SEdward Tomasz Napierala.It Fl u Ar filter 87c0a04e01SBryan DreweryDisplay resource usage for a subject 88c0a04e01SBryan Drewery.Po 89c0a04e01SBryan Drewery.Sy process , 90c0a04e01SBryan Drewery.Sy user , 91c0a04e01SBryan Drewery.Sy loginclass 92c0a04e01SBryan Dreweryor 93c0a04e01SBryan Drewery.Sy jail 94c0a04e01SBryan Drewery.Pc 95c0a04e01SBryan Drewerymatching the 966ec54a57SEdward Tomasz Napierala.Ar filter . 976ec54a57SEdward Tomasz Napierala.It Fl h 986ec54a57SEdward Tomasz Napierala"Human-readable" output. 996ec54a57SEdward Tomasz NapieralaUse unit suffixes: Byte, Kilobyte, Megabyte, 1006ec54a57SEdward Tomasz NapieralaGigabyte, Terabyte and Petabyte. 1016ec54a57SEdward Tomasz Napierala.It Fl n 1026ec54a57SEdward Tomasz NapieralaDisplay user IDs numerically rather than converting them to a user name. 103b2e52cedSUlrich Spörlein.El 104c0a04e01SBryan Drewery.Pp 105c0a04e01SBryan DreweryModifying rules affects all currently running and future processes matching 106c0a04e01SBryan Drewerythe rule. 1076ec54a57SEdward Tomasz Napierala.Sh RULE SYNTAX 1086ec54a57SEdward Tomasz NapieralaSyntax for a rule is subject:subject-id:resource:action=amount/per. 1096ec54a57SEdward Tomasz Napierala.Pp 110c0a04e01SBryan Drewery.Bl -tag -width "subject-id" -compact -offset indent 111c0a04e01SBryan Drewery.It subject 112c0a04e01SBryan Drewerydefines the kind of entity the rule applies to. 113c0a04e01SBryan DreweryIt can be either 114c0a04e01SBryan Drewery.Sy process , 115c0a04e01SBryan Drewery.Sy user , 116c0a04e01SBryan Drewery.Sy loginclass , 117c0a04e01SBryan Dreweryor 118c0a04e01SBryan Drewery.Sy jail . 119c0a04e01SBryan Drewery.It subject-id 120c0a04e01SBryan Dreweryidentifies the 121c0a04e01SBryan Drewery.Em subject . 122c0a04e01SBryan DreweryIt can be a process ID, user name, numerical user ID, login class name from 123c0a04e01SBryan Drewery.Xr login.conf 5 , 124aeb99b56SEdward Tomasz Napieralaor jail name. 125c0a04e01SBryan Drewery.It resource 126c0a04e01SBryan Dreweryidentifies the resource the rule controls. 127c0a04e01SBryan DrewerySee the 128c0a04e01SBryan Drewery.Sx RESOURCES 129c0a04e01SBryan Drewerysection below for details. 130c0a04e01SBryan Drewery.It action 131c0a04e01SBryan Drewerydefines what will happen when a process exceeds the allowed 132c0a04e01SBryan Drewery.Em amount . 133c0a04e01SBryan DrewerySee the 134c0a04e01SBryan Drewery.Sx ACTIONS 135c0a04e01SBryan Drewerysection below for details. 136c0a04e01SBryan Drewery.It amount 137c0a04e01SBryan Drewerydefines how much of the resource a process can use before 138c0a04e01SBryan Drewerythe defined 139c0a04e01SBryan Drewery.Em action 140c0a04e01SBryan Drewerytriggers. 141c0a04e01SBryan DreweryResources which limit bytes may use prefixes from 142c0a04e01SBryan Drewery.Xr expand_number 3 . 143c0a04e01SBryan Drewery.It per 144c0a04e01SBryan Drewerydefines what entity the 145c0a04e01SBryan Drewery.Em amount 146c0a04e01SBryan Drewerygets accounted for. 1476ec54a57SEdward Tomasz NapieralaFor example, rule "loginclass:users:vmem:deny=100M/process" means 1486ec54a57SEdward Tomasz Napieralathat each process of any user belonging to login class "users" may allocate 1496ec54a57SEdward Tomasz Napieralaup to 100MB of virtual memory. 1506ec54a57SEdward Tomasz NapieralaRule "loginclass:users:vmem:deny=100M/user" would mean that for each 1516ec54a57SEdward Tomasz Napieralauser belonging to the login class "users", the sum of virtual memory allocated 15220d3bac0SEdward Tomasz Napieralaby all the processes of that user will not exceed 100MB. 1536ec54a57SEdward Tomasz NapieralaRule "loginclass:users:vmem:deny=100M/loginclass" would mean that the sum of 1546ec54a57SEdward Tomasz Napieralavirtual memory allocated by all processes of all users belonging to that login 1556ec54a57SEdward Tomasz Napieralaclass will not exceed 100MB. 156c0a04e01SBryan Drewery.El 1576ec54a57SEdward Tomasz Napierala.Pp 158c0a04e01SBryan DreweryA valid rule has all those fields specified, except for 159c0a04e01SBryan Drewery.Em per , 160c0a04e01SBryan Drewerywhich defaults 161c0a04e01SBryan Dreweryto the value of 162c0a04e01SBryan Drewery.Em subject . 1636ec54a57SEdward Tomasz Napierala.Pp 164c0a04e01SBryan DreweryA filter is a rule for which one of more fields other than 165c0a04e01SBryan Drewery.Em per 166c0a04e01SBryan Dreweryis left empty. 1676ec54a57SEdward Tomasz NapieralaFor example, a filter that matches every rule could be written as ":::=/", 1686ec54a57SEdward Tomasz Napieralaor, in short, ":". 1696ec54a57SEdward Tomasz NapieralaA filter that matches all the login classes would be "loginclass:". 170c0a04e01SBryan DreweryA filter that matches all defined rules for 171c0a04e01SBryan Drewery.Sy maxproc 172c0a04e01SBryan Dreweryresource would be 173a29460e0SEdward Tomasz Napierala"::maxproc". 174c0a04e01SBryan Drewery.Sh SUBJECTS 175c0a04e01SBryan Drewery.Bl -column -offset 3n "pseudoterminals" ".Sy username or numerical User ID" 176c0a04e01SBryan Drewery.It Em subject Ta Em subject-id 177c0a04e01SBryan Drewery.It Sy process Ta numerical Process ID 178c0a04e01SBryan Drewery.It Sy user Ta user name or numerical User ID 179c0a04e01SBryan Drewery.It Sy loginclass Ta login class from 180c0a04e01SBryan Drewery.Xr login.conf 5 181c0a04e01SBryan Drewery.It Sy jail Ta jail name 182c0a04e01SBryan Drewery.El 1836ec54a57SEdward Tomasz Napierala.Sh RESOURCES 18485a2f1b4SEdward Tomasz Napierala.Bl -column -offset 3n "pseudoterminals" 185c0a04e01SBryan Drewery.It Em resource 186c0a04e01SBryan Drewery.It Sy cputime Ta "CPU time, in seconds" 187c0a04e01SBryan Drewery.It Sy datasize Ta "data size, in bytes" 188c0a04e01SBryan Drewery.It Sy stacksize Ta "stack size, in bytes" 189c0a04e01SBryan Drewery.It Sy coredumpsize Ta "core dump size, in bytes" 190c0a04e01SBryan Drewery.It Sy memoryuse Ta "resident set size, in bytes" 191c0a04e01SBryan Drewery.It Sy memorylocked Ta "locked memory, in bytes" 192c0a04e01SBryan Drewery.It Sy maxproc Ta "number of processes" 193c0a04e01SBryan Drewery.It Sy openfiles Ta "file descriptor table size" 194c0a04e01SBryan Drewery.It Sy vmemoryuse Ta "address space limit, in bytes" 195c0a04e01SBryan Drewery.It Sy pseudoterminals Ta "number of PTYs" 196d051ac80SEdward Tomasz Napierala.It Sy swapuse Ta "swap space that may be reserved or used, in bytes" 197c0a04e01SBryan Drewery.It Sy nthr Ta "number of threads" 198c0a04e01SBryan Drewery.It Sy msgqqueued Ta "number of queued SysV messages" 199c0a04e01SBryan Drewery.It Sy msgqsize Ta "SysV message queue size, in bytes" 200c0a04e01SBryan Drewery.It Sy nmsgq Ta "number of SysV message queues" 201c0a04e01SBryan Drewery.It Sy nsem Ta "number of SysV semaphores" 202c0a04e01SBryan Drewery.It Sy nsemop Ta "number of SysV semaphores modified in a single semop(2) call" 203c0a04e01SBryan Drewery.It Sy nshm Ta "number of SysV shared memory segments" 204c0a04e01SBryan Drewery.It Sy shmsize Ta "SysV shared memory size, in bytes" 205c0a04e01SBryan Drewery.It Sy wallclock Ta "wallclock time, in seconds" 206c0a04e01SBryan Drewery.It Sy pcpu Ta "%CPU, in percents of a single CPU core" 207*ae34b6ffSEdward Tomasz Napierala.It Sy readbps Ta "filesystem reads, in bytes per second" 208*ae34b6ffSEdward Tomasz Napierala.It Sy writebps Ta "filesystem writes, in bytes per second" 209*ae34b6ffSEdward Tomasz Napierala.It Sy readiops Ta "filesystem reads, in operations per second" 210*ae34b6ffSEdward Tomasz Napierala.It Sy writeiops Ta "filesystem writes, in operations per second" 2116ec54a57SEdward Tomasz Napierala.El 2126ec54a57SEdward Tomasz Napierala.Sh ACTIONS 21385a2f1b4SEdward Tomasz Napierala.Bl -column -offset 3n "pseudoterminals" 214c0a04e01SBryan Drewery.It Em action 215c0a04e01SBryan Drewery.It Sy deny Ta deny the allocation; not supported for 216*ae34b6ffSEdward Tomasz Napierala.Sy cputime , 217*ae34b6ffSEdward Tomasz Napierala.Sy wallclock , 218*ae34b6ffSEdward Tomasz Napierala.Sy readbps , 219*ae34b6ffSEdward Tomasz Napierala.Sy writebps , 220*ae34b6ffSEdward Tomasz Napierala.Sy readiops , 221c0a04e01SBryan Dreweryand 222*ae34b6ffSEdward Tomasz Napierala.Sy writeiops 223c0a04e01SBryan Drewery.It Sy log Ta "log a warning to the console" 224c0a04e01SBryan Drewery.It Sy devctl Ta "send notification to" 2256ec54a57SEdward Tomasz Napierala.Xr devd 8 226c0a04e01SBryan Dreweryusing 227c0a04e01SBryan Drewery.Sy system 228c0a04e01SBryan Drewery= "RCTL", 229c0a04e01SBryan Drewery.Sy subsystem 230c0a04e01SBryan Drewery= "rule", 231c0a04e01SBryan Drewery.Sy type 232c0a04e01SBryan Drewery= "matched" 233c0a04e01SBryan Drewery.It sig* e.g. 234c0a04e01SBryan Drewery.Sy sigterm ; 235c0a04e01SBryan Drewerysend a signal to the offending process. 2366ec54a57SEdward Tomasz NapieralaSee 2376ec54a57SEdward Tomasz Napierala.Xr signal 3 238c0a04e01SBryan Dreweryfor a list of supported signals 239*ae34b6ffSEdward Tomasz Napierala.It Sy throttle Ta "slow down process execution"; only supported for 240*ae34b6ffSEdward Tomasz Napierala.Sy readbps , 241*ae34b6ffSEdward Tomasz Napierala.Sy writebps , 242*ae34b6ffSEdward Tomasz Napierala.Sy readiops , 243*ae34b6ffSEdward Tomasz Napieralaand 244*ae34b6ffSEdward Tomasz Napierala.Sy writeiops . 245c0a04e01SBryan Drewery.El 2466ec54a57SEdward Tomasz Napierala.Pp 2476ec54a57SEdward Tomasz NapieralaNot all actions are supported for all resources. 248c0a04e01SBryan DreweryAttempting to add a rule with an action not supported by a given resource will 249c0a04e01SBryan Dreweryresult in error. 250ba8f0eb8SEdward Tomasz Napierala.Sh LOADER TUNABLES 251ba8f0eb8SEdward Tomasz NapieralaTunables can be set at the 252ba8f0eb8SEdward Tomasz Napierala.Xr loader 8 253ba8f0eb8SEdward Tomasz Napieralaprompt, or 254ba8f0eb8SEdward Tomasz Napierala.Xr loader.conf 5 . 255ba8f0eb8SEdward Tomasz Napierala.Bl -tag -width indent 256ba8f0eb8SEdward Tomasz Napierala.It Va kern.racct.enable: No 1 257ba8f0eb8SEdward Tomasz NapieralaEnable 258ba8f0eb8SEdward Tomasz Napierala.Nm . 259ba8f0eb8SEdward Tomasz NapieralaThis defaults to 1, unless 260ba8f0eb8SEdward Tomasz Napierala.Cd "options RACCT_DEFAULT_TO_DISABLED" 261ba8f0eb8SEdward Tomasz Napieralais set in the kernel configuration file. 26237cba721SJoel Dahl.El 2636ec54a57SEdward Tomasz Napierala.Sh EXIT STATUS 2646ec54a57SEdward Tomasz Napierala.Ex -std 2656ec54a57SEdward Tomasz Napierala.Sh EXAMPLES 2660a44395eSBryan DreweryPrevent user "joe" from allocating more than 1GB of virtual memory: 2670a44395eSBryan Drewery.Dl Nm Fl a Ar user:joe:vmemoryuse:deny=1g 2686ec54a57SEdward Tomasz Napierala.Pp 2690a44395eSBryan DreweryRemove all RCTL rules: 2700a44395eSBryan Drewery.Dl Nm Fl r Ar \&: 2716ec54a57SEdward Tomasz Napierala.Pp 2720a44395eSBryan DreweryDisplay resource usage information for jail named "www": 2730a44395eSBryan Drewery.Dl Nm Fl hu Ar jail:www 2746ec54a57SEdward Tomasz Napierala.Pp 2750a44395eSBryan DreweryDisplay all the rules applicable to process with PID 512: 2760a44395eSBryan Drewery.Dl Nm Fl l Ar process:512 277c0a04e01SBryan Drewery.Pp 278c0a04e01SBryan DreweryDisplay all rules: 279c0a04e01SBryan Drewery.Dl Nm 280c0a04e01SBryan Drewery.Pp 281c0a04e01SBryan DreweryDisplay all rules matching user "joe": 282c0a04e01SBryan Drewery.Dl Nm Ar user:joe 283c0a04e01SBryan Drewery.Pp 284c0a04e01SBryan DreweryDisplay all rules matching login classes: 285c0a04e01SBryan Drewery.Dl Nm Ar loginclass: 2866ec54a57SEdward Tomasz Napierala.Sh SEE ALSO 287d8c4c833SEdward Tomasz Napierala.Xr rctl.conf 5 2886ec54a57SEdward Tomasz Napierala.Sh HISTORY 2896ec54a57SEdward Tomasz NapieralaThe 2906ec54a57SEdward Tomasz Napierala.Nm 2916ec54a57SEdward Tomasz Napieralacommand appeared in 2926ec54a57SEdward Tomasz Napierala.Fx 9.0 . 2936ec54a57SEdward Tomasz Napierala.Sh AUTHORS 2946ec54a57SEdward Tomasz Napierala.An -nosplit 2956ec54a57SEdward Tomasz NapieralaThe 2966ec54a57SEdward Tomasz Napierala.Nm 2971de5b5ebSEdward Tomasz Napieralawas developed by 2982b7af31cSBaptiste Daroussin.An Edward Tomasz Napierala Aq Mt trasz@FreeBSD.org 2991de5b5ebSEdward Tomasz Napieralaunder sponsorship from the FreeBSD Foundation. 300c0a04e01SBryan Drewery.Sh BUGS 301c0a04e01SBryan DreweryLimiting 302c0a04e01SBryan Drewery.Sy memoryuse 303c0a04e01SBryan Drewerymay kill the machine due to thrashing. 304*ae34b6ffSEdward Tomasz Napierala.Pp 305*ae34b6ffSEdward Tomasz NapieralaThe 306*ae34b6ffSEdward Tomasz Napierala.Sy readiops 307*ae34b6ffSEdward Tomasz Napieralaand 308*ae34b6ffSEdward Tomasz Napierala.Sy writeiops 309*ae34b6ffSEdward Tomasz Napieralacounters are only approximations. 310*ae34b6ffSEdward Tomasz NapieralaLike 311*ae34b6ffSEdward Tomasz Napierala.Sy readbps 312*ae34b6ffSEdward Tomasz Napieralaand 313*ae34b6ffSEdward Tomasz Napierala.Sy writebps , 314*ae34b6ffSEdward Tomasz Napieralathey are calculated in the filesystem layer, where it is difficult 315*ae34b6ffSEdward Tomasz Napieralaor even impossible to observe actual disk device operations. 316*ae34b6ffSEdward Tomasz Napierala.Pp 317*ae34b6ffSEdward Tomasz NapieralaThe 318*ae34b6ffSEdward Tomasz Napierala.Sy writebps 319*ae34b6ffSEdward Tomasz Napieralaand 320*ae34b6ffSEdward Tomasz Napierala.Sy writeiops 321*ae34b6ffSEdward Tomasz Napieralaresources generally account for writes to the filesystem cache, 322*ae34b6ffSEdward Tomasz Napieralanot to actual devices. 323