solaris project限制资源
projmod -a -K "project.max-sem-ids=(priv,100,deny)" user.oracle
projmod -a -K "process.max-sem-nsems=(priv,256,deny)" user.oracle
projmod -a -K "project.max-shm-memory=(priv,4294967295,deny)" user.oracle
projmod -a -K "project.max-shm-ids=(priv,100,deny)" user.oracle
异常
www.MyException.Cn 网友分享于：2014-12-16 浏览：0次
在solaris10上安装ORACLE 12c时遇到：Soft limit:maxmum open file descriptors错误
--配置oracle最大打开文件数限制
Solaris操作系统具有打开文件数量的限制，数据库的db_files参数设置会受操作系统的参数限制。
在solaris10安装12c的过程中出现这样的一个环境检查错误：
Soft Limit: maximum open file descriptors - This is a prerequisite condition to test whether the soft limit for "maximum open file descriptors" is set correctly.
Expected Value : 1024
Actual Value : 256
--查看参数限制：
bash-3.2# ulimit -a
core file size (blocks, -c) unlimited
data seg size (kbytes, -d) unlimited
file size (blocks, -f) unlimited
open files (-n) 256
pipe size (512 bytes, -p) 10
stack size (kbytes, -s) 10240
cpu time (seconds, -t) unlimited
max user processes (-u) 28565
virtual memory (kbytes, -v) unlimited
bash-3.2#
##建议使用第三种方法：
（1）修改/etc/system参数
在Solaris10上，这种方法已经不建议使用，但这种方式仍然有效。/etc/system中设置参数是全局有效的，即所有用户均会受影响。并且设置后，需要重启系统才能生效。
设置方法是在/etc/system文件中增加以下两个参数，然后重启系统。
set rlim_fd_cur=1024
set rlim_fd_max=65535
（2）使用ulimit命令修改（立即生效,一旦当前SHELL退出设置即失效）
ulimit命令只能修改当前SHELL及其子进程的设置，设置后立即生效，'一旦当前SHELL退出设置即失效。-S参数用于设置软限制，-H参数用于设置硬限制'。
ulimit -S -n 65536
ulimit -H -n 65536
--ulimit命令中open files显示的是软限制，可以用prctl命令显示硬限制，即privileged值。
bash-3.2# prctl -i process $$
process: 13110: bash
NAME PRIVILEGE VALUE FLAG ACTION RECIPIENT
process.max-address-space
privileged 16.0EB max deny -
system 16.0EB max deny -
process.max-file-descriptor
basic 256 - deny 13110
privileged 65.5K - deny -
system 2.15G max deny -
process.max-core-size
privileged 8.00EB max deny -
system 8.00EB max deny -
process.max-stack-size
basic 10.0MB - deny 13110
privileged 125TB max deny -
system 125TB max deny -
....
...
...
（3）使用project（立即生效，永久）
project是Solaris10新增加的特性，可以通过设置project参数为一个用户或一组用户设置参数值。设置后可立即生效。
'但是,root用户的结果只受/etc/system里参数的影响，而不受project user.oracle影响，root用户不属于此project. '
以下是设置示例：
bash-3.2# :/ #>projadd user.oracle (创建project user.oracle)
bash-3.2# :/ #>id -p oracle
uid=100(oracle) gid=1(other) projid=100(user.oracle) (oracle用户属于project user.oracle)
bash-3.2# :/ #>projmod -a -K "process.max-file-descriptor=(basic,65534,deny)" user.oracle
bash-3.2# :/ #>projmod -a -K "process.max-file-descriptor=(priv,65535,deny)" user.oracle
bash-3.2# :/ #>grep 'user.oracle' /etc/project
user.oracle:100::::process.max-file-descriptor=(basic,65534,deny),(priv,65535,deny)
设置basic和privilege值分别为65534和65535，不能越过/etc/system中的最大硬限制65535；
bash-3.2# :/ #>tail -2 /etc/system
set rlim_fd_cur=1024
set rlim_fd_max=65535
bash-3.2# plimit $$
13110: bash
resource current maximum
time(seconds) unlimited unlimited
file(blocks) unlimited unlimited
data(kbytes) unlimited unlimited
stack(kbytes) 10240 unlimited
coredump(blocks) unlimited unlimited
nofiles(descriptors) 256 65536
vmemory(kbytes) unlimited unlimited
bash-3.2#
root用户的结果只受/etc/system里参数的影响，而不受project user.oracle影响，root用户不属于此project.
bash-3.2# su - oracle
Oracle Corporation SunOS 5.10 Generic Patch January 2005
-sh: TEMP=/tmp: is not an identifier
$ bash
bash-3.2$ plimit $$
14704: bash
resource current maximum
time(seconds) unlimited unlimited
file(blocks) unlimited unlimited
data(kbytes) unlimited unlimited
stack(kbytes) 10240 unlimited
coredump(blocks) unlimited unlimited
nofiles(descriptors) 65534 65535
vmemory(kbytes) unlimited unlimited
bash-3.2$
其他资源限制的添加如下：
--同样如上进行需要修改其他参数：
noexec_user_stack=1
semsys:seminfo_semmni=100
semsys:seminfo_semmns=1024
semsys:seminfo_semmsl=256
semsys:seminfo_semvmx=32767
shmsys:shminfo_shmmax=4294967295
shmsys:shminfo_shmmni=100
rlim_fd_max=65536
rlim_fd_cur=4096
maxuprc=16384
max_nprocs=3000
projmod -a -K "project.max-sem-ids=(priv,100,deny)" user.oracle
projmod -a -K "process.max-sem-nsems=(priv,256,deny)" user.oracle
projmod -a -K "project.max-shm-memory=(priv,4294967295,deny)" user.oracle
projmod -a -K "project.max-shm-ids=(priv,100,deny)" user.oracle
2018/4/12 文档 429191.1
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-state=1a7n03bmlx_160&id=429191.1 1/6
Copyright (c) 2018, Oracle. All rights reserved.
Kernel setup for Solaris 10 and Solaris 11 using project files (文档 ID 429191.1)
In this Document
Abstract
History
Details
References
APPLIES TO:
Oracle Database - Enterprise Edition - Version 9.2.0.1 and later
Oracle Solaris on SPARC (64-bit)
Oracle Solaris on x86-64 (64-bit)
Solaris Operating System (SPARC 64-bit)
***Checked for relevance on 03-Jan-2013***
ABSTRACT
This is an MOS article that covers kernel parameter setup for Solaris 10 and Solaris 11.
If a Solaris System Administrator needs help implementing these concepts, they will need to contact Oracle's
Solaris support organization.
Expire Date na
DETAILS
Sparc Solaris version 10 and 11
-------------------------------
Generally speaking, information on setting kernel parameters in Solaris 10 and Solaris 11 is limited. There is a
new project file that is used to set kernel parameters (or more generally - any resource control) for the Solaris 10
and Solaris 11 Operating Systems. The remainder of this white paper will be divided into 3 sections to aid in
understanding the configuration of kernel parameters in Solaris 10 and Solaris 11.
Basics
Questions and Answers
Examples
Permanently Setting Kernel Parameters
Temporarily Setting Kernel Parameters
Basics on /etc/projects
===================
1. Specifying a limit in the /etc/project file extends that limit to all processes belonging to the project.
The corresponding ulimit variables that you are concerned with are:
[task|process].max-cpu-time: Maximum CPU time available to processes in this task.
process.max-address-space: Maximum address space.
process.max-core-size: Maximum core dump size.
process.max-data-size: Maximum heap size.
process.max-file-descriptor: Maximum file descriptor index.
process.max-file-size: Maximum file offset allowed for writes.
process.max-stack-size: Maximum stack memory segment available.
2018/4/12 文档 429191.1
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-state=1a7n03bmlx_160&id=429191.1 2/6
2. Now, before I show you an example of an /etc/project file containing IPC settings for both the oracle_oltp and
oracle_dss projects, please allow me to emphasize that the "oracle_oltp:100:Oracle OLTP........" line below is just
one (1) single line with no linebreak. Likewise, the "oracle_dss:101:Oracle DSS......." line below is just one (1)
single line with no linebreak. It is only for readability in this whitepaper document that I break these lines up:
oracle_oltp:100:Oracle OLTP:oracle:: \
project.max-shm-memory=(privileged,51539607552,deny);\
process.max-sem-nsems=(privileged,300,deny)
oracle_dss:101:Oracle DSS:oracle:: \
project.max-shm-memory=(privileged,17179869184,deny)
This sets a limit of 48GB per shared memory segment and 300 semaphores for all processes in the
oracle_oltp project, and a 16GB shared memory segment limit for all processes in the oracle_dss project.
However, according to the Solaris manual the process.max-sem-nsems gives the maximum number of
semaphores per semaphore set, not for the entire project.
The issue is that project.max-shm-memory is not an exact equivalent of shmmax.
shmmax is the max size of an _individual_ segment.
The project.max-shm-memory limit is the __total__ shared memory size for your project.
-- ie maximum total of all your segments.
Similarly, zone.max-shm-memory is the __total__ shared memory size for your zone (see Note:317257.1 for
further information)
http://docs.oracle.com/cd/E19082-01/819-2450/rmctrls-1/index.html
The seminfo_semmns parameter which used to control the maximum number
of semaphores systemwide is obsolete and has been removed as a tunable
parameter.
So you may want to decrease this number. If you find you run out of these you can increase later.
3. The recommended method for modifying the /etc/project file is to use the "proj*" commands,
such as projadd(1) for creating a project and projmod(1) for modifying a project.
Examples of projadd and projmod
# projadd -c "Oracle" 'user.oracle'
# projmod -s -K "project.max-shm-memory=(privileged,6GB,deny)" 'user.oracle'
4. Resource Control assignments made in this way (in the /etc/project file) are permanent, and will survive a
system re-boot. This is covered in much more detail in the example section below.
5. There is also an "on-the-fly" way to temporarily set Resource Control assignments using the prctl(1)
command. However, unlike the /etc/project file, resource assignments made in this way will NOT survive a
system re-boot. Again, this is covered in much more detail in the example section below.
6. Oracle support encourages the use of the "id -p" command. It shows the active and available projects for a
user. If the limits (such as kernel parameters) that you establish within a project are not being activated for a
particular user, the "id -p" will help you to see that the user is not using that project.
==========================================================================
2018/4/12 文档 429191.1
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-state=1a7n03bmlx_160&id=429191.1 3/6
Questions and Answers
===================
Q1: Why can't we just set them the old way?
A1: Actually, you can. While it is not the preferred method, kernel parameter values specified in /etc/system are
still honored, with some caveats:
* Values in /etc/system must be greater than the new default values of Solaris 10 / Solaris 11
* Any kernel parameters tunables that are obsolete in Solaris 10 / Solaris 11 are ignored.
* Values specified in /etc/system are global and affect all processes on the system.
* If you use /etc/system to set IPC rctl values, you must reboot the system for them to take effect.
As a Note here you still must set noexec_user_stack = 1 in the /etc/system file.
==========================================================================
Real World Examples - Permanently Setting Kernel Parameters
================================================
After upgrading a system from Solaris 9 to Solaris 10 or Solaris 11, it was decided that the new IPC resource
control assignment should be used.
The old /etc/system file contained values that were suitable for the Oracle installation on the system,
but these values were too large for average users. The assumption is that all Oracle processes are run under the
'oracle' user.
The contents of the /etc/system file, as pertaining to IPC:
% /bin/egrep "semsys:|shmsys:|msgsys:" /etc/system
set semsys:seminfo_semmni=100 < set semsys:seminfo_semmns=1024
set semsys:seminfo_semmsl=256 < set semsys:seminfo_semvmx=32767
set shmsys:shminfo_shmmax=4294967295 < set shmsys:shminfo_shmmin=1
set shmsys:shminfo_shmmni=256 < set shmsys:shminfo_shmseg=10
Immediately, these lines can be ignored as the tunables are removed in Solaris 10 and Solaris 11:
set semsys:seminfo_semmns=1024
set semsys:seminfo_semvmx=32767
set shmsys:shminfo_shmmin=1
set shmsys:shminfo_shmseg=10
The remaining lines need to have resource controls set up for them. To do so, the first step is that a project must
be created. Since all processes are run under the userid 'oracle', the special "user.oracle" project will be used. For
more details on special projects, consult the Solaris OS project(4) man page or the Resource Management Guide.
# projadd -c "Oracle" 'user.oracle'
A.) Once the project is created, we will assign resource controls corresponding to the remaining lines of the old
/etc/system file that need to be "converted". The first line to consider is:
set semsys:seminfo_semmni=100
Since this "100" value is less than the new Solaris 10 default for project.max-sem-ids of "128", we could either
2018/4/12 文档 429191.1
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-state=1a7n03bmlx_160&id=429191.1 4/6
artificially lower the value to 100 with a specific resource control assignment, or we could choose to accept the
new Solaris 10 default value by simply ignoring the old /etc/system line. We chose to simply ignore it.
B.) The next line of the old /etc/system file that need to be "converted" to a resource control is:
set semsys:seminfo_semmsl=256
Again, this value is less than the new Solaris 10 / Solaris 11 default value for process.max-sem-nsems of 512. In
this case, however, we wish to artificially limit Oracle to only 256 semaphores per process. Therefore we
"convert" this old /etc/system line to a resource control assignment as follows:
# projmod -s -K "process.max-sem-nsems=(privileged,256,deny)" 'user.oracle'
C.) The next line of the old /etc/system file that need to be "converted" to a resource control is:
set shmsys:shminfo_shmmax=4294967295
This system has 8GB of memory. Therefore, this value (4GB, in bytes) is larger than new Solaris 10 / Solaris 11
default value for project.max-shm-memory of "1/4 physmem" (which would be 2GB on this system). Therefore
another resource control assignment must be created:
# projmod -s -K "project.max-shm-memory=(privileged,4GB,deny)" 'user.oracle'
D.) The final line of the old /etc/system file that need to be "converted" to a resource control is:
set shmsys:shminfo_shmmni=256
Again, this value is larger than the new default for project.max-shm-ids so another resource control assignment
needs to be created:
# projmod -s -K "project.max-shm-ids=(privileged,256,deny)" 'user.oracle'
Since there are no more lines from /etc/system that pertain to IPC, we remove the old lines:
# /bin/cp /etc/system /etc/system.solaris9
# /bin/egrep -v "semsys:|shmsys:|msgsys:" /etc/system > /etc/system.solaris10
# /bin/mv /etc/system.solaris10 /etc/system
Now, before I show you our final /etc/project file, please allow me to emphasize that the
"user.oracle:100:oracle:::process........" line below is just one (1) single line with no linebreak. It is only for
readability in this whitepaper document that I break it up:
# cat /etc/project
system:0::::
user.root:1::::
noproject:2::::
default:3::::
group.staff:10::::
***********************
NOTICE this is ONE LINE!
2018/4/12 文档 429191.1
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-state=1a7n03bmlx_160&id=429191.1 5/6
************************
user.oracle:100:oracle:::process.max-sem-nsems=(privileged,256,deny);project.max-shm-ids=
(privileged,256,deny);project.max-shm-memory=(privileged,4294967296,deny) ***********************
NOTICE this is ONE LINE!
************************
========================================================================
Real World Examples - Temporarily Setting Kernel Parameters
================================================
Resource controls can also be set "on the fly" using prctl(1). Unlike the /etc/project file, resource assignments
made in this way will NOT survive a system re-boot. Additionally, the user must have the correct privileges.
The syntax of prctl(1) can, at first, seem complex. Some common usages are:
# prctl -i process <pid>
to list all resource controls for process <pid>
# prctl -i project <project>
to list all resource controls for project <project>
# prctl -n <rctl> -i process <pid>
lists only the resource control named <rctl> for process <pid>
# prctl -n <rctl> -r -v <value> -i process <pid>
replaces (-r) the named rctl setting with the value <value> for process <pid>
Unlike the /etc/project file, prctl allows the use of "scale factors" to simplify resource control management.
Values specified with the -v switch can be "human readable" values such as 48GB instead of the 51539607552
bytes required in the project database.
For example, assuming the preceding /etc/project file we can check the values for the Shared Memory setting for
the oracle_dss project:
% prctl -n project.max-shm-memory -i project oracle_dss
project: 101: oracle_dss
NAME PRIVILEGE VALUE FLAG ACTION RECIPIENT
project.max-shm-memory
privileged 16.0GB - deny -
system 16.0EB max deny -
Should we need to temporarily increase the setting to 24GB:
% prctl -n project.max-shm-memory -r -v 24GB -i project oracle_dss
% prctl -n project.max-shm-memory -i project oracle_dss
project: 101: oracle_dss
NAME PRIVILEGE VALUE FLAG ACTION RECIPIENT
project.max-shm-memory
privileged 24.0GB - deny -
system 16.0EB max deny
2018/4/12 文档 429191.1
https://support.oracle.com/epmos/faces/DocumentDisplay?_adf.ctrl-state=1a7n03bmlx_160&id=429191.1 6/6
未找到您要查找的产品?
REFERENCES
==========
http://docs.oracle.com/cd/E19082-01/819-2450/rmctrls-1/index.html
The prctl(1) man page and System Administration Guide:
Solaris Containers-Resource Management and Solaris Zones provide several useful examples as well.
REFERENCES
NOTE:317257.1 - Running Oracle Database in Solaris 10 Containers - Best Practices