Subject: Re: [vserver] Re: Is writing to om_adj important ?
From: "Michael S. Zick" <mszick@morethan.org>
Date: Mon, 26 Jan 2009 08:02:55 -0600

On Mon January 26 2009, Declan Mullen wrote:
> Hi
> 
> I've just read the kernel documentation for "oom_adj" 
> (filesytems/proc.txt) :
> 
>   2.12 /proc/<pid>/oom_adj - Adjust the oom-killer score
>   ------------------------------------------------------
>   This file can be used to adjust the score used to select which processes
>   should be killed in an  out-of-memory  situation.  Giving it a high 
> score will
>   increase the likelihood of this process being killed by the 
> oom-killer.  Valid
>   values are in the range -16 to +15, plus the special value -17, which 
> disables
>   oom-killing altogether for this process.
> 
> So I think I can ignore these errors.
> 

It looks like from that snippet of documentation that setting sshd
to -17 in the case where ssh/sshd is the _only_ or _last resort_
means of access to a guest for service or maintenance would be handy. ;)

Otherwise the only way to recover control of a wild guest might be
to re-boot the host.  And your application might make that un-desirable.
(Think of force re-starting 100 guests for one "bad guy").

Mike
> All the best,
> Declan
> 
> 
> Declan Mullen wrote:
> > Hi
> >
> > When I ssh into my Linux server, the login succeeds but I notice that 
> > I get the following type of entry appended to the auth.log :
> >
> >    Jan 26 17:10:45 maxv1 sshd[32624]: error writing 
> > /proc/self/oom_adj: Permission denied
> >
> > What are the implications of the sshd not being able to write to the 
> > oom_adj ? Ie Is this error significant or should I just ignore it ?
> >
> > The sshd's write is failing because the server I'm logging into is a 
> > VServer guest/virtual server, and the VServer virtualisation 
> > technology places restrictions on what can be written to the /proc 
> > filesystem from within the guest.
> >
> > The guest server OS is Debian Lenny and the sshd versions is 
> > "1:5.1p1-5". Within the sshd_config Privilege Separation is turned on.
> >
> > The host server's kernel is Lenny's "linux-source-2.6.26" (version 
> > "2.6.26-13") with Lenny's vserver patches applied from 
> > "linux-patch-debian-2.6.26" (version "2.6.26-13"). The host's 
> > util-vserver package is version "0.30.216~r2772-6". The host's
> > "vserver-debiantools" package is version "0.6.3".
> >
> > Many thanks,
> > Declan
> >
> >
> >
> >
> >
> 
> 
>