Interaction with Solaris Zones

System Administration Guide: Oracle® Solaris Containers-Resource Management and Oracle Solaris Zones

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing. If this is software or related software documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are “commercial computer software” or “commercial technical data” pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, duplication, disclosure, modification, and adaptation shall be subject to the restrictions and license terms setforth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications which may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, andservices.Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products,orservices.

Copyright © 2004, 2010, Oracle et/ou ses affiliés. Tous droits réservés. Ce logiciel et la documentation qui l’accompagne sont protégés par les lois sur la propriété intellectuelle. Ils sont concédés sous licence et soumis à des restrictions d’utilisation et de divulgation. Sauf disposition de votre contrat de licence ou de la loi, vous ne pouvez pas copier, reproduire, traduire, diffuser, modifier, breveter, transmettre, distribuer, exposer, exécuter, publier ou afficher le logiciel, même partiellement, sous quelque forme et par quelque procédé quecesoit. Par ailleurs, il est interdit de procéder à toute ingénierie inverse du logiciel, de le désassembler ou de le décompiler, excepté à des fins d’interopérabilité avec des logiciels tiers ou tel que prescrit par la loi. Les informations fournies dans ce document sont susceptibles de modification sans préavis. Par ailleurs, Oracle Corporation ne garantit pas qu’elles soient exemptes d’erreurset vous invite, le cas échéant, à lui en faire part par écrit. Si ce logiciel, ou la documentation qui l’accompagne, est concédé sous licence au Gouvernement des Etats-Unis, ou à toute entité qui délivre la licence de ce logiciel ou l’utilise pour le compte du Gouvernement des Etats-Unis, la notice suivante s’applique : U.S. GOVERNMENT RIGHTS. Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, the use, duplication, disclosure, modification, and adaptation shall be subject to the restrictions and license terms setforth in the applicable Government contract, and, to the extent applicable by the terms of the Government contract, the additional rights set forth in FAR 52.227-19, Commercial Computer Software License (December 2007). Oracle America, Inc., 500 Oracle Parkway, Redwood City, CA 94065. Ce logiciel ou matériel a été développé pour un usage général dans le cadre d’applications de gestion des informations. Ce logiciel ou matériel n’estpas conçu ni n’est destiné à être utilisé dans des applications à risque, notamment dans des applications pouvant causer des dommages corporels. Si vous utilisez ce logiciel ou matériel dans le cadre d’applications dangereuses, il est de votre responsabilité de prendre toutes les mesures de secours, de sauvegarde, de redondance et autres mesures nécessaires à son utilisation dans des conditions optimales de sécurité. Oracle Corporation et ses affiliés déclinent toute responsabilité quant aux dommages causés par l’utilisation de ce logiciel ou matériel pour ce type d’applications. Oracle et Java sont des marques déposées d’Oracle Corporation et/ou de ses affiliés.Tout autre nom mentionné peut correspondre à des marques appartenant à d’autres propriétaires qu’Oracle. AMD, Opteron, le logo AMD et le logo AMD Opteron sont des marques ou des marques déposées d’Advanced Micro Devices. Intel et Intel Xeon sont des marques ou des marques déposées d’Intel Corporation. Toutes les marques SPARC sont utilisées sous licence et sont des marques ou des marques déposées de SPARC International, Inc. UNIX est une marque déposée concédé sous license par X/Open Company, Ltd.

101015@24999 Contents

Preface ...... 25

Part I Resource Management ...... 31

1 Introduction to Solaris 10 Resource Management ...... 33 Resource Management Overview ...... 33 Resource Classifications ...... 34 Resource Management Control Mechanisms ...... 35 Resource Management Configuration ...... 36 Interaction With Solaris Zones ...... 36 When to Use Resource Management ...... 36 Server Consolidation ...... 37 Supporting a Large or Varied User Population ...... 37 Setting Up Resource Management (Task Map) ...... 38

2 Projects andTasks (Overview) ...... 41 What's New in Project Database and Resource Control Commands for Solaris 10? ...... 41 Project and Task Facilities ...... 42 Project Identifiers ...... 42 Determining a User's Default Project ...... 43 Setting User Attributes With the useradd, usermod, and passmgmt Commands ...... 43 project Database ...... 44 PAM Subsystem ...... 44 Naming Services Configuration ...... 45 Local /etc/project File Format ...... 45 Project Configuration for NIS ...... 47 Project Configuration for LDAP ...... 47

3 Contents

Task Identifiers ...... 47 Commands Used With Projects and Tasks ...... 49

3 Administering Projects andTasks ...... 51 Administering Projects and Tasks (Task Map) ...... 51 Example Commands and Command Options ...... 52 Command Options Used With Projects and Tasks ...... 52 Using cron and su With Projects and Tasks ...... 54 Administering Projects ...... 54 ▼ How to Define a Project and View the Current Project ...... 54 ▼ How to Delete a Project From the /etc/project File ...... 57 How to Validate the Contents of the /etc/project File ...... 58 How to Obtain Project Membership Information ...... 58 ▼ How to Create a New Task ...... 58 ▼ How to Move a Running Process Into a New Task ...... 59 Editing and Validating Project Attributes ...... 60 ▼ How to Add Attributes and Attribute Values to Projects ...... 60 ▼ How to Remove Attribute Values From Projects ...... 60 ▼ How to Remove a Resource Control Attribute From a Project ...... 61 ▼ How to Substitute Attributes and Attribute Values for Projects ...... 61 ▼ How to Remove the Existing Values for a Resource Control Attribute ...... 62

4 Extended Accounting (Overview) ...... 63 What's New in Extended Accounting for Solaris 10? ...... 63 Introduction to Extended Accounting ...... 64 How Extended Accounting Works ...... 64 Extensible Format ...... 65 exacct Records and Format ...... 65 Using Extended Accounting on a Solaris System With Zones Installed ...... 66 Extended Accounting Configuration ...... 6 Commands Used With Extended Accounting ...... 66 Perl Interface to libexacct ...... 67

4 System Administration Guide: Oracle Solaris Containers-Resource Management and Oracle Solaris Zones • September 2010 Contents

5 Administering Extended Accounting (Tasks) ...... 71 Administering the Extended Accounting Facility (Task Map) ...... 71 Using Extended Accounting Functionality ...... 72 ▼ How to Activate Extended Accounting for Processes, Tasks, and Flows ...... 72 How to Activate Extended Accounting With a Startup Script ...... 72 How to Display Extended Accounting Status ...... 73 How to View Available Accounting Resources ...... 73 ▼ How to Deactivate Process, Task, and Flow Accounting ...... 74 Using the Perl Interface to libexacct ...... 75 How to Recursively Print the Contents of an exacct Object ...... 75 How to Create a New Group Record and Write It to a File ...... 76 How to Print the Contents of an exacct File ...... 77 Example Output From Sun::Solaris::Exacct::Object->dump() ...... 77

6 Resource Controls (Overview) ...... 79 What's New in Resource Controls for Solaris 10? ...... 79 Resource Controls Concepts ...... 80 Resource Limits and Resource Controls ...... 80 Interprocess Communication and Resource Controls ...... 81 Resource Control Constraint Mechanisms ...... 81 Project Attribute Mechanisms ...... 81 Configuring Resource Controls and Attributes ...... 82 Available Resource Controls ...... 83 Zone-Wide Resource Controls ...... 85 Units Support ...... 87 Resource Control Values and Privilege Levels ...... 88 Global and Local Actions on Resource Control Values ...... 88 Resource Control Flags and Properties ...... 90 Resource Control Enforcement ...... 92 Global Monitoring of Resource Control Events ...... 92 Applying Resource Controls ...... 92 Temporarily Updating Resource Control Values on a Running System ...... 93 Updating Logging Status ...... 93 Updating Resource Controls ...... 93 Commands Used With Resource Controls ...... 94

5 Contents

7 Administering Resource Controls (Tasks) ...... 95 Administering Resource Controls (Task Map) ...... 95 Setting Resource Controls ...... 96 ▼ How to Set the Maximum Number of LWPs for Each Task in a Project ...... 96 ▼ How to Set Multiple Controls on a Project ...... 97 Using the prctl Command ...... 98 ▼ How to Use the prctl Command to Display Default Resource Control Values ...... 98 ▼ How to Use the prctl Command to Display Information for a Given Resource Control 100 ▼ HowtoUseprctl to Temporarily Change a Value ...... 100 ▼ HowtoUseprctl to Lower a Resource Control Value ...... 101 ▼ HowtoUseprctl to Display, Replace, and Verify the Value of a Control on a Project ... 101 Using rctladm ...... 102 HowtoUserctladm ...... 102 Using ipcs ...... 103 HowtoUseipcs ...... 103 Capacity Warnings ...... 103 ▼ How to Determine Whether a Web Server Is Allocated Enough CPU Capacity ...... 104

8 Fair Share Scheduler (Overview) ...... 105 Introduction to the Scheduler ...... 105 CPU Share Definition ...... 106 CPU Shares and Process State ...... 107 CPU Share Versus Utilization ...... 107 CPU Share Examples ...... 107 Example 1: Two CPU-Bound Processes in Each Project ...... 108 Example 2: No Competition Between Projects ...... 108 Example 3: One Project Unable to Run ...... 109 FSS Configuration ...... 109 Projects and Users ...... 109 CPU Shares Configuration ...... 110 FSS and Processor Sets ...... 111 FSS and Processor Sets Examples ...... 111 Combining FSS With Other Scheduling Classes ...... 113 Setting the Scheduling Class for the System ...... 113 Scheduling Class on a System with Zones Installed ...... 114

6 System Administration Guide: Oracle Solaris Containers-Resource Management and Oracle Solaris Zones • September 2010 Contents

Commands Used With FSS ...... 114

9 Administering the Fair Share Scheduler (Tasks) ...... 115 Administering the Fair Share Scheduler (Task Map) ...... 115 Monitoring the FSS ...... 116 ▼ How to Monitor System CPU Usage by Projects ...... 116 ▼ How to Monitor CPU Usage by Projects in Processor Sets ...... 116 Configuring the FSS ...... 116 ▼ How to Make FSS the Default Scheduler Class ...... 117 ▼ How to Manually Move Processes From the TS Class Into the FSS Class ...... 117 ▼ How to Manually Move Processes From All User Classes Into the FSS Class ...... 118 ▼ How to Manually Move a Project's Processes Into the FSS Class ...... 118 How to Tune Scheduler Parameters ...... 119

10 Physical Memory Control Using the Resource Capping Daemon (Overview) ...... 121 What's New in Physical Memory Control Using the Resource Capping Daemon? ...... 121 Introduction to the Resource Capping Daemon ...... 122 How Resource Capping Works ...... 122 Attribute to Limit Physical Memory Usage for Projects ...... 123 rcapd Configuration ...... 123 Using the Resource Capping Daemon on a System With Zones Installed ...... 124 Memory Cap Enforcement Threshold ...... 124 Determining Cap Values ...... 125 rcapd Operation Intervals ...... 126 Monitoring Resource Utilization With rcapstat ...... 128 Commands Used With rcapd ...... 129

11 Administering the Resource Capping Daemon (Tasks) ...... 131 Configuring and Using the Resource Capping Daemon (Task Map) ...... 131 Administering the Resource Capping Daemon With rcapadm ...... 132 ▼ How to Set the Memory Cap Enforcement Threshold ...... 132 ▼ How to Set Operation Intervals ...... 133 ▼ How to Enable Resource Capping ...... 133 ▼ How to Disable Resource Capping ...... 134

7 Contents

▼ How to Specify a Temporary Resource Cap for a Zone ...... 134 Producing Reports With rcapstat ...... 135 Reporting Cap and Project Information ...... 135 Monitoring the RSS of a Project ...... 135 Determining the Working Set Size of a Project ...... 136 Reporting Memory Utilization and the Memory Cap Enforcement Threshold ...... 137

12 Resource Pools (Overview) ...... 139 What's New in Resource Pools and Dynamic Resource Pools? ...... 140 Introduction to Resource Pools ...... 140 Introduction to Dynamic Resource Pools ...... 141 About Enabling and Disabling Resource Pools and Dynamic Resource Pools ...... 141 Resource Pools Used in Zones ...... 142 When to Use Pools ...... 142 Resource Pools Framework ...... 144 Implementing Pools on a System ...... 145 project.pool Attribute ...... 146 SPARC: Dynamic Reconfiguration Operations and Resource Pools ...... 146 Creating Pools Configurations ...... 147 Directly Manipulating the Dynamic Configuration ...... 147 poold Overview ...... 148 Managing Dynamic Resource Pools ...... 148 Configuration Constraints and Objectives ...... 148 Configuration Constraints ...... 149 Configuration Objectives ...... 150 poold Properties ...... 152 poold Features That Can Be Configured ...... 153 poold Monitoring Interval ...... 153 poold Logging Information ...... 153 Logging Location ...... 155 Log Management With logadm ...... 156 How Dynamic Resource Allocation Works ...... 156 About Available Resources ...... 156 Determining Available Resources ...... 156 Identifying a Resource Shortage ...... 157

8 System Administration Guide: Oracle Solaris Containers-Resource Management and Oracle Solaris Zones • September 2010 Contents

Determining Resource Utilization ...... 157 Identifying Control Violations ...... 158 Determining Appropriate Remedial Action ...... 158 Using poolstat to Monitor the Pools Facility and Resource Utilization ...... 159 poolstat Output ...... 159 Tuning poolstat Operation Intervals ...... 160 Commands Used With the Resource Pools Facility ...... 160

13 Creating and Administering Resource Pools (Tasks) ...... 163 Administering Dynamic Resource Pools (Task Map) ...... 163 Enabling and Disabling the Pools Facility ...... 165 ▼ Solaris 10 11/06 and Later: How to Enable the Resource Pools Service Using svcadm ...... 165 ▼ Solaris 10 11/06 and Later: How to Disable the Resource Pools Service Using svcadm ..... 165 ▼ Solaris 10 11/06 and Later: How to Enable the Dynamic Resource Pools Service Using svcadm ...... 166 ▼ Solaris 10 11/06 and Later: How to Disable the Dynamic Resource Pools Service Using svcadm ...... 168 ▼ How to Enable Resource Pools Using pooladm ...... 168 ▼ How to Disable Resource Pools Using pooladm ...... 169 Configuring Pools ...... 169 ▼ How to Create a Static Configuration ...... 169 ▼ How to Modify a Configuration ...... 171 ▼ How to Associate a Pool With a Scheduling Class ...... 173 ▼ How to Set Configuration Constraints ...... 174 ▼ How to Define Configuration Objectives ...... 175 ▼ How to Set the poold Logging Level ...... 177 ▼ How to Use Command Files With poolcfg ...... 177 Transferring Resources ...... 178 ▼ How to Move CPUs Between Processor Sets ...... 178 Activating and Removing Pool Configurations ...... 179 ▼ How to Activate a Pools Configuration ...... 179 ▼ How to Validate a Configuration Before Committing the Configuration ...... 179 ▼ How to Remove a Pools Configuration ...... 180 Setting Pool Attributes and Binding to a Pool ...... 181 ▼ How to Bind Processes to a Pool ...... 181 ▼ How to Bind Tasks or Projects to a Pool ...... 181

9 Contents

▼ How to Set the project.pool Attribute for a Project ...... 182 ▼ HowtoUseproject Attributes to Bind a Process to a Different Pool ...... 182 Using poolstat to Report Statistics for Pool-Related Resources ...... 183 Displaying Default poolstat Output ...... 183 Producing Multiple Reports at Specific Intervals ...... 183 Reporting Resource Set Statistics ...... 183

14 Resource Management Configuration Example ...... 185 Configuration to Be Consolidated ...... 185 Consolidation Configuration ...... 186 Creating the Configuration ...... 186 Viewing the Configuration ...... 187

15 Resource Control Functionality in the Solaris Management Console ...... 193 Using the Console (Task Map) ...... 193 Console Overview ...... 194 Management Scope ...... 194 Performance Tool ...... 194 ▼ How to Access the Performance Tool ...... 195 Monitoring by System ...... 195 Monitoring by Project or User Name ...... 196 Resource Controls Tab ...... 198 ▼ How to Access the Resource Controls Tab ...... 199 Resource Controls You Can Set ...... 199 Setting Values ...... 200 Console References ...... 200

Part II Zones ...... 203

16 Introduction to Solaris Zones ...... 205 Zones Overview ...... 205 About Branded Zones ...... 206 When to Use Zones ...... 207 How Zones Work ...... 209

10 System Administration Guide: Oracle Solaris Containers-Resource Management and Oracle Solaris Zones • September 2010 Contents

Summary of Zone Features ...... 210 How Non-Global Zones Are Administered ...... 211 How Non-Global Zones Are Created ...... 211 Non-Global Zone State Model ......