Shulou(Shulou.com)05/31 Report--

This article mainly introduces "what is the basic concept of Linux Cgroup". In daily operation, I believe many people have doubts about what the basic concept of Linux Cgroup is. The editor consulted all kinds of materials and sorted out simple and easy-to-use methods of operation. I hope it will be helpful for you to answer the question of "what is the basic concept of Linux Cgroup?" Next, please follow the editor to study!

Cgroup is a function of Linux kernel: it is a hierarchical group of processes running in a system to which you can allocate resources (such as CPU time, system memory, network bandwidth, or a combination of these resources). By using cgroup, system administrators can exercise fine-grained control over the allocation, sorting, rejection, management, and monitoring of system resources. Hardware resources can be intelligently allocated between applications and users, thereby increasing overall efficiency.

Cgroup is similar to namespace in grouping processes, but its purpose is not the same as namespace. Namespace is to isolate resources between process groups, while cgroup is to monitor and restrict a group of processes.

Cgroup is divided into v1 and v2. V1 is implemented earlier and has more functions, but because the functions in it are implemented sporadically, the planning is not very good, resulting in some inconvenience in use and maintenance. V2 appears to solve this problem in v1. In the latest 4.5 kernel, cgroup v2 claims that it can already be used in the production environment, but the functions it supports are still very limited. Along with v2, cgroup namespace was introduced into the kernel. V1 and v2 can be mixed, but this is more complicated, so no one usually uses it this way.

1. Why do you need cgroup

In Linux, there has always been the concept and requirement of grouping processes, such as session group, progress group and so on. Later, with the increasing demand for this aspect, such as the need to track the memory and IO usage of a group of processes, cgroup appeared, which is used to uniformly group processes, monitor processes and manage resources on the basis of grouping.

two。 What is cgroup?

The term cgroup has different meanings in different contexts. It can refer to the cgroup technology of the entire Linux or to a specific process group.

Cgroup is a mechanism for managing processes by groups under Linux. In the user layer, cgroup technology is to organize all processes in the system into an independent tree, each tree contains all the processes of the system, each node of the tree is a process group, and each tree is associated with one or more subsystem, the role of the tree is to group processes, and the role of subsystem is to operate these groups. Cgroup mainly includes the following two parts:

Subsystem: a subsystem is a kernel module, and after it is associated with a cgroup tree, specific operations are done on each node (process group) of the tree. Subsystem is often called resource controller because it is mainly used to schedule or restrict the resources of each process group, but this is not entirely accurate, because sometimes we group processes just to do some monitoring and observe their status, such as perf_event subsystem. So far, Linux supports 12 kinds of subsystem, such as limiting the usage time of CPU, limiting the amount of memory used, counting the usage of CPU, freezing and resuming a set of processes, and so on.

Hierarchy: a hierarchy can be understood as a cgroup tree. Each node of the tree is a process group, and each tree is associated with zero or more subsystem. In a tree, it will contain all the processes in the Linux system, but each process can only belong to one node (process group). There can be many cgroup trees in the system, and each tree is associated with a different subsystem. A process can belong to multiple trees, that is, a process can belong to multiple process groups, but these process groups are associated with different subsystem. Currently, Linux supports 12 kinds of subsystem. Without considering the situation that is not associated with any subsystem (as is the case with systemd), a maximum of 12 cgroup trees can be built in Linux, each tree can be associated with one subsystem. Of course, only one tree can be built, and then the tree can be associated with all subsystem. When a cgroup tree is not associated with any subsystem, it means that the tree only groups processes, and it is up to the application to decide what to do on the basis of grouping. Systemd is a case in point.

3. Think of resources as a piece of cake

On CentOS 7 systems, including Red Hat Enterprise Linux 7, resource management settings can be moved from the process level to the application level by bundling the cgroup hierarchical system with the systemd unit tree. By default, systemd automatically creates a hierarchy of slice, scope, and service units (the exact meaning will be explained later) to provide a unified structure for the cgroup tree. You can further modify this structure by creating a custom slice with the systemctl command.

If we treat the resources of the system as a pie, then all resources will be divided into three cgroup:System, User and Machine by default. Each cgroup is a slice, and each slice can have its own child slice, as shown in the following figure:

Let's take the CPU resource as an example to explain some of the keywords that appear in the figure above.

As shown in the figure above, the system creates three top-level slice (System, User and Machine) by default, and each slice gets the same CPU usage time (effective only when CPU is busy). If user.slice wants to get 100% CPU usage time, and CPU is idle at this time, then user.slice can get its wish. The meanings of these three top-level slice are as follows:

System.slice-the default location for all system service

User.slice-the default location for all user sessions. Each user session creates a sub-slice under that slice, and if the same user logs in to the system multiple times, the same sub-slice will still be used.

Machine.slice-the default location for all virtual machines and Linux containers

One of the ways to control the use of CPU resources is shares. Shares is used to set the relative value of CPU (which you can understand as weight) and is for all CPU (kernel). The default value is 1024. So in the image above, the CPU shares of httpd, sshd, crond and gdm is 1024, and the CPU shares of User and Machine is also 1024.

Suppose four service are running on the system, two users are logged in, and a virtual machine is running. Also assume that each process requires as many CPU resources as possible (each process is busy).

System.slice gets 33.333% of the CPU usage time, where each service gets a CPU usage time of 1 to 4, or 8.25% of the CPU usage time, from the resources allocated by system.slice.

User.slice gets 33.333% CPU usage time, in which every logged-in user gets 16.5% CPU usage time. Suppose you have two users, tom and jack, and if tom logs out or kills all processes under that user's session, jack can use 33.333% of the CPU usage time.

Machine.slice will get 33.333% of the CPU usage time, and if the virtual machine is turned off or in the idle state, then system.slice and user.slice will each get 50% of the CPU resources from the 33.333% CPU resources and distribute them equally to their child slice.

If you want to strictly control CPU resources, set an upper limit for the use of CPU resources, that is, no matter whether the CPU is busy or not, the use of CPU resources cannot exceed this limit. You can set it with the following two parameters:

Cpu.cfs_period_us = the period of CPU usage time in microseconds (us) cpu.cfs_quota_us = the CPU time allowed in the cycle (refers to the time of single core, while multi-core needs to be accumulated at setting time)

Systemctl can use the CPUQuota parameter to set the upper limit of CPU resource usage. For example, if you want to set the limit of CPU resource usage for user tom to 20%, you can execute the following command:

$systemctl set-property user-1000.slice CPUQuota=20%

When using the command systemctl set-property, you can use tab completion:

$systemctl set-property user-1000.sliceAccuracySec= CPUAccounting= Environment= LimitCPU= LimitNICE= LimitSIGPENDING= SendSIGKILL=BlockIOAccounting= CPUQuota= Group= LimitDATA= LimitNOFILE= LimitSTACK= User=BlockIODeviceWeight= CPUShares= KillMode= LimitFSIZE= LimitNPROC= MemoryAccounting= WakeSystem=BlockIOReadBandwidth= DefaultDependencies= KillSignal= LimitLOCKS= LimitRSS= MemoryLimit=BlockIOWeight= DeviceAllow= LimitAS= LimitMEMLOCK= LimitRTPRIO= Nice=BlockIOWriteBandwidth= DevicePolicy= LimitCORE= LimitMSGQUEUE= LimitRTTIME= SendSIGHUP=

There are many properties that can be set, but not all of them are used to set cgroup. We just need to focus on Block, CPU, and Memory.

If you want to set up cgroup,service through the configuration file, you can create the corresponding configuration file directly under the / etc/systemd/system/xxx.service.d directory, and slice can create the corresponding configuration file directly under the / run/systemd/system/xxx.slice.d directory. In fact, setting cgroup through the systemctl command line tool will also be written to the configuration file in this directory:

$cat / run/systemd/system/user-1000.slice.d/50- CPUQuota.confu [slice] CPUQuota=20%

View the corresponding cgroup parameters:

$cat / sys/fs/cgroup/cpu,cpuacct/user.slice/user-1000.slice/cpu.cfs_period_us100000 $cat / sys/fs/cgroup/cpu,cpuacct/user.slice/user-1000.slice/cpu.cfs_quota_us20000

This means that the user tom can use 20 milliseconds of CPU time in one life cycle (100ms). Regardless of whether the CPU is free or not, the CPU resources used by the user will not exceed this limit.

The value of CPUQuota can exceed 100%. For example, if the CPU of the system is multicore and the value of CPUQuota is 200%, then the slice can use 2-core CPU time.

At this point, the study of "what is the basic concept of Linux Cgroup" is over. I hope to be able to solve your doubts. The collocation of theory and practice can better help you learn, go and try it! If you want to continue to learn more related knowledge, please continue to follow the website, the editor will continue to work hard to bring you more practical articles!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.