SEO

Hello!

I'm running Lotus Domino on Slackware 9.1. Domino needs a limit of maximum
processes per user and maximum open files per user to be increased from
their defaults.

Since Domino runs under it's own user account 'lotus', I started by
creating the following /etc/limits:

lotus N40000 U14000

When I log in from console as lotus, I can check with ulimit -n and
ulimit -u that these values are, indeed, applied.

However, Domino is started automatically at boot time with a script in
/etc/rc.d. Here's the relevant command:

su - lotus -c "opt/lotus/bin/server" > /dev/null 2>&1 &

It seems to me that in this case the limits defined for user lotus in
/etc/limits.conf are not applied. I added a line immediately before this
line in the script:

su - lotus -c "ulimit -n > /tmp/maxfiles"

and the result was 1024.

What (if anything) can I do to increase the limits for Domino processes
started in this way?

Logging in as user lotus each time the server starts and starting Domino
manually is not a good solution :-)

Thanks in advance,
--
Toomas Aas

On Thu, 29 Jan 2004 23:11:14 +0200, Toomas Aas wrote:

> Hello!

Wahzap.

> When I log in from console as lotus, I can check with ulimit -n and
> ulimit -u that these values are, indeed, applied.
>
> However, Domino is started automatically at boot time with a script in
> /etc/rc.d. Here's the relevant command:
>
> su - lotus -c "opt/lotus/bin/server" > /dev/null 2>&1 &
....
> What (if anything) can I do to increase the limits for Domino processes
> started in this way?

Try executeing a new shell from "su", ie:

su - lotus -c "exec /bin/bash -c opt/lotus/bin/server" > /dev/null 2>&1 &

( You might have to tweak that a bit to fit your specific setup though,
like maybe: "exec /bin/bash -l -c /opt/lotus/bin/server" or some such. )

HTH.

--
-Menno.

Menno Duursma <menno@desktop.lan> wrote in
newsan.2004.01.30.00.41.14.595731@desktop.lan:

Hi!

>> When I log in from console as lotus, I can check with ulimit -n and
>> ulimit -u that these values are, indeed, applied.
>>
>> However, Domino is started automatically at boot time with a script in
>> /etc/rc.d. Here's the relevant command:
>>
>> su - lotus -c "opt/lotus/bin/server" > /dev/null 2>&1 & ...
>> What (if anything) can I do to increase the limits for Domino
>> processes started in this way?
>
> Try executeing a new shell from "su", ie:
>
> su - lotus -c "exec /bin/bash -c opt/lotus/bin/server" > /dev/null 2>&1
> &
>
> ( You might have to tweak that a bit to fit your specific setup though,
> like maybe: "exec /bin/bash -l -c /opt/lotus/bin/server" or some
> such. )

Thanks for the idea. It doesn't look too hopeful, though. I tried the
following while being logged in as root:

su lotus -c "exec /bin/bash -l -c \"ulimit -n\""

It returned 1024.

It seems to me that the only case when the limits from /etc/limits are
applied is when the login(1) program actually runs, i.e. when logging in
from the server console or invoking "su lotus" as a non-root user. For
example, when I log in as lotus via ssh, the limits are not applied. I may
be way off base here, though, since I'm really no Linux expert.

If I can't apply the limits from /etc/limits, is there maybe a way to
increase the default limit of 1024? Where is this set?

--
Toomas Aas

In article <Xns947FEBE003AD3vatsonatmyrealboxdot@194.126.101. 124>,
Toomas Aas <Toomas.Aas@mail.ee> wrote:
>Hello!
>
>I'm running Lotus Domino on Slackware 9.1. Domino needs a limit of maximum
>processes per user and maximum open files per user to be increased from
>their defaults.
>
>Since Domino runs under it's own user account 'lotus', I started by
>creating the following /etc/limits:
>
>lotus N40000 U14000

Good, but . . .

>
>When I log in from console as lotus, I can check with ulimit -n and
>ulimit -u that these values are, indeed, applied.

.. . . /bin/login reads /etc/limits and before switching user/group
it uses its root priviliges to set resource limits. Root privilige
is needed to increase limits.

>
>However, Domino is started automatically at boot time with a script in
>/etc/rc.d. Here's the relevant command:
>
>su - lotus -c "opt/lotus/bin/server" > /dev/null 2>&1 &
>
>It seems to me that in this case the limits defined for user lotus in
>/etc/limits.conf are not applied. I added a line immediately before this
>line in the script:
>
>su - lotus -c "ulimit -n > /tmp/maxfiles"
>
>and the result was 1024.

Apparently su doesn't care about /etc/limits.

>
>What (if anything) can I do to increase the limits for Domino processes
>started in this way?

To invoke from an init script, you might write a program in a
language that can make system calls (e.g. C, perl) that uses
its root privilege to setrlimit() to your heart's content,
then switches real and effective uid and gid, then exec*()s
your program -- with all due security paranoia checks, of course.
It might even wait on the program and `respawn' (in init terminology)
it if more time than some lower limit has passed (to prevent rapid
respawning due to some error). This approach could be error
prone.

I think it was mentioned in another followup that you might have
init start your program in certain runlevels. This would probably
be safer and easier than writing your own executor program. The
trick is to use /bin/login to set your resource limits. With
Slack's shadow login you must ensure the account has a password
(apparently you already have), has a valid home dir and shell.
Add a line like this to /etc/inittab:

ug:3:respawn:/bin/login -h localhost -f lotus

The -f option is available only to root, and says account is
authorized (don't prompt for password), _but_ -f only works
along with -h, _and_ if the account has a password! That is not
properly documented in login(1), but the source and a test say
it is so.

From there, just arrange that the shell's startup procedure checks
the executable and any anything else you can think of, then invokes
or exec's the program. If you invoke and wait, you can also check
elapsed time and sleep as necessary before exiting to prevent rapid
respawns. logger is cool too. Test well, then telinit q. With
this approach you should be able to test by logging in.

HTH,
Ed


--
U2=h; U0=e; U1=v; # "s/\<.\{1,\}@/$U0$U1$U2@/" for address
"[...] if I may, Your Honor, just so you know I'm not making this stuff
up, or at least I am not making it up *new* [...]"
-- Kevin McBride, representing SCO [emphasis added]

Toomas Aas wrote in
news:Xns947FEBE003AD3vatsonatmyrealboxdot@194.126. 101.124:

> I'm running Lotus Domino on Slackware 9.1. Domino needs a limit of
> maximum processes per user and maximum open files per user to be
> increased from their defaults.
>
> Since Domino runs under it's own user account 'lotus', I started by
> creating the following /etc/limits:
>
> lotus N40000 U14000
>
> When I log in from console as lotus, I can check with ulimit -n and
> ulimit -u that these values are, indeed, applied.
>
> However, Domino is started automatically at boot time with a script in
> /etc/rc.d. Here's the relevant command:
>
> su - lotus -c "opt/lotus/bin/server" > /dev/null 2>&1 &
>
> It seems to me that in this case the limits defined for user lotus in
> /etc/limits.conf are not applied.

Well, I found a partial workaround. I replaced the line above with this:
su - lotus -c "ulimit -n 10000 && opt/lotus/bin/server" > /dev/null 2>&1 &

I confirmed that this does indeed work by putting
ulimit -n > /tmp/maxfiles
between those two commands above. /tmp/maxfiles read 10000.

I was initially lead to think that I can't do this by two things
- 'man bash' says that most systems don't allow ulimit -n to be changed
- I tried it with a value of 40000 and it failed.

It seems that 10000 is some kind of built in limit (of bash?), because
ulimit -n 10001 fails.

I hope that this solves my problems - with default max files limit of 1024
Domino occasionally complained that it has run out of sockets during
daytime when lots of users were logged in. Now that the limit is ~10 times
higher, it will hopefully be happy. IBM thinks, though, that this limit
should be set to 49152. I guess Monday will show.

On Fri, 30 Jan 2004 16:07:55 +0200, Toomas Aas wrote:
> Menno Duursma <menno@desktop.lan> wrote:

[ Ed made a good "login" suggestion, so this may be redundant info. ]

>> su - lotus -c "exec /bin/bash -c opt/lotus/bin/server" > /dev/null 2>&1
>> &
>>
>> ( You might have to tweak that a bit to fit your specific setup though,
>> like maybe: "exec /bin/bash -l -c /opt/lotus/bin/server" or some
>> such. )
>
> Thanks for the idea. It doesn't look too hopeful, though. I tried the
> following while being logged in as root:
>
> su lotus -c "exec /bin/bash -l -c \"ulimit -n\""

Lets see:

root@desktop:~# cat /etc/limits
# Test some limit
druiloor N40000 U14000
root@desktop:~# su druiloor -c "exec /bin/bash -c \"ulimit -n\""
1024
root@desktop:~# su druiloor -c "exec /bin/bash -c ulimit -n"
unlimited

So here, i guess you'd need something more allong tease lines:

su - lotus -l -c 'exec /opt/lotus/bin/server' >/dev/null 2>&1

--
-Menno.