Chapter 25. Using control groups version 1 with systemd

• Service - A process or a group of processes, which systemd started according to a unit configuration file. Services encapsulate the specified processes so that they can be started and stopped as one set. Services are named in the following way:

  <name>.service

• Scope - A group of externally created processes. Scopes encapsulate processes that are started and stopped by the arbitrary processes through the fork() function and then registered by systemd at runtime. For example, user sessions, containers, and virtual machines are treated as scopes. Scopes are named as follows:

  <name>.scope

• Slice - A group of hierarchically organized units. Slices organize a hierarchy in which scopes and services are placed. The actual processes are contained in scopes or in services. Every name of a slice unit corresponds to the path to a location in the hierarchy. The dash ("-") character acts as a separator of the path components to a slice from the -.slice root slice. In the following example:

  <parent-name>.slice

  parent-name.slice is a sub-slice of parent.slice, which is a sub-slice of the -.slice root slice. parent-name.slice can have its own sub-slice named parent-name-name2.slice, and so on.

Procedure

• To create a transient control group, use the systemd-run command in the following format:

  # systemd-run --unit=<name> --slice=<name>.slice <command>

  This command creates and starts a transient service or a scope unit and runs a custom command in such a unit.

  • The --unit=<name> option gives a name to the unit. If --unit is not specified, the name is generated automatically.
  • The --slice=<name>.slice option makes your service or scope unit a member of a specified slice. Replace <name>.slice with the name of an existing slice (as shown in the output of systemctl -t slice), or create a new slice by passing a unique name. By default, services and scopes are created as members of the system.slice.

  • Replace <command> with the command you want to enter in the service or the scope unit.

    The following message is displayed to confirm that you created and started the service or the scope successfully:

    # Running as unit <name>.service

• Optional: Keep the unit running after its processes finished to collect run-time information:

  # systemd-run --unit=<name> --slice=<name>.slice --remain-after-exit <command>

  The command creates and starts a transient service unit and runs a custom command in the unit. The --remain-after-exit option ensures that the service keeps running after its processes have finished.

Procedure

• To create a persistent control group, enter:

  # systemctl enable <name>.service

  The command above automatically creates a unit configuration file into the /usr/lib/systemd/system/ directory and by default, it assigns <name>.service to the system.slice unit.

Procedure

• To limit the memory usage of a service, run the following:

  # systemctl set-property example.service MemoryMax=1500K

  The command instantly assigns the memory limit of 1,500 KB to processes executed in a control group the example.service service belongs to. The MemoryMax parameter, in this configuration variant, is defined in the /etc/systemd/system.control/example.service.d/50-MemoryMax.conf file and controls the value of the /sys/fs/cgroup/memory/system.slice/example.service/memory.limit_in_bytes file.

• Optionally, to temporarily limit the memory usage of a service, run:

  # systemctl set-property --runtime example.service MemoryMax=1500K

  The command instantly assigns the memory limit to the example.service service. The MemoryMax parameter is defined until the next reboot in the /run/systemd/system.control/example.service.d/50-MemoryMax.conf file. With a reboot, the whole /run/systemd/system.control/ directory and MemoryMax are removed.

Procedure

• To stop the service unit with all its processes, enter:

  # systemctl stop <name>.service

• To terminate one or more of the unit processes, enter:

  # systemctl kill <name>.service --kill-who=PID,…​ --signal=<signal>

  The command uses the --kill-who option to select process(es) from the control group you want to terminate. To kill multiple processes at the same time, pass a comma-separated list of PIDs. The --signal option determines the type of POSIX signal to be sent to the specified processes. The default signal is SIGTERM.

Procedure

• List all active units on the system with the systemctl utility. The terminal returns an output similar to the following example:

  # systemctl
  UNIT                                                LOAD   ACTIVE SUB       DESCRIPTION
  …​
  init.scope                                          loaded active running   System and Service Manager
  session-2.scope                                     loaded active running   Session 2 of user jdoe
  abrt-ccpp.service                                   loaded active exited    Install ABRT coredump hook
  abrt-oops.service                                   loaded active running   ABRT kernel log watcher
  abrt-vmcore.service                                 loaded active exited    Harvest vmcores for ABRT
  abrt-xorg.service                                   loaded active running   ABRT Xorg log watcher
  …​
  -.slice                                             loaded active active    Root Slice
  machine.slice                                       loaded active active    Virtual Machine and Container Slice system-getty.slice                                                                       loaded active active    system-getty.slice
  system-lvm2\x2dpvscan.slice                         loaded active active    system-lvm2\x2dpvscan.slice
  system-sshd\x2dkeygen.slice                         loaded active active    system-sshd\x2dkeygen.slice
  system-systemd\x2dhibernate\x2dresume.slice         loaded active active    system-systemd\x2dhibernate\x2dresume>
  system-user\x2druntime\x2ddir.slice                 loaded active active    system-user\x2druntime\x2ddir.slice
  system.slice                                        loaded active active    System Slice
  user-1000.slice                                     loaded active active    User Slice of UID 1000
  user-42.slice                                       loaded active active    User Slice of UID 42
  user.slice                                          loaded active active    User and Session Slice
  …​

  UNIT

  A name of a unit that also reflects the unit position in a control group hierarchy. The units relevant for resource control are a slice, a scope, and a service.

  LOAD

  Indicates whether the unit configuration file was properly loaded. If the unit file failed to load, the field contains the state error instead of loaded. Other unit load states are: stub, merged, and masked.

  ACTIVE

  The high-level unit activation state, which is a generalization of SUB.

  SUB

  The low-level unit activation state. The range of possible values depends on the unit type.

  DESCRIPTION

  The description of the unit content and functionality.

• List all active and inactive units:

  # systemctl --all

• Limit the amount of information in the output:

  # systemctl --type service,masked

  The --type option requires a comma-separated list of unit types such as a service and a slice, or unit load states such as loaded and masked.

Procedure

• Display the whole cgroups hierarchy on your system with the systemd-cgls command.

  # systemd-cgls
  Control group /:
  -.slice
  ├─user.slice
  │ ├─user-42.slice
  │ │ ├─session-c1.scope
  │ │ │ ├─ 965 gdm-session-worker [pam/gdm-launch-environment]
  │ │ │ ├─1040 /usr/libexec/gdm-x-session gnome-session --autostart /usr/share/gdm/greeter/autostart
  …​
  ├─init.scope
  │ └─1 /usr/lib/systemd/systemd --switched-root --system --deserialize 18
  └─system.slice
    …​
    ├─example.service
    │ ├─6882 /bin/bash /home/jdoe/example.sh
    │ └─6902 sleep 1
    ├─systemd-journald.service
      └─629 /usr/lib/systemd/systemd-journald
    …​

  The example output returns the entire cgroups hierarchy, where the highest level is formed by slices.

• Display the cgroups hierarchy filtered by a resource controller with the systemd-cgls <resource_controller> command.

  # systemd-cgls memory
  Controller memory; Control group /:
  ├─1 /usr/lib/systemd/systemd --switched-root --system --deserialize 18
  ├─user.slice
  │ ├─user-42.slice
  │ │ ├─session-c1.scope
  │ │ │ ├─ 965 gdm-session-worker [pam/gdm-launch-environment]
  …​
  └─system.slice
    |
    …​
    ├─chronyd.service
    │ └─844 /usr/sbin/chronyd
    ├─example.service
    │ ├─8914 /bin/bash /home/jdoe/example.sh
    │ └─8916 sleep 1
    …​

  The example output lists the services that interact with the selected controller.

• Display detailed information about a certain unit and its part of the cgroups hierarchy with the systemctl status <system_unit> command.

  # systemctl status example.service
  ● example.service - My example service
     Loaded: loaded (/usr/lib/systemd/system/example.service; enabled; vendor preset: disabled)
     Active: active (running) since Tue 2019-04-16 12:12:39 CEST; 3s ago
   Main PID: 17737 (bash)
      Tasks: 2 (limit: 11522)
     Memory: 496.0K (limit: 1.5M)
     CGroup: /system.slice/example.service
             ├─17737 /bin/bash /home/jdoe/example.sh
             └─17743 sleep 1
  Apr 16 12:12:39 redhat systemd[1]: Started My example service.
  Apr 16 12:12:39 redhat bash[17737]: The current time is Tue Apr 16 12:12:39 CEST 2019
  Apr 16 12:12:40 redhat bash[17737]: The current time is Tue Apr 16 12:12:40 CEST 2019