From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Tremer To: development@lists.ipfire.org Subject: Re: [PATCH] Allow kernel to swap memory on high demand Date: Tue, 25 Sep 2018 21:50:23 +0100 Message-ID: In-Reply-To: <021e5d95-f39b-a7b4-0464-ba8b4a335449@link38.eu> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============6880963944731069355==" List-Id: --===============6880963944731069355== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hello Tim, welcome to the list and thanks for the patch. On Tue, 2018-09-25 at 20:29 +0200, Peter M=C3=BCller wrote: > Hello Tim, >=20 > I am not sure about the side-effects introduced with this patch. >=20 > As far as I am aware, values for "vm.swappiness" range from 0 > (disable swapping entirely) to 100 (swap aggressively). Value 1 > means swapping is only used to avoid OOM situations. No, 0 does not disable swapping entirely. https://git.ipfire.org/?p=3Dthirdparty/kernel/linux.git;a=3Dblob;f=3DDocume= ntation/sysctl/vm.txt;hb=3D02214bfc89c71bcc5167f653994cfa5c57f10ff1#l808 > This raises three questions: > (a) On some systems, I observer swap usage > 0% indeed, which > should not happen if value 0 for this setting _disables_ swapping. See above. > (b) Since disk I/O is much slower than RAM access, I fear it > might be a DoS vector to enable this (infected program running > amok). On the other hand, if a systems might avoid running out > of memory, this sounds good too. Not swapping would cause the OOM killer to kill random processes. That also i= s a DoS attack vector. Every OOM situation is. There is no way to recover from th= is. > (c) How does the kernel treat anonymous pages after changing > this setting? Anonymous pages? > However, these might be academic threats since the overall > issue is already discussed in=20 > https://bugzilla.ipfire.org/show_bug.cgi?id=3D11839 . > Just some comments from my side... :-) Not really. I guess what we really want is 1 here. There is usually no reason for the firewall to swap. That only happens for the proxy or IDS (or an application with a massive memory leak). Usually that can be configured away = or the amount of RAM in the machine has to be upgraded. As long as there is enough memory available, we want to keep everything in memory. There is no point in swapping out the IDS ruleset or proxy cache in memory. We only will do this to keep the system alive if there is a peak in memory usage and that is what vm.swappiness=3D1 is doing from my POV. Best, -Michael >=20 > Thanks, and best regards, > Peter M=C3=BCller >=20 >=20 > > Signed-off-by: Tim FitzGeorge > > Fixes: Bug 11839 > > --- > > config/etc/sysctl.conf | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > >=20 > > diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf > > index 345f8f52a..4066af767 100644 > > --- a/config/etc/sysctl.conf > > +++ b/config/etc/sysctl.conf > > @@ -27,7 +27,7 @@ net.ipv4.conf.all.accept_source_route =3D 0 > > net.ipv4.conf.all.log_martians =3D 1 > > =20 > > kernel.printk =3D 1 4 1 7 > > -vm.swappiness=3D0 > > +vm.swappiness=3D1 > > vm.mmap_min_addr =3D 4096 > > vm.min_free_kbytes =3D 8192 > > =20 > >=20 >=20 >=20 --===============6880963944731069355==--