Hello Tim,
welcome to the list and thanks for the patch.
On Tue, 2018-09-25 at 20:29 +0200, Peter Müller wrote:
Hello Tim,
I am not sure about the side-effects introduced with this patch.
As far as I am aware, values for "vm.swappiness" range from 0 (disable swapping entirely) to 100 (swap aggressively). Value 1 means swapping is only used to avoid OOM situations.
No, 0 does not disable swapping entirely.
https://git.ipfire.org/?p=thirdparty/kernel/linux.git;a=blob;f=Documentation...
This raises three questions: (a) On some systems, I observer swap usage > 0% indeed, which should not happen if value 0 for this setting _disables_ swapping.
See above.
(b) Since disk I/O is much slower than RAM access, I fear it might be a DoS vector to enable this (infected program running amok). On the other hand, if a systems might avoid running out of memory, this sounds good too.
Not swapping would cause the OOM killer to kill random processes. That also is a DoS attack vector. Every OOM situation is. There is no way to recover from this.
(c) How does the kernel treat anonymous pages after changing this setting?
Anonymous pages?
However, these might be academic threats since the overall issue is already discussed in https://bugzilla.ipfire.org/show_bug.cgi?id=11839 . Just some comments from my side... :-)
Not really. I guess what we really want is 1 here. There is usually no reason for the firewall to swap. That only happens for the proxy or IDS (or an application with a massive memory leak). Usually that can be configured away or the amount of RAM in the machine has to be upgraded.
As long as there is enough memory available, we want to keep everything in memory. There is no point in swapping out the IDS ruleset or proxy cache in memory. We only will do this to keep the system alive if there is a peak in memory usage and that is what vm.swappiness=1 is doing from my POV.
Best, -Michael
Thanks, and best regards, Peter Müller
Signed-off-by: Tim FitzGeorge <ipfr at tfitzgeorge.me.uk> Fixes: Bug 11839
config/etc/sysctl.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/config/etc/sysctl.conf b/config/etc/sysctl.conf index 345f8f52a..4066af767 100644 --- a/config/etc/sysctl.conf +++ b/config/etc/sysctl.conf @@ -27,7 +27,7 @@ net.ipv4.conf.all.accept_source_route = 0 net.ipv4.conf.all.log_martians = 1
kernel.printk = 1 4 1 7 -vm.swappiness=0 +vm.swappiness=1 vm.mmap_min_addr = 4096 vm.min_free_kbytes = 8192