How to restrict process CPU usage using nice, cpulimit, and cgroups
The Linux kernel is an incredible circus performer, carefully juggling many processes and their resource needs to keep your server humming along. The kernel is also all about equity: when there is competition for resources, the kernel tries to distribute those resources fairly.
However, what if you've got an important process that needs priority? What about a low-priority process? Or what about limiting resources for a group of a processes?
The kernel can't determine what CPU processes are important without your help.
Most processes are started at the same priority level and the Linux kernel schedules time for each task evenly on the processor. Have a CPU intensive process that can be run at a lower priority? Then you need to tell the scheduler about it!
There are at least three ways in which you can control how much CPU time a process gets:
Use the
nicecommand to manually lower the task's priority.- Use the
cpulimitcommand to repeatedly pause the process so that it doesn’t exceed a certain limit. - Use Linux’s built-in control groups, a mechanism which tells the scheduler to limit the amount of resources available to the process.
Let's look at how these work and the pros and cons of each.
Simulating high CPU usage
Before looking at these three techniques, we need to find a tool that will simulate high CPU usage on a system. We will be using CentOS as our base system, and to artificially load the processor we can use the prime number generator from the Mathomatic toolkit.
There isn’t a prebuilt package for CentOS so you will need to build it yourself. Download the source code from http://mathomatic.orgserve.de/mathomatic-16.0.5.tar.bz2 and then unpack the archive file. Change directory intomathomatic-16.0.5/primes. Runmakeandsudo make installto build and install the binaries. You will now have thematho-primesbinary in/usr/local/bin.
Run the command like this:
/usr/local/bin/matho-primes 0 9999999999 > /dev/null &
This will generate a list of prime numbers from zero to nine billion nine hundred ninety-nine million nine hundred ninety-nine thousand nine hundred ninety-nine. Since we don’t really want to keep the list, the output is redirected to/dev/null.
Now run top and you will see that the matho-primes process is using all the available CPU.
Exit top (press the q key) and kill the matho-primes process (fg to bring the process to the foreground and press CTRL+C).
nice
Thenicecommand tweaks the priority level of a process so that it runs less frequently.This is useful when you need to run a CPU intensive task as a background or batch job. The niceness level ranges from -20 (most favorable scheduling) to 19 (least favorable). Processes on Linux are started with a niceness of 0 by default. The nice command (without any additional parameters) will start a process with a niceness of 10. At that level the scheduler will see it as a lower priority task and give it less CPU resources.
Start twomatho-primestasks, one with nice and one without:
nice matho-primes 0 9999999999 > /dev/null &
matho-primes 0 9999999999 > /dev/null &
Now runtop:
Observe that the process started withoutnice(at niceness level 0) gets more processor time, whereas the process with a niceness level of 10 gets less.
What this means in real terms is that if you want to run a CPU intensive task you can start it using nice and the scheduler will always ensure that other tasks have priority over it. This means that the server (or desktop) will remain responsive even when under heavy load.
Nice has an associated command calledrenice. It changes the niceness level of an already running process. To use it, find out the PID of process hogging all the CPU time (using ps) and then runrenice:
renice +10 1234
Where 1234 is the PID.
Don’t forget to kill thematho-primesprocesses once you have finished experimenting with theniceandrenicecommands.
cpulimit
Thecpulimittool curbs the CPU usage of a process by pausing the process at different intervals to keep it under the defined ceiling. It does this by sending SIGSTOP and SIGCONT signals to the process. It does not change thenicevalue of the process, instead it monitors and controls the real-world CPU usage.
cpulimitis useful when you want to ensure that a process doesn't use more than a certain portion of the CPU.The disadvantage overniceis that the process can't use all of the available CPU time when the system is idle.
To install it on CentOS type:
wget -O cpulimit.zip https://github.com/opsengine/cpulimit/archive/master.zip
unzip cpulimit.zip
cd cpulimit-master
make
sudo cp src/cpulimit /usr/bin
The commands above will download the source code from GitHub, unpack the archive file, build the binary, and copy it to/usr/bin.
cpulimitis used in a similar way tonice, however you need to explicitly define the maximum CPU limit for the process using the ‘-l’ parameter. For example:
cpulimit -l 50 matho-primes 0 9999999999 > /dev/null &
Note how thematho-primesprocess is now only using 50% of the available CPU time. On my example system the rest of the time is spent in idle.
You can also limit a currently running process by specifying its PID using the ‘-p’ parameter. For example
cpulimit -l 50 -p 1234
Where 1234 is the PID of the process.
cgroups
Control groups (cgroups) are a Linux kernel feature that allows you to specify how the kernel should allocate specific resources to a group of processes. With cgroups you can specify how much CPU time, system memory, network bandwidth, or combinations of these resources can be used by the processes residing in a certain group.
The advantage of control groups overniceorcpulimitis that the limits are applied to a set of processes, rather than to just one.Also,niceorcpulimitonly limit the CPU usage of a process, whereas cgroups can limit other process resources.
By judiciously using cgroups the resources of entire subsystems of a server can be controlled. For example in CoreOS, the minimal Linux distribution designed for massive server deployments, the upgrade processes are controlled by a cgroup. This means the downloading and installing of system updates doesn’t affect system performance.
To demonstrate cgroups, we will create two groups with different CPU resources allocated to each group. The groups will be called ‘cpulimited’ and ‘lesscpulimited’.
The groups are created with thecgcreatecommand like this:
sudo cgcreate -g cpu:/cpulimited
sudo cgcreate -g cpu:/lesscpulimited
The “-g cpu” part of the command tell cgroups that the groups can place limits on the amount of CPU resources given to the processes in the group. Other contollers includecpuset,memory, andblkio. The cpuset controller is related to the cpu controller in that it allows the processes in a group to be bound to a specific CPU, or set of cores in a CPU.
The cpu controller has a property known as cpu.shares. It is used by the kernel to determine the share of CPU resources available to each process across the cgroups. The default value is 1024. By leaving one group (lesscpulimited) at the default of 1024 and setting the other (cpulimited) to 512, we are telling the kernel to split the CPU resources using a 2:1 ratio.
To set the cpu.shares to 512 in the cpulimited group, type:
sudo cgset -r cpu.shares=512 cpulimited
To start a task in a particular cgroup you can use the cgexec command. To test the two cgroups, start matho-primes in the cpulimited group, like this:
sudo cgexec -g cpu:cpulimited /usr/local/bin/matho-primes 0 9999999999 > /dev/null &
If you runtopyou will see that the process is taking all of the available CPU time.
This is because when a single process is running, it uses as much CPU as necessary, regardless of which cgroup it is placed in. The CPU limitation only comes into effect when two or more processes compete for CPU resources.
Now start a second matho-primes process, this time in the lesscpulimited group:
sudo cgexec -g cpu:lesscpulimited /usr/local/bin/matho-primes 0 9999999999 > /dev/null &
The top command shows us that the process in the cgroup with the greater cpu.shares value is getting more CPU time.
Now start another matho-primes process in the cpulimited group:
sudo cgexec -g cpu:cpulimited /usr/local/bin/matho-primes 0 9999999999 > /dev/null &
Observe how the CPU is still being proportioned in a 2:1 ratio. Now the twomatho-primestasks in the cpulimited group are sharing the CPU equally, while the process in the other group still gets more processor time.
You can read the full control groups documentation from Red Hat (which applies equally to CentOS 7).