Movatterモバイル変換

17.4.1. Shared Memory and Semaphores

17.4.2. systemd RemoveIPC

17.4.3. Resource Limits

17.4.4. Linux Memory Overcommit

17.4.5. Linux Huge Pages

Shared memory and semaphores are collectively referred to as“System VIPC” (together with message queues, which are not relevant forPostgres Pro). Except onWindows, wherePostgres Pro provides its own replacement implementation of these facilities, these facilities are required in order to runPostgres Pro.

The complete lack of these facilities is usually manifested by anIllegal system call error upon server start. In that case there is no alternative but to reconfigure your kernel.Postgres Pro won't work without them. This situation is rare, however, among modern operating systems.

WhenPostgres Pro exceeds one of the various hardIPC limits, the server will refuse to start and should leave an instructive error message describing the problem and what to do about it. (See alsoSection 17.3.1.) The relevant kernel parameters are named consistently across different systems;Table 17.1 gives an overview. The methods to set them, however, vary. Suggestions for some platforms are given below.

Postgres Pro uses one semaphore per allowed connection (max_connections), allowed autovacuum worker process (autovacuum_max_workers) and allowed background process (max_worker_processes), in sets of 16. Each such set will also contain a 17th semaphore which contains a“magic number”, to detect collision with semaphore sets used by other applications. The maximum number of semaphores in the system is set bySEMMNS, which consequently must be at least as high asmax_connections plusautovacuum_max_workers plusmax_worker_processes, plus one extra for each 16 allowed connections plus workers (see the formula inTable 17.1). The parameterSEMMNI determines the limit on the number of semaphore sets that can exist on the system at one time. Hence this parameter must be at leastceil((max_connections + autovacuum_max_workers + max_worker_processes + 5) / 16). Lowering the number of allowed connections is a temporary workaround for failures, which are usually confusingly worded“No space left on device”, from the functionsemget.

In some cases it might also be necessary to increaseSEMMAP to be at least on the order ofSEMMNS. If the system has this parameter (many do not), it defines the size of the semaphore resource map, in which each contiguous block of available semaphores needs an entry. When a semaphore set is freed it is either added to an existing entry that is adjacent to the freed block or it is registered under a new map entry. If the map is full, the freed semaphores get lost (until reboot). Fragmentation of the semaphore space could over time lead to fewer available semaphores than there should be.

TheSEMMSL parameter, which determines how many semaphores can be in a set, must be at least 17 forPostgres Pro.

Various other settings related to“semaphore undo”, such asSEMMNU andSEMUME, do not affectPostgres Pro.

Ifsystemd is in use, some care must be taken that IPC resources (shared memory and semaphores) are not prematurely removed by the operating system. This is especially of concern when installingPostgres Pro from source. Users of distribution packages ofPostgres Pro are less likely to be affected, as thepostgres user is then normally created as a system user.

The settingRemoveIPC inlogind.conf controls whether IPC objects are removed when a user fully logs out. System users are exempt. This setting defaults to on in stocksystemd, but some operating system distributions default it to off.

A typical observed effect when this setting is on is that the semaphore objects used by aPostgres Pro server are removed at apparently random times, leading to the server crashing with log messages like

LOG: semctl(1234567890, 0, IPC_RMID, ...) failed: Invalid argument

Different types of IPC objects (shared memory vs. semaphores, System V vs. POSIX) are treated slightly differently bysystemd, so one might observe that some IPC resources are not removed in the same way as others. But it is not advisable to rely on these subtle differences.

A“user logging out” might happen as part of a maintenance job or manually when an administrator logs in as thepostgres user or something similar, so it is hard to prevent in general.

What is a“system user” is determined atsystemd compile time from theSYS_UID_MAX setting in/etc/login.defs.

Packaging and deployment scripts should be careful to create thepostgres user as a system user by usinguseradd -r,adduser --system, or equivalent.

Alternatively, if the user account was created incorrectly or cannot be changed, it is recommended to set

RemoveIPC=no

in/etc/systemd/logind.conf or another appropriate configuration file.

Unix-like operating systems enforce various kinds of resource limits that might interfere with the operation of yourPostgres Pro server. Of particular importance are limits on the number of processes per user, the number of open files per process, and the amount of memory available to each process. Each of these have a“hard” and a“soft” limit. The soft limit is what actually counts but it can be changed by the user up to the hard limit. The hard limit can only be changed by the root user. The system callsetrlimit is responsible for setting these parameters. The shell's built-in commandulimit (Bourne shells) orlimit (csh) is used to control the resource limits from the command line. On BSD-derived systems the file/etc/login.conf controls the various resource limits set during login. See the operating system documentation for details. The relevant parameters aremaxproc,openfiles, anddatasize. For example:

default:\...        :datasize-cur=256M:\        :maxproc-cur=256:\        :openfiles-cur=256:\...

(-cur is the soft limit. Append-max to set the hard limit.)

Kernels can also have system-wide limits on some resources.

ThePostgres Pro server uses one process per connection so you should provide for at least as many processes as allowed connections, in addition to what you need for the rest of your system. This is usually not a problem but if you run several servers on one machine things might get tight.

The factory default limit on open files is often set to“socially friendly” values that allow many users to coexist on a machine without using an inappropriate fraction of the system resources. If you run many servers on a machine this is perhaps what you want, but on dedicated servers you might want to raise this limit.

On the other side of the coin, some systems allow individual processes to open large numbers of files; if more than a few processes do so then the system-wide limit can easily be exceeded. If you find this happening, and you do not want to alter the system-wide limit, you can setPostgres Pro'smax_files_per_process configuration parameter to limit the consumption of open files.

In Linux 2.4 and later, the default virtual memory behavior is not optimal forPostgres Pro. Because of the way that the kernel implements memory overcommit, the kernel might terminate thePostgres Pro postmaster (the master server process) if the memory demands of eitherPostgres Pro or another process cause the system to run out of virtual memory.

If this happens, you will see a kernel message that looks like this (consult your system documentation and configuration on where to look for such a message):

Out of Memory: Killed process 12345 (postgres).

This indicates that thepostgres process has been terminated due to memory pressure. Although existing database connections will continue to function normally, no new connections will be accepted. To recover,Postgres Pro will need to be restarted.

One way to avoid this problem is to runPostgres Pro on a machine where you can be sure that other processes will not run the machine out of memory. If memory is tight, increasing the swap space of the operating system can help avoid the problem, because the out-of-memory (OOM) killer is invoked only when physical memory and swap space are exhausted.

IfPostgres Pro itself is the cause of the system running out of memory, you can avoid the problem by changing your configuration. In some cases, it may help to lower memory-related configuration parameters, particularlyshared_buffers andwork_mem. In other cases, the problem may be caused by allowing too many connections to the database server itself. In many cases, it may be better to reducemax_connections and instead make use of external connection-pooling software.

On Linux 2.6 and later, it is possible to modify the kernel's behavior so that it will not“overcommit” memory. Although this setting will not prevent theOOM killer from being invoked altogether, it will lower the chances significantly and will therefore lead to more robust system behavior. This is done by selecting strict overcommit mode viasysctl:

sysctl -w vm.overcommit_memory=2

or placing an equivalent entry in/etc/sysctl.conf. You might also wish to modify the related settingvm.overcommit_ratio. For details see the kernel documentation fileDocumentation/vm/overcommit-accounting.

Another approach, which can be used with or without alteringvm.overcommit_memory, is to set the process-specificOOM score adjustment value for the postmaster process to-1000, thereby guaranteeing it will not be targeted by the OOM killer. The simplest way to do this is to execute

echo -1000 > /proc/self/oom_score_adj

in the postmaster's startup script just before invoking the postmaster. Note that this action must be done as root, or it will have no effect; so a root-owned startup script is the easiest place to do it. If you do this, you should also set these environment variables in the startup script before invoking the postmaster:

export PG_OOM_ADJUST_FILE=/proc/self/oom_score_adjexport PG_OOM_ADJUST_VALUE=0

These settings will cause postmaster child processes to run with the normal OOM score adjustment of zero, so that the OOM killer can still target them at need. You could use some other value forPG_OOM_ADJUST_VALUE if you want the child processes to run with some other OOM score adjustment. (PG_OOM_ADJUST_VALUE can also be omitted, in which case it defaults to zero.) If you do not setPG_OOM_ADJUST_FILE, the child processes will run with the same OOM score adjustment as the postmaster, which is unwise since the whole point is to ensure that the postmaster has a preferential setting.

Older Linux kernels do not offer/proc/self/oom_score_adj, but may have a previous version of the same functionality called/proc/self/oom_adj. This works the same except the disable value is-17 not-1000.

Using huge pages reduces overhead when using large contiguous chunks of memory, asPostgres Pro does, particularly when using large values ofshared_buffers. To use this feature inPostgres Pro you need a kernel withCONFIG_HUGETLBFS=y andCONFIG_HUGETLB_PAGE=y. You will also have to adjust the kernel settingvm.nr_hugepages. To estimate the number of huge pages needed, startPostgres Pro without huge pages enabled and check the postmaster'sVmPeak value, as well as the system's huge page size, using the/proc file system. This might look like:

$head -1 $PGDATA/postmaster.pid4170$grep ^VmPeak /proc/4170/statusVmPeak:  6490428 kB$grep ^Hugepagesize /proc/meminfoHugepagesize:       2048 kB

6490428 /2048 gives approximately3169.154, so in this example we need at least3170 huge pages, which we can set with:

$sysctl -w vm.nr_hugepages=3170

A larger setting would be appropriate if other programs on the machine also need huge pages. Don't forget to add this setting to/etc/sysctl.conf so that it will be reapplied after reboots.

Sometimes the kernel is not able to allocate the desired number of huge pages immediately, so it might be necessary to repeat the command or to reboot. (Immediately after a reboot, most of the machine's memory should be available to convert into huge pages.) To verify the huge page allocation situation, use:

$grep Huge /proc/meminfo

It may also be necessary to give the database server's operating system user permission to use huge pages by settingvm.hugetlb_shm_group viasysctl, and/or give permission to lock memory withulimit -l.

The default behavior for huge pages inPostgres Pro is to use them when possible and to fall back to normal pages when failing. To enforce the use of huge pages, you can sethuge_pages toon inpostgresql.conf. Note that with this settingPostgres Pro will fail to start if not enough huge pages are available.

For a detailed description of theLinux huge pages feature have a look athttps://www.kernel.org/doc/Documentation/vm/hugetlbpage.txt.