Re: Problems with dom0 and low memory

[Peri Hankey <mpah@thegreen.co.uk>]

I'm not sure whether this was related to low memory, but I have seen an 
ext3 journal abort like this on a xenU domain, and have also had one 
occurrence of ext3 file corruption on the same domain. Not while I was 
active on that  domain.

It seems that a worm was probing for one of the IIS buffer overflow 
exploits: initially I saw a lot of "\x90\x90\x90\x90\x90\x90\x90\x90..." 
sequences in /lib/modules/2.6.9-xenU/modules.alias, which didn't go down 
very well with the boot process. I fsck'ed the beast, letting it unpick 
quite a tangle. Subsequently I have seen large SEARCH blocks containing 
that (and similar garbage) appear in the httpd/access_log, and a bit 
googling about suggested that it was probably one of the IIS worms.  
There's also an attempt to POST a minegrew$ dll to the system - also a 
known exploit.

I haven't been able to pin any of this down more closely, and am a bit 
concerned about the ext3 file system corruption.

Regards
Peri

Jérôme Petazzoni wrote:

>
> I am running a Xen box where I need a lot of memory for a given domain 
> (which runs memory-hungry java apps). I had reduced the memory of 
> domain0 to 42000KB. It *seems* that after running OK for a while, a 
> low memory condition on domain0 messed during a short time the VBD of 
> the other domains, and they got a burst if I/O errors. After this 
> event, the other domains were still running, and their VBD were still 
> working, but the burst of I/O errors aborted the ext3 journal on the 
> filesystems (causing them to go read-only).
>
> Here are the kernel logs of both domains if you want to check that 
> it's indeed a low memory condition problem and not something else 
> (which would then be a "real" bug).
>
> I increased the memory allocated to domain0, but it would be 
> interesting to know if there is a way to avoid those problems (I 
> thought about increasing /proc/sys/vm/min_free_kbytes ; would it be 
> useful here?)
>
> The dom0 and domU kernels, as well as xen itself, the associated 
> symbols, and the same log files are located here, if someone needs them:
> http://skaya.enix.org/webs/xen/dom0-lowmem/
>


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/