From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peri Hankey Subject: Re: Problems with dom0 and low memory Date: Tue, 07 Dec 2004 12:51:31 +0000 Message-ID: <41B5A753.8030708@thegreen.co.uk> References: <41B588B5.9010309@enix.org> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <41B588B5.9010309@enix.org> Sender: xen-devel-admin@lists.sourceforge.net Errors-To: xen-devel-admin@lists.sourceforge.net List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , List-Archive: To: =?ISO-8859-1?Q?J=E9r=F4me_Petazzoni?= Cc: xen-devel@lists.sourceforge.net List-Id: xen-devel@lists.xenproject.org I'm not sure whether this was related to low memory, but I have seen an=20 ext3 journal abort like this on a xenU domain, and have also had one=20 occurrence of ext3 file corruption on the same domain. Not while I was=20 active on that domain. It seems that a worm was probing for one of the IIS buffer overflow=20 exploits: initially I saw a lot of "\x90\x90\x90\x90\x90\x90\x90\x90..."=20 sequences in /lib/modules/2.6.9-xenU/modules.alias, which didn't go down=20 very well with the boot process. I fsck'ed the beast, letting it unpick=20 quite a tangle. Subsequently I have seen large SEARCH blocks containing=20 that (and similar garbage) appear in the httpd/access_log, and a bit=20 googling about suggested that it was probably one of the IIS worms. =20 There's also an attempt to POST a minegrew$ dll to the system - also a=20 known exploit. I haven't been able to pin any of this down more closely, and am a bit=20 concerned about the ext3 file system corruption. Regards Peri J=E9r=F4me Petazzoni wrote: > > I am running a Xen box where I need a lot of memory for a given domain=20 > (which runs memory-hungry java apps). I had reduced the memory of=20 > domain0 to 42000KB. It *seems* that after running OK for a while, a=20 > low memory condition on domain0 messed during a short time the VBD of=20 > the other domains, and they got a burst if I/O errors. After this=20 > event, the other domains were still running, and their VBD were still=20 > working, but the burst of I/O errors aborted the ext3 journal on the=20 > filesystems (causing them to go read-only). > > Here are the kernel logs of both domains if you want to check that=20 > it's indeed a low memory condition problem and not something else=20 > (which would then be a "real" bug). > > I increased the memory allocated to domain0, but it would be=20 > interesting to know if there is a way to avoid those problems (I=20 > thought about increasing /proc/sys/vm/min_free_kbytes ; would it be=20 > useful here?) > > The dom0 and domU kernels, as well as xen itself, the associated=20 > symbols, and the same log files are located here, if someone needs them= : > http://skaya.enix.org/webs/xen/dom0-lowmem/ > ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/