Re: [2.4.18] Security: Process-Killer if machine get's out of memory

[Andreas Hartmann <andihartmann@freenet.de>]

Rik van Riel wrote:
> On Sun, 24 Mar 2002, andreas wrote:
> 
> 
>>I've got a basic question:
>>Would it be possible to kill only the process which consumes the most
>>memory in the last delta t?
> 
> 
>>rsync is an actual example for the problem, I wrote. This could be any
>>other process, eating up the memory. Then, the kernel kills wildly some
>>processes until the right process is killed - and the machine is
>>probably unavailable meanwhile.
> 
> 
> The problem is that 'rsync' might as well have been 'scientific
> calculation that ran for 3 days'.
> 
> One 'solution' could be to let the OOM killer ignore CPU usage
> of less than say 1 hour, but it'll always be heuristics that
> can go wrong in some scenario.

In that particular case, rsync eats up the memory within seconds. Not 
only 5 MB's but hundreds of MB's. Wouldn't it be possible to detect such 
behaviour and kill such processes, if they consume all the memory very 
fast (I mean RAM and SWAP-space), that is, if no more virtual memory is 
left, or let's say e.g., if 99% percent of virtual memory are used?

Processes, that consume memory during a long term run cannot be detected 
with this heuristic.

Maybe, it would be possible to sort all known processes by there memory 
usage and combine it with the speed of their memoryrequests.
If memory gets low, and there is a process, which suddenly requests a 
lot of memory, this process get's killed, even if there is another 
process, which has three times more memory allocated then the "fast 
growing" process. If all processes are growing nearly equal and memory 
gets low, the process with the most memory usage get's killed - because 
with this process, the kernel achieves the target (to get free memspace) 
best.

Advantage of combining consumption-speed and memory usage per process 
would be, that processes could be filtered, which are obviously broken. 
If the behaviour of the process is correct, than the machine hasn't 
enough memory. But this is a problem, which cannot be handled by the kernel.



Regards,
Andreas Hartmann