Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (asf.osuosl.org: domain of b.candler@pobox.com designates
 208.210.124.75 as permitted sender)
Date: Wed, 1 Mar 2006 18:31:14 +0000
From: Brian Candler <B.Candler@pobox.com>
To: Eric Covener <covener@gmail.com>
Cc: dev@httpd.apache.org
Subject: Re: AW: Limiting CGIs in 2.2.0
Message-ID: <20060301183114.GA14965@uk.tiscali.com>
References: <1404e5910603010708xa700effs693b322b6f61bbc5@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1404e5910603010708xa700effs693b322b6f61bbc5@mail.gmail.com>
User-Agent: Mutt/1.4.2.1i

On Wed, Mar 01, 2006 at 10:08:19AM -0500, Eric Covener wrote:
> > Hmmm... the docs explain both a "soft limit" and a "maximum limit", but
> > doesn't describe the difference between the two.
> 
> The soft/hard limits are a notion held in the underlying
> ulimit/setrlimit facility.
> 
> Unrpivileged users can manipulate their soft limit  to control the
> limits on how much CPU time, memory, or # of processes their programs
> can use.  The "hard" limit acts as a ceiling for what the OS will let
> you adjust your soft limit to.

Also - an application can catch a signal when it reaches its soft limit
(e.g. SIGXCPU when the soft limit for CPU time has been reached), but not
when it reaches its hard limit.

But these limits are per-child. Better, in my opinion, is to capture rusage
information for each child, generate a log entry when each CGI terminates,
and then use this to generate CGI stats showing (for example) the top 20
users of CPU time by CGI path or by virtual host. You can then penalise bad
users appropriately.

However Apache doesn't support this out-of-the-box as far as I know. I did
it by modifying suexec to fork, run the child in a sub-process, and then
capture this information when the child dies.

Regards,

Brian.