Steven M. Bellovin wrote:
> On Thu, 22 Feb 2007 13:18:50 +1100
> Carl Brewer <carl@bl.echidna.id.au> wrote:
> 
>> Steven M. Bellovin wrote:
>>
>>> I believe it only applies via login.  If you have a root process
>>> starting the zope process, have the root process change its soft (or
>>> hard) limit before invoking the 'su' command.
>> I expect the most suitable place to do that would be in the rc.d
>> script?  It would, I think, require the least maintenance when
>> zope gets updated etc?  Will the children (zope-owned) inherit
>> limit|ulimit settings from an rc script ok?
> 
> Yes.
> 
> However, there's one thing to watch for.  If I'm not mistaken, all of
> the rc.d scripts run in a single process.  You want to ensure that you
> don't change the limits for other rc.d scripts.
> 
> Looking further, though, I see that 'su' has a '-c' -- login class --
> parameter.  It may do exactly what you need.

I had a look, zope does the exec/change user thing internally, and
I really don't want to go mucking in its bowels.  So I have
set a ulimit in the zope process control script as follows (for the
archive) :

/home/zope/server/bin/zopectl
#! /bin/sh

# let zope use 356MB
ulimit -d 393216

PYTHON="/usr/pkg/bin/python2.4"
ZOPE_HOME="/home/zope/zope-2.9.6"
INSTANCE_HOME="/home/zope/server"
CONFIG_FILE="/home/zope/server/etc/zope.conf"
SOFTWARE_HOME="/home/zope/zope-2.9.6/lib/python"
PYTHONPATH="$SOFTWARE_HOME"
export PYTHONPATH INSTANCE_HOME SOFTWARE_HOME

ZDCTL="$SOFTWARE_HOME/Zope2/Startup/zopectl.py"

exec "$PYTHON" "$ZDCTL" -C "$CONFIG_FILE" "$@"


This should, I think let zope use 356MB before it gets
in trouble.

sysctl now shows this for a running zope server :
sysctl proc.24701

proc.24701.corename = %n.core
proc.24701.rlimit.cputime.soft = unlimited
proc.24701.rlimit.cputime.hard = unlimited
proc.24701.rlimit.filesize.soft = unlimited
proc.24701.rlimit.filesize.hard = unlimited
proc.24701.rlimit.datasize.soft = 402653184
proc.24701.rlimit.datasize.hard = 402653184
proc.24701.rlimit.stacksize.soft = 2097152
proc.24701.rlimit.stacksize.hard = 33554432
proc.24701.rlimit.coredumpsize.soft = unlimited
proc.24701.rlimit.coredumpsize.hard = unlimited
proc.24701.rlimit.memoryuse.soft = 974860288
proc.24701.rlimit.memoryuse.hard = 974860288
proc.24701.rlimit.memorylocked.soft = 324953429
proc.24701.rlimit.memorylocked.hard = 974860288
proc.24701.rlimit.maxproc.soft = 160
proc.24701.rlimit.maxproc.hard = 532
proc.24701.rlimit.descriptors.soft = 64
proc.24701.rlimit.descriptors.hard = 1772
proc.24701.rlimit.sbsize.soft = unlimited
proc.24701.rlimit.sbsize.hard = unlimited


I think that's now going to work a bit better?  If
it's stable for a few days I'll contribute a
summary of this to the zope/plone doco for
NetBSD.