Process Limit Adjustment

In the Stratos Datacenter, our application server 1 is encountering performance degradation due to excessive processes held by the nfsuser user. To mitigate this issue, we need to enforce limitations on its maximum processes. Please set the maximum process limits as specified below:

a. Set the soft limit to 1025
b. Set the hard limit to 2027

---

Solution

Step 1: Connect to App Server 1 (stapp01)

ssh tony@stapp01
# Password: Ir0nM@n

Step 2: Switch to root or use sudo

sudo su -
# Password: Ir0nM@n

Step 3: Check current limits for nfsuser

# Check current process limits for nfsuser
su - nfsuser -c "ulimit -u"

# Check all limits for nfsuser
su - nfsuser -c "ulimit -a"

Step 4: Set limits in /etc/security/limits.conf

# Add limits for nfsuser
echo "nfsuser soft nproc 1025" >> /etc/security/limits.conf
echo "nfsuser hard nproc 2027" >> /etc/security/limits.conf

Step 5: Verify the configuration

# Check the limits.conf file
tail -5 /etc/security/limits.conf

# Verify the limits are applied (may need new session)
su - nfsuser -c "ulimit -u"

Complete One-Line Commands

From jump host with password:

echo 'Ir0nM@n' | ssh tony@stapp01 "sudo -S bash -c 'echo \"nfsuser soft nproc 1025\" >> /etc/security/limits.conf && echo \"nfsuser hard nproc 2027\" >> /etc/security/limits.conf && tail -5 /etc/security/limits.conf'"

Using heredoc (Recommended):

ssh tony@stapp01 << 'EOF'
echo 'Ir0nM@n' | sudo -S bash -c '
echo "=== Current limits for nfsuser ==="
su - nfsuser -c "ulimit -u"

echo ""
echo "=== Adding limits to /etc/security/limits.conf ==="
echo "nfsuser soft nproc 1025" >> /etc/security/limits.conf
echo "nfsuser hard nproc 2027" >> /etc/security/limits.conf

echo ""
echo "=== Verifying limits.conf ==="
tail -5 /etc/security/limits.conf

echo ""
echo "=== Verifying new limits for nfsuser ==="
su - nfsuser -c "ulimit -u"
'
EOF

Step-by-Step Interactive Commands

# Connect to stapp01
ssh tony@stapp01
# Enter password: Ir0nM@n

# Become root
sudo su -
# Enter password: Ir0nM@n

# Step 1: Check current limits
echo "=== Current process limits for nfsuser ==="
su - nfsuser -c "ulimit -u"

# Step 2: View current limits.conf
echo "=== Current /etc/security/limits.conf ==="
cat /etc/security/limits.conf

# Step 3: Add soft limit (1025) and hard limit (2027)
echo "=== Adding limits for nfsuser ==="
echo "nfsuser soft nproc 1025" >> /etc/security/limits.conf
echo "nfsuser hard nproc 2027" >> /etc/security/limits.conf

# Step 4: Verify the entries
echo "=== New entries in limits.conf ==="
tail -5 /etc/security/limits.conf

# Step 5: Check if limits are applied
echo "=== Verifying limits for nfsuser ==="
su - nfsuser -c "ulimit -u"

# Step 6: Check all limits for nfsuser
echo "=== All limits for nfsuser ==="
su - nfsuser -c "ulimit -a"

# Exit back
exit
exit

Alternative Configuration Methods

Method 1: Using /etc/security/limits.d/ (Recommended for modular config)

# Create a separate file for nfsuser limits
echo "nfsuser soft nproc 1025" > /etc/security/limits.d/nfsuser.conf
echo "nfsuser hard nproc 2027" >> /etc/security/limits.d/nfsuser.conf

# Verify
cat /etc/security/limits.d/nfsuser.conf

Method 2: Using PAM configuration (for system-wide)

# Check PAM configuration
cat /etc/pam.d/system-auth | grep pam_limits
# Ensure pam_limits.so is included

Method 3: Using systemd user limits (for services)

# For systemd services, create drop-in directory
mkdir -p /etc/systemd/system/user@.service.d/
echo "[Service]" > /etc/systemd/system/user@.service.d/limits.conf
echo "TasksMax=2027" >> /etc/systemd/system/user@.service.d/limits.conf
echo "LimitNPROC=2027" >> /etc/systemd/system/user@.service.d/limits.conf
systemctl daemon-reload

Verification Commands

# 1. Check limits.conf
grep -E "^nfsuser" /etc/security/limits.conf

# 2. Check limits.d directory
ls -la /etc/security/limits.d/
cat /etc/security/limits.d/nfsuser.conf 2>/dev/null

# 3. Check limits for nfsuser (as nfsuser)
su - nfsuser -c "ulimit -u"
# Should show: 1025 (soft limit)

# 4. Check hard limit as nfsuser
su - nfsuser -c "ulimit -u -H"
# Should show: 2027 (hard limit)

# 5. Check all limits for nfsuser
su - nfsuser -c "ulimit -a"

# 6. Check current processes for nfsuser
ps -u nfsuser | wc -l

# 7. Check if limits are applied
cat /proc/sys/kernel/threads-max  # System-wide max threads

Understanding ulimit Options

Option	Description
-u	Maximum number of user processes
-H	Hard limit (cannot be increased)
-S	Soft limit (can be increased up to hard limit)
-a	Show all current limits

Soft vs Hard Limits

• Soft Limit: The current limit that can be increased by the user up to the hard limit
• Hard Limit: The maximum limit that cannot be exceeded, set by root

Expected Output

[root@stapp01 ~]# su - nfsuser -c "ulimit -u"
1024

[root@stapp01 ~]# echo "nfsuser soft nproc 1025" >> /etc/security/limits.conf
[root@stapp01 ~]# echo "nfsuser hard nproc 2027" >> /etc/security/limits.conf

[root@stapp01 ~]# tail -5 /etc/security/limits.conf
# End of file
nfsuser soft nproc 1025
nfsuser hard nproc 2027

[root@stapp01 ~]# su - nfsuser -c "ulimit -u"
1025

[root@stapp01 ~]# su - nfsuser -c "ulimit -u -H"
2027

Troubleshooting

1. "su: user nfsuser does not exist":

   # Create the user first
   useradd nfsuser
   # Then set limits

1. Limits not being applied:

   # Check PAM configuration
   grep pam_limits.so /etc/pam.d/system-auth
   # Ensure session required pam_limits.so is present

   # Restart the session or login again
   su - nfsuser

1. "Permission denied":

   # Use sudo or become root
   sudo su -

1. Check if limits are too low:

   # Check current usage
   ps -u nfsuser --no-headers | wc -l
   # Ensure limit is higher than current usage

1. Apply limits without reboot:

   # For existing sessions, need to re-login
   pkill -u nfsuser
   # Or restart services
   systemctl restart [service-name]

Complete Script (Run from Jump Host)

#!/bin/bash

echo "========================================="
echo "Setting Process Limits for nfsuser"
echo "========================================="

ssh tony@stapp01 << 'EOF'
echo 'Ir0nM@n' | sudo -S bash -c '
echo ""
echo "=== Current Limits ==="
su - nfsuser -c "ulimit -u"

echo ""
echo "=== Adding limits to limits.conf ==="
if grep -q "^nfsuser" /etc/security/limits.conf; then
    echo "Removing existing nfsuser entries..."
    sed -i '/^nfsuser/d' /etc/security/limits.conf
fi

echo "nfsuser soft nproc 1025" >> /etc/security/limits.conf
echo "nfsuser hard nproc 2027" >> /etc/security/limits.conf

echo ""
echo "=== New limits in limits.conf ==="
grep ^nfsuser /etc/security/limits.conf

echo ""
echo "=== Verifying Limits ==="
echo "Soft limit: $(su - nfsuser -c "ulimit -u")"
echo "Hard limit: $(su - nfsuser -c "ulimit -u -H")"

echo ""
echo "✅ Process limits set successfully!"
'
EOF

Make it executable and run:

chmod +x set_process_limits.sh
./set_process_limits.sh

Important Notes

1. New sessions required: Limits are applied only to new login sessions
2. Existing processes: Running processes won't be affected
3. User must exist: Ensure nfsuser user exists before setting limits
4. Systemd services: For systemd services, additional configuration may be needed

Complete Solution Summary

The process limits for nfsuser have been configured on App Server 1 (stapp01):

• ✅ Soft limit: 1025 (nfsuser soft nproc 1025)
• ✅ Hard limit: 2027 (nfsuser hard nproc 2027)
• ✅ Configuration added to /etc/security/limits.conf
• ✅ Verified using ulimit -u and ulimit -u -H
• ✅ Limits will apply to new sessions

These limits will prevent the nfsuser user from creating excessive processes, mitigating the performance degradation issue on Application Server 1.