How to limit an entire user to less than 10% of cpu, not just process?

Question

I am running centos, cpanel/whm, and I have cpulimit installed.

The problem I am having is one of my users is using an extreme amount of cpu usage. Over 100% consistently and it's slowing down my server.

Further problem is they are a friend and not malicious so I don't want to suspend them.

Also what further is an issue is that I can't limit it by process, because this process changes every second. It's a different process every time.

I tried the following but it doesn't work.

cpulimit -l 10 -e /home/[username]/public_html/theirwebsite.org/index.php

I just get returned,

No process found
No process found
No process found
No process found
No process found
No process found

etc

There are two things that are using that extreme cpu usage.

First thing is that file at that location, index.php. Other is [php], whatever that means in WHM. But mainly the index.php is the problem.

If I could limit that index.php file in that location, that might help mitigate this issue.

By the way, I tried the -P flag but that isn't available as an option unlike the documentation.

cpulimit -l 10 -P /home/[username]/public_html/theirwebsite.org/index.php

returns

cpulimit: invalid option -- 'P'
Usage: cpulimit [OPTIONS...] TARGET
   OPTIONS
      -l, --limit=N          percentage of cpu allowed from 0 to 1600 (required)
      -v, --verbose          show control statistics
      -z, --lazy             exit if there is no target process, or if it dies
      -i, --include-children limit also the children processes
      -h, --help             display this help and exit
   TARGET must be exactly one of these:
      -p, --pid=N            pid of the process (implies -z)
      -e, --exe=FILE         name of the executable program file or path name
      COMMAND [ARGS]         run this command and limit it (implies -z)

So looks like I have to do it with the -e flag.

Ideally however I would like to limit the entire user account.

And yes I know about cloudlinux but I can't do that right now. Until I can do that I need help doing it manually with something that doesn't require a server reboot.

Answer 1

You are correct that you can't limit your friend using a process (PID), Apache spawns a new process (Worker) for every request it receives, assigning a new PID each time.

Depending on what PHP handler you setup in WHM -> MultiPHP Manager -> PHP Handlers, Apache will either run PHP scripts as itself, or run them as the user that owns the file. If you use suPHP as handler, the PHP process will be executed as by the account that owns the file.

If the script is executed by the owner, you can limit cpu usage to an account by adding it to the /etc/security/limits.conf file. While you can't use this to limit cpu percentage exactly, you can modify their 'nice' value so their processes take a lower priority than other processes on the server. As such, other processes won't have to wait as long.

I've never used this myself (I run CloudLinux), but I believe the following entry should help with the problem:

username    hard    priority    30

This sets the maximum priority for processes executed by the user to 30. From what I understand, a higher priority actually means that other processes (with a lower priority) get more CPU time.

On my server running cPanel, most processes have a priority of 20, so following the above logic, setting the priority for that user to 30 should allow other processes to execute before these processes.

Answer 2

Have you tried Cgroups?

---

• Install the service sudo yum install libcgroup and start it sudo service cgconfig start.
• After which view the subsystem configuration for the cgroups by running sudo ls /cgroup

---

Create a cgroup named limitcpu. Lines that start with group create cgroups and set subsystem parameters.

Example /etc/cgconfig.conf:

group limitcpu{

        cpu {
                cpu.shares = 200;
                # cpu.cfs_period_us
                # cpu.cfs_quota_us
        }
        memory {

        }
}

For CPU limiting there are a couple of tunable parameters that you can use to limit blatant CPU usage

If tasks in a cgroup should be able to access a single CPU for 0.1 (10%) seconds out of every 1 second, set cpu.cfs_quota_us to 100000 and cpu.cfs_period_us to 1000000.

---

Cgred is a service (which starts the cgrulesengd service) that moves tasks into cgroups according to parameters set in the /etc/cgrules.conf file. Entries in the /etc/cgrules.conf file can take one of these two forms:

user subsystems control_group
user:command subsystems control_group

Where user with a user name or a group name prefixed with the "@" character. Replace subsystems with a comma‑separated list of subsystem names, control_group represents a path to the cgroup, and command stands for a process name or a full command path of a process.

Example etc/cgrules.conf:

*:firefox      cpu,memory      browsers/
@admin:memhog  memory          limitmem/
cpuhog         cpu             limitcpu/

• firefox processes run by any user will be automatically added to the browsers cgroup and limited in cpu and memory subsystems.

• memhog processes run by anyone in the admin group will be added to the cgroup limitmem and limited in memory subsystem.

  - Your user, cpuhog, will be added to cgroup 'limitcpu' and limited in cpu subsystems.

---

In advance use cases, you can try utilizing a template instead.

For example, specify the following template in /etc/cgconfig.conf:

template users/%g/%u {
                     cpuacct{
                     }
                     cpu {
                        cpu.shares = "1000";
                     }
          }

Then use the users/%g/%u template in the third row of a /etc/cgrules.conf entry, which can look as follows:

peter:ftp       cpu     users/%g/%u

The %g and %u variables used above are automatically replaced with group and user name depending on the owner of the ftp process.

If the process belongs to peter from the adminstaff group, the above path is translated to users/adminstaff/peter.

The cgred service then searches for this directory, and if it does not exist, cgred creates it and assigns the process to users/adminstaff/peter/tasks.

Note that template rules apply only to definitions of templates in configuration files, so even if "group users/adminstaff/peter" was defined in /etc/cgconfig.conf, it would be ignored in favor of "template users/%g/%u".

Tutorial by Digital Ocean.

Introduction to Control Groups.

Answer 3

You can probably try to setup /etc/security/limits.conf there you should be able to adjust how much cpu time and memory a user can consume. For details see https://linux.die.net/man/5/limits.conf