linux-kernel - Re: [PATCH v2] kernel/ucounts: expose count of inotify watches in use

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 25 Apr 2019 23:39:58 +0200
From:   Albert Vaca Cintora <albertvaka@...il.com>
To:     Andrew Morton <akpm@...ux-foundation.org>
Cc:     rdunlap@...radead.org, mingo@...nel.org, Jan Kara <jack@...e.cz>,
        ebiederm@...ssion.com,
        Nicolas Saenz Julienne <nsaenzjulienne@...e.de>,
        linux-kernel@...r.kernel.org, Matthias Brugger <mbrugger@...e.com>
Subject: Re: [PATCH v2] kernel/ucounts: expose count of inotify watches in use

On Thu, Apr 25, 2019 at 10:07 PM Andrew Morton
<akpm@...ux-foundation.org> wrote:
>
> On Fri,  1 Feb 2019 21:39:59 +0100 Albert Vaca Cintora <albertvaka@...il.com> wrote:
>
> > Adds a readonly 'current_inotify_watches' entry to the user sysctl table.
> > The handler for this entry is a custom function that ends up calling
> > proc_dointvec. Said sysctl table already contains 'max_inotify_watches'
> > and it gets mounted under /proc/sys/user/.
> >
> > Inotify watches are a finite resource, in a similar way to available file
> > descriptors. The motivation for this patch is to be able to set up
> > monitoring and alerting before an application starts failing because
> > it runs out of inotify watches.
>
> Matthias said "Albert found this problem while working on montitoring
> software, so it fixes a real problem out there", so please include full
> details of the problem which you encountered so that we are better able
> to understand the value of the patch.
>

This is an important metric to track as a sysadmin. Currently,
monitoring software have to workaround the lack of a single metric by
iterating all the file descriptors for all processes and checking
which ones are inotify watches [1].

If this seems enough justification to you, please say so and I will
submit a patch v3 with the requested implementation changes.

[1] https://github.com/prometheus/node_exporter/blob/master/text_collector_examples/inotify-instances

Albert