[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-devel] Problems with dom0 and low memory

I'm not sure whether this was related to low memory, but I have seen an ext3 journal abort like this on a xenU domain, and have also had one occurrence of ext3 file corruption on the same domain. Not while I was active on that domain.

It seems that a worm was probing for one of the IIS buffer overflow exploits: initially I saw a lot of "\x90\x90\x90\x90\x90\x90\x90\x90..." sequences in /lib/modules/2.6.9-xenU/modules.alias, which didn't go down very well with the boot process. I fsck'ed the beast, letting it unpick quite a tangle. Subsequently I have seen large SEARCH blocks containing that (and similar garbage) appear in the httpd/access_log, and a bit googling about suggested that it was probably one of the IIS worms. There's also an attempt to POST a minegrew$ dll to the system - also a known exploit.

I haven't been able to pin any of this down more closely, and am a bit concerned about the ext3 file system corruption.


Jérôme Petazzoni wrote:

I am running a Xen box where I need a lot of memory for a given domain (which runs memory-hungry java apps). I had reduced the memory of domain0 to 42000KB. It *seems* that after running OK for a while, a low memory condition on domain0 messed during a short time the VBD of the other domains, and they got a burst if I/O errors. After this event, the other domains were still running, and their VBD were still working, but the burst of I/O errors aborted the ext3 journal on the filesystems (causing them to go read-only).

Here are the kernel logs of both domains if you want to check that it's indeed a low memory condition problem and not something else (which would then be a "real" bug).

I increased the memory allocated to domain0, but it would be interesting to know if there is a way to avoid those problems (I thought about increasing /proc/sys/vm/min_free_kbytes ; would it be useful here?)

The dom0 and domU kernels, as well as xen itself, the associated symbols, and the same log files are located here, if someone needs them:

SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
Xen-devel mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.