Re: [Openvpn-devel] [PATCH] Require at least 20MB of mlock()-able memory if --mlock is used.

[Gert D. <ge...@gr...>]

Hi,

On Sun, Mar 07, 2021 at 02:20:32PM -0500, Selva Nair wrote:
> > That's another possible angle... just up soft+hard to "something"
> > (how much would that be? :-) ) and log the fact.
> 
> Rereading my comment on Trac #1059 I recall testing this and concluding
> 100MB enough for clients. On modern machines that's a low amount of memory
> --- not allowing swapout of 100MB should be acceptable.  For servers, I
> think there is no reliable limit that we could come up with.

This is interesting.  My machines, including servers, have a way lower
memory usage - but I'm not using EC.

Here's a linux server with 3 peers and a client (arm32):

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root     14569  0.0  0.5   5704  2980 ?        Ss    2020  12:31 openvpn
root     21020  0.1  0.5   5568  3040 ?        Ss    2020 454:45 openvpn

Here's a FreeBSD server that serves 5 clients right now, but has peaks
up to 150 concurrent clients (amd64)

USER      PID   %CPU %MEM    VSZ    RSS TT  STAT STARTED          TIME COMMAND
root     5023    0.3  0.1  30924  23172  -  Ss   20Dec20    1945:07.12 /usr/local/sbin/openvpn --cd /usr/local/etc/openvpn --daemon

... and another two Linux server instances...

USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root      1138  2.1  1.3  26732 10628 ?        Ss    2019 21678:18 /usr/sbin/openvpn
root      2897  0.8  0.9  29548  7080 ?        Ss    2019 8596:15 /usr/sbin/openvpn


the last 3 see a high number of clients during work time, and quite
some churn (especially due to iOS/android connecting and disconnecting
frequently), but long-term memory usage is not high.

So there must be some massive transient usage due to EC at reconnection
time...


But anyway.  100M seems to be a good value, then.

I'll send a v2 of that patch, with setrlimit().

thanks,

gert

-- 
"If was one thing all people took for granted, was conviction that if you 
 feed honest figures into a computer, honest figures come out. Never doubted 
 it myself till I met a computer with a sense of humor."
                             Robert A. Heinlein, The Moon is a Harsh Mistress

Gert Doering - Munich, Germany                             ge...@gr...