add
This commit is contained in:
root
142
notizen
142
notizen
@@ -21,7 +21,37 @@ StandardOutput=append:/var/log/vmstat.log
|
|||||||
VMSTAT_OPTS=-ntw
|
VMSTAT_OPTS=-ntw
|
||||||
VMSTAT_DELAY=3
|
VMSTAT_DELAY=3
|
||||||
VMSTAT_LOG=/var/log/vmstat.log
|
VMSTAT_LOG=/var/log/vmstat.log
|
||||||
|
#########Unit aufbau
|
||||||
|
# Unit ist immer vorhanden
|
||||||
|
[Unit]
|
||||||
|
Description=Freie Beschreibung
|
||||||
|
Documentation=Bezug zu Dok Quellen
|
||||||
|
# Reihenfolge (keine Abhängigkeiten)
|
||||||
|
# systemd ist egozentrisch
|
||||||
|
After=diese Units mögen bitte vorher gestartet werden
|
||||||
|
Before=diese Unit möge bitte vor den hier genannten gestartet werden
|
||||||
|
# Abhängigkeiten
|
||||||
|
Wants=diese Units werden mit dieser Unit gestartet.
|
||||||
|
Require=diese Units werden benötigt und werden mit dieser Unit gestartet. Ausfall führt zu einem Fehler.
|
||||||
|
|
||||||
|
# targets bestehen i.d.R. nur aus der [Unit]-Sektion
|
||||||
|
|
||||||
|
#Typ des Unitfiles
|
||||||
|
#Hier stehen Anweisungen, die spezifisch für die Unit sind.\\
|
||||||
|
#Dokumentation unter ''man systemd.<unit type>''
|
||||||
|
[Service]
|
||||||
|
ExecStart=/usr/bin/daemond --param arg
|
||||||
|
|
||||||
|
# Restart-Logik. Watchdog-Funktionen
|
||||||
|
Restart=on-failure
|
||||||
|
RestartSec=5
|
||||||
|
|
||||||
|
# kann entfallen, dann ist das Unit static und kann nicht enabled/disabled werden
|
||||||
|
[Install]
|
||||||
|
# Rückwärts-Abhängigkeiten
|
||||||
|
WantedBy=multi-user.target
|
||||||
|
RequiredBy=
|
||||||
|
#####################
|
||||||
###############################
|
###############################
|
||||||
#oneShort beispiel
|
#oneShort beispiel
|
||||||
#vorbereitung
|
#vorbereitung
|
||||||
@@ -137,5 +167,117 @@ ssh 10.9.8.7
|
|||||||
ip a
|
ip a
|
||||||
exit
|
exit
|
||||||
####################################
|
####################################
|
||||||
|
#Capipilitäts
|
||||||
|
# cat /bin/ping > /usr/local/bin/PING
|
||||||
|
# chmod +x /usr/local/bin/PING
|
||||||
|
$ PING 9.9.9.9 # geht nicht
|
||||||
|
# setcap cap_net_raw=p /usr/local/bin/PING
|
||||||
|
$ PING 9.9.9.9 # geht
|
||||||
|
|
||||||
|
$ getpcap <pid>
|
||||||
|
$ grep ^Cap /proc/<pid>/status
|
||||||
|
$ /usr/sbin/capsh --decode=0x00003f
|
||||||
|
|
||||||
|
#Auf einer anderen Shell
|
||||||
|
$ strace -e trace=%creds -ff -p <pid der Shell>
|
||||||
|
|
||||||
|
#Auf der ping Shell
|
||||||
|
$ PING -c 3 9.9.9.9
|
||||||
|
#BoundingSet
|
||||||
|
capsh --drop=cap_chown,cap_net_raw --
|
||||||
|
chown nutzer /tmp
|
||||||
|
cd /proc/self
|
||||||
|
grep ^Cap status
|
||||||
|
exit
|
||||||
|
cd /proc/self
|
||||||
|
grep ^Cap status
|
||||||
|
##CPU set property
|
||||||
|
systemctl set-property cups.service CPUWeight=33
|
||||||
|
##show
|
||||||
|
systemctl show cups.service -p CPUWeight
|
||||||
|
# Geht auch mit Quota=100 CPUQuota=100%
|
||||||
|
# Run Unit mit cgroups
|
||||||
|
systemd-run --unit <name> -p CPUQuota=40% <process-name beispiel stress-ng --cpu 8>
|
||||||
|
# mit cat kann auch schnell ein template generieren
|
||||||
|
systemctl cat <name>
|
||||||
|
# mit angaben --unit kann ich die bestehende steueren
|
||||||
|
# [Unit] mit abhängigkeiten
|
||||||
|
# Requires muss in der HauptUnit angeben werden
|
||||||
|
# PartOf muss in der ReqUnit angeben werden (Kind lässt sich alleine Starten)
|
||||||
|
####Anders
|
||||||
|
#in der Main Unit mit Wants
|
||||||
|
#
|
||||||
|
|
||||||
|
[Unit]
|
||||||
|
Description=CPU Stress
|
||||||
|
#Requires=vmstress.service
|
||||||
|
#Wants=vmstress.service
|
||||||
|
#After=vmstress.service
|
||||||
|
Befor=vmstress.service
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=simple
|
||||||
|
CPUQuota=4%
|
||||||
|
ExecStart=/usr/bin/stress-ng --cpu 4
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=my.target
|
||||||
|
##################################
|
||||||
|
#Templating wird mit @ gespeichert
|
||||||
|
[Unit]
|
||||||
|
Description=%i Stress as a Service
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=simple
|
||||||
|
CPUQuota=4%
|
||||||
|
KillMode=mixed
|
||||||
|
ExecStart=/usr/bin/stress-ng --%i 4
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=my.target
|
||||||
|
##Aufruf für cpu
|
||||||
|
#
|
||||||
|
|
||||||
|
systemctl start stress@vm.service
|
||||||
|
systemctl start stress@cpu.service
|
||||||
|
|
||||||
|
#um es ins Filesystem zubekommen muss es enabled werden
|
||||||
|
##Unit Baum anzeigen
|
||||||
|
systemctl list-dependencies sshd
|
||||||
|
###systemctl edit --full pyhttp@.service
|
||||||
|
[Unit]
|
||||||
|
Description=Start Server in %I
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=simple
|
||||||
|
Restart=on-failure
|
||||||
|
ExecStart=/usr/bin/python3 -m http.server
|
||||||
|
WorkingDirectory=%I
|
||||||
|
|
||||||
|
ReadOnlyPaths=/var /usr
|
||||||
|
InaccessiblePaths=/sys /proc
|
||||||
|
##Run systemctl start pyhttp@-var-log.service
|
||||||
|
#- wird escaped
|
||||||
|
|
||||||
|
Liste :
|
||||||
|
|
||||||
|
Specifier Meaning
|
||||||
|
%n %N Full unit name
|
||||||
|
%p %P Prefix name (before @ character)
|
||||||
|
%i %I Instance name (after @ character)
|
||||||
|
%f Unescaped filename
|
||||||
|
%c Control group path of the unit (without /sys/fs/cgroup/systemd/)
|
||||||
|
%r Control group path of the slice (parent cgroup)
|
||||||
|
%R Root control group path (for system instances /)
|
||||||
|
%t Runtime directory (/run [system] or „$XDG_RUNTIME_DIR“ [user]
|
||||||
|
%u User name
|
||||||
|
%U User UID
|
||||||
|
%h User home directory
|
||||||
|
%s User shell
|
||||||
|
%m Machine ID
|
||||||
|
%b Boot ID
|
||||||
|
%H Host name
|
||||||
|
%v Kernel release (uname -r output
|
||||||
|
%% Single percent sign
|
||||||
|
|
||||||
|
für Unit
|
||||||
|
|||||||
9
vmanlegen
Normal file
9
vmanlegen
Normal file
@@ -0,0 +1,9 @@
|
|||||||
|
#/var/lib/machines sourcen kopieren
|
||||||
|
#Verzeichnis anlegen
|
||||||
|
mkdir /etc/systemd/nspawn
|
||||||
|
#Konfig anlegen
|
||||||
|
echo "[Exec]\nPrivateUsers=pick" > /etc/systemd/rocky7.nspawn
|
||||||
|
#VM anlegen vom Template
|
||||||
|
systemctl start systemd-nspawn@rocky7.service
|
||||||
|
#enable
|
||||||
|
systemctl enable systemd-nspawn@rock7.servive
|
||||||
Reference in New Issue
Block a user