How to Limit Time and Memory Usage of Processes in Linux

Managing system resources is crucial for maintaining a stable and efficient Linux environment. Limiting the time and memory usage of processes helps prevent any single task from exhausting system resources, which can cause slowdowns or crashes. This guide walks you through practical methods to control CPU time and memory limits for your processes effectively.

What You’ll Need

• A Linux system with shell access (terminal or SSH)
• Basic command-line knowledge
• Root or sudo privileges for some commands (depending on the method)
• Tools like ulimit, timeout, and cgroups (usually pre-installed)

Step-by-Step

1. Understand the basics of resource limits: Linux offers several ways to limit process resources, such as ulimit for shell-imposed limits, timeout for controlling execution time, and Control Groups (cgroups) for advanced resource management.
2. Limit CPU time using ulimit: The shell built-in ulimit can restrict the CPU time a process can consume. For example, to limit CPU time to 60 seconds, run:

   ulimit -t 60

   Then start the process in the same shell. When the process exceeds 60 seconds of CPU time, it will be terminated by the system.

3. Limit memory usage with ulimit: You can limit the maximum resident set size (physical memory) a process may use. For example, to limit memory to 500 MB:

   ulimit -v 512000

   This sets the virtual memory limit in kilobytes. Processes exceeding this limit will receive a memory allocation error or be killed.
4. Use timeout to limit wall-clock time: The timeout command runs a process with a maximum real time limit. For example, to run a script for no longer than 120 seconds:

   timeout 120s ./your_script.sh

   After 120 seconds, the process is sent a SIGTERM signal. You can customize the signal if needed.

5. Combine ulimit and timeout for comprehensive limits: First set resource limits with ulimit, then execute the command with timeout to control both CPU and wall-clock time.

   ulimit -t 60 -v 512000
   timeout 120s ./your_script.sh

6. Implement cgroups for advanced resource control: Control Groups (cgroups) provide fine-grained control over CPU, memory, and other resources.
   • Create a cgroup. For cgroup v2 (modern systems):

     sudo mkdir /sys/fs/cgroup/mygroup
     sudo echo "50000000" > /sys/fs/cgroup/mygroup/cpu.max

     This limits CPU to 50ms of CPU time per 100ms period (50%).

   • Limit memory in cgroup:

     sudo echo 536870912 > /sys/fs/cgroup/mygroup/memory.max

     This limits memory to 512 MB (bytes).

   • Start a process in the cgroup:

     sudo cgexec -g memory,cpu:mygroup ./your_script.sh

     If cgexec is not available, you may echo the process ID to cgroup.procs manually.
7. Use systemd slices for persistent limits (if applicable): On systems using systemd, you can create custom slices with resource limits.
   • Create a slice file, e.g., /etc/systemd/system/myslice.slice, with contents:

     [Slice]
     CPUQuota=50%
     MemoryMax=512M

   • Reload systemd and start your service or process in this slice.
8. Verify limits are in effect: Use commands like ulimit -a to see shell limits or check cgroup files (e.g., cat /sys/fs/cgroup/mygroup/memory.max). Running top, htop, or ps can help monitor resource usage in real-time.

Common Mistakes

• Setting limits in one shell but running the process in another, causing limits not to apply.
• Confusing CPU time limits (user CPU seconds) with wall-clock time limits.
• Not having sufficient permissions to set or enforce limits, especially with cgroups or systemd slices.
• Using ulimit limits that are too restrictive, causing processes to fail unexpectedly.
• Forgetting to check if cgroups v1 or v2 is in use, which affects commands and paths.
• Assuming timeout kills processes immediately; it sends SIGTERM first, which can be ignored by the process.

Tips

• Use timeout --kill-after=5s to forcibly kill processes that ignore SIGTERM.
• Combine resource limits with logging to track when limits are hit and diagnose issues.
• For scripts, place ulimit commands at the start to ensure limits apply to all child processes.
• Use cgroups for containerized or multi-user environments to isolate resource usage effectively.
• Regularly monitor system resource usage to adjust limits based on real-world needs.
• Consider using tools like prlimit to set limits on already running processes without restarting them.

Troubleshooting

If your resource limits do not seem to work as expected, try the following:

• Check shell context: If you set ulimit in one shell, make sure you start the process in the same shell session or script.
• Verify permissions: Some limits require root privileges. For cgroups, ensure your user has access or use sudo.
• Confirm cgroup version: Run stat -fc %T /sys/fs/cgroup/ to determine if your system uses cgroup v2 (usually “cgroup2fs”) or v1 and adjust commands accordingly.
• Check for conflicting limits: System-wide or PAM limits can override or conflict with your settings. Check /etc/security/limits.conf and PAM configs.
• Use verbose or debug flags: For example, timeout --verbose shows signals sent, helping diagnose hung processes.
• Examine logs: System logs (journalctl or /var/log/syslog) may contain messages about processes killed due to memory limits.
• Test with simple commands: Run a known resource-heavy command like yes > /dev/null with limits to verify enforcement.

Frequently Asked Questions

How is CPU time limited by ulimit different from using timeout?

ulimit -t limits the total CPU time a process can consume, counting only time the CPU spends executing the process. timeout limits the total wall-clock time regardless of CPU usage.

Can I limit memory for already running processes?

Yes, with tools like prlimit or by manually moving the process to a cgroup with memory limits.

What happens if a process exceeds its memory limit?

The kernel may kill the process with an Out-Of-Memory (OOM) error or cause allocation failures depending on the limit type.

Are these limits permanent?

Limits set with ulimit last for the shell session or script. cgroups and systemd slices can enforce persistent limits.

How do I find out which cgroup version my system uses?

Run stat -fc %T /sys/fs/cgroup/. “cgroup2fs” means cgroup v2; “tmpfs” with “cgroup” subfolders usually means v1.

Can I limit other resources like disk I/O?

Yes, cgroups support disk I/O limits, CPU shares, and more, but this requires additional configuration.

By following these steps and understanding the tools available in Linux, you can effectively manage process resource usage. This helps maintain system responsiveness and prevents runaway processes from affecting other users or services.

Related

• How to Fix Out of Memory Errors in Linux Systems
• How to Restrict Memory Usage for Linux Programs Effectively
• How to Decompress Zstd Files on Linux Terminal Efficiently