Selinux Commands Fail On Low Memory Box

Home » CentOS » Selinux Commands Fail On Low Memory Box
CentOS 3 Comments

Hey all,

I have 3 web servers hosted at Digital Ocean that all have the same amount of memory at 512MB. They’re all running CentOS 7.

They are low powered apache servers and don’t really need more than that. All they’re doing is serving the web, no database on those hosts at all.

On the first two hosts I seem to have no trouble running SELinux related commands. It’s only on the 3rd web server where I seem to have any trouble at all running the SELinux commands I want to keep the box secure.

On box #3 all SElinux commands end up the same way. For example:

[root@ops3:~] #semodule -i newrelic.pp Killed

And that happened when I had about 280MB free:

[root@ops3:~] #free -m
total used free shared buff/cache available Mem: 490 96 286 28 107
285
Swap: 0 0 0

Typically what I’ll do is stop all the main services on this machine to free up some memory to run the command I want. But to no avail! The commands die with the same errors every time. Whereas on the other two hosts I can run the same commands with only as little as 30 or 40MB free!

So would this be some inherent flaw with this box? That the only way to get around it is to scrap it and build a replacement?

Not that hard to do. But before I took that measure I was wondering if there was any hocus-pocus I could try that I might not be aware of that could alleviate this scenario.

Thanks, Tim

3 thoughts on - Selinux Commands Fail On Low Memory Box

  • Not a bad idea, Eero! That worked.

    [root@ops3:~] #cat /proc/swaps Filename Type Size Used Priority
    /swapfile file 1048572 712 -1

    [root@ops3:~] #semodule -i newrelic.pp
    [root@ops3:~] #

    Thanks!
    Tim

  • You might want to consider permanent swap, particularly for such low-memory systems. For a simple web server, you’d probably benefit from having the rest of the OS swapped out and dedicate more memory to the httpds and disk caches. If you’re concerned about your web server processes using swap, you can adjust the vm.swappiness parameter for the httpd systemd unit’s cgroup setting.