diff --git a/documentation/content/en/books/handbook/config/_index.adoc b/documentation/content/en/books/handbook/config/_index.adoc --- a/documentation/content/en/books/handbook/config/_index.adoc +++ b/documentation/content/en/books/handbook/config/_index.adoc @@ -1,17 +1,17 @@ --- -title: Chapter 14. Configuration and Tuning +title: Chapter 14. Configuration, Services, Logging and Power Management part: Part III. System Administration prev: books/handbook/partiii next: books/handbook/boot -description: This chapter explains much of the FreeBSD configuration process, including some of the parameters which can be set to tune a FreeBSD system. -tags: ["configuration", "tuning", "services", "cron", "logging", "configuration files", "sysctl", "tuning disks", "kernel limits", "swap", "power management"] +description: This chapter explains much of the FreeBSD configuration files, how to enable or disable a service, how to configure the logging system and the power management area. +tags: ["configuration", "services", "cron", "periodic", "logging", "configuration files", "sysctl", "swap", "power management"] showBookMenu: true weight: 18 path: "/books/handbook/" --- [[config-tuning]] -= Configuration and Tuning += Configuration, Services, Logging and Power Management :doctype: book :toc: macro :toclevels: 1 @@ -57,28 +57,317 @@ Before reading this chapter, you should: * Understand UNIX(R) and FreeBSD basics (crossref:basics[basics,FreeBSD Basics]). -* Be familiar with the basics of kernel configuration and compilation (crossref:kernelconfig[kernelconfig,Configuring the FreeBSD Kernel]). After reading this chapter, you will know: -* The basics of [.filename]#rc.conf# configuration and [.filename]#/usr/local/etc/rc.d# startup scripts. * How to use the various configuration files in [.filename]#/etc#. +* The basics of [.filename]#rc.conf# configuration and [.filename]#/usr/local/etc/rc.d# startup scripts. * How to tune FreeBSD using man:sysctl[8] variables. -* How to tune disk performance and modify kernel limitations. +* How to configure the power management in FreeBSD. -[[configtuning-starting-services]] -== Starting Services +[[configtuning-configfiles]] +== Configuration Files + +FreeBSD maintains a clear separation between the base system and third party applications and therefore this affects where the configuration files of these applications are located. + +FreeBSD base system configuration is located at the [.filename]#/etc# directory, +and the [.filename]#/usr/local/etc# directory contains all the configuration files of the applications installed on the system through the ports collection and packages. + +The kernel state configuration is located in [.filename]#/etc/sysctl.conf#. +In the section <>, the operation of man:sysctl[8] will be explained in more detail. + +For more information about the FreeBSD file system structure refer to man:hier[7]. + +As a general rule, configuration files do not use a standard on what syntax they must follow. +Although it is true that the `#` character is normally used to comment a line and that each line has a configuration variable. + +[NOTE] +==== +Some applications like man:pkg[8] are starting to use the link:https://github.com/vstakhov/libucl[Universal Configuration Language (UCL)]. +==== + +=== The [.filename]#/etc# directory + +The [.filename]#/etc# directory contains all of the FreeBSD base system configuration files that are responsible for configuring FreeBSD. + +[CAUTION] +==== +*Extreme* caution must be taken when modifying files in the [.filename]#/etc# directory; misconfiguration could make FreeBSD unbootable or malfunction. +==== + +[.informaltable] +[cols="1,1", frame="none"] +|=== + +|[.filename]#/etc# +|System configuration files and scripts. + +|[.filename]#/etc/defaults# +|Default system configuration files, see man:rc[8] for more information. + +|[.filename]#/etc/fstab# +|man:fstab[5] contains descriptive information about the various file systems. + +|[.filename]#/etc/mail# +|Extra man:sendmail[8] configuration and other MTA configuration files. + +|[.filename]#/etc/mtree# +|mtree configuration files, see man: mtree[8] for more information. + +|[.filename]#/etc/pam.d# +|Configuration files for the Pluggable Authentication Modules (PAM) library. + +|[.filename]#/etc/periodic# +|Scripts that are run daily, weekly, and monthly, via man:cron[8], see man:periodic[8] for more information. + +|[.filename]#/etc/rc.d# +|System and daemon startup/control scripts, see man:rc[8] for more information. + +|[.filename]#/etc/rc.conf# +|Contains descriptive information about the local host name, configuration details for any potential network interfaces and which services should be started up at system initial boot time. More information in <> + +|[.filename]#/etc/security# +|OpenBSM audit configuration files, see man:audit[8] for more information. + +|[.filename]#/etc/ppp# +|ppp configuration files, see man:ppp[8] for more information. + +|[.filename]#/etc/ssh# +|OpenSSH configuration files, see man:ssh[1] for more information. + +|[.filename]#/etc/ssl# +|OpenSSL configuration files. + +|[.filename]#/etc/sysctl.conf# +|Contains settings for the kernel. More information in <> + +|=== + +[[configtuning-sysctl]] +=== The sysctl utility + +The man:sysctl[8] utility is used to make changes to a running FreeBSD system. + +The man:sysctl[8] utility retrieves kernel state and allows processes with appropriate privilege to set kernel state. +The state to be retrieved or set is described using a "Management Information Base" ("MIB") style name, described as a dotted set of components. -Many users install third party software on FreeBSD from the Ports Collection and require the installed services to be started upon system initialization. -Services, such as package:mail/postfix[] or package:www/apache22[] are just two of the many software packages which may be started during system initialization. -This section explains the procedures available for starting third party software. +.Management Information Base +[.informaltable] +[cols="1,1", frame="none"] +|=== + +|sysctl +|"Magic" numbers + +|kern +|Kernel functions and features + +|vm +|virtual memory + +|vfs +|Filesystem + +|net +|Network + +|debug +|Debugging parameters + +|hw +|Hardware + +|machdep +|Machine dependent + +|user +|Userland + +|p1003_1b +|POSIX 1003.1B + +|=== + +At its core, man:sysctl[8] serves two functions: to read and to modify system settings. + +To view all readable variables: + +[source,shell] +.... +% sysctl -a +.... -In FreeBSD, most included services, such as man:cron[8], are started through the system startup scripts. +The output should be similar to the following: + +[.programlisting] +.... +kern.ostype: FreeBSD +... +vm.swap_enabled: 1 +vm.overcommit: 0 +vm.domain.0.pidctrl.kdd: 8 +vm.domain.0.pidctrl.kid: 4 +vm.domain.0.pidctrl.kpd: 3 +... +vfs.zfs.sync_pass_rewrite: 2 +vfs.zfs.sync_pass_dont_compress: 8 +vfs.zfs.sync_pass_deferred_free: 2 +.... + +To read a particular variable, specify its name: + +[source,shell] +.... +% sysctl kern.maxproc +.... + +The output should be similar to the following: + +[.programlisting] +.... +kern.maxproc: 1044 +.... + +The Management Information Base (MIB) is hierarchical and hence, specifying a prefix prints all the nodes hanging from it: + +[source,shell] +.... +% sysctl net +.... -=== Extended Application Configuration +The output should be similar to the following: + +[.programlisting] +.... +net.local.stream.recvspace: 8192 +net.local.stream.sendspace: 8192 +net.local.dgram.recvspace: 16384 +net.local.dgram.maxdgram: 2048 +net.local.seqpacket.recvspace: 8192 +net.local.seqpacket.maxseqpacket: 8192 +net.local.sockcount: 60 +net.local.taskcount: 25 +net.local.recycled: 0 +net.local.deferred: 0 +net.local.inflight: 0 +net.inet.ip.portrange.randomtime: 1 +net.inet.ip.portrange.randomcps: 9999 +[...] +.... + +To set a particular variable, use the _variable_=_value_ syntax: + +[source,shell] +.... +# sysctl kern.maxfiles=5000 +.... + +The output should be similar to the following: + +[.programlisting] +.... +kern.maxfiles: 2088 -> 5000 +.... + +[NOTE] +==== +To keep the configuration after a reboot it is necessary to add these variables to the [.filename]#/etc/sysctl.conf# file as explained below. +==== + +[[configtuning-sysctlconf]] +=== The [.filename]#/etc/sysctl.conf# file + +The configuration file for man:sysctl[8], [.filename]#/etc/sysctl.conf#, looks much like [.filename]#/etc/rc.conf#. + +Values are set using a `variable=value` syntax. + +[NOTE] +==== +The specified values are set after the system goes into multi-user mode. +Not all variables are settable in this mode. +==== + +For example, to turn off logging of fatal signal exits and prevent users from seeing processes started by other users, the following tunables can be set in [.filename]#/etc/sysctl.conf#: + +[.programlisting] +.... +# Do not log fatal signal exits (e.g., sig 11) +kern.logsigexit=0 + +# Prevent users from seeing information about processes that +# are being run under another UID. +security.bsd.see_other_uids=0 +.... + +To obtain more information about what function a particular sysctl has, the following command can be executed: + +[source,shell] +.... +% sysctl -d kern.dfldsiz +.... + +The output should be similar to the following: + +[.programlisting] +.... +kern.dfldsiz: Initial data size limit +.... + +[[configtuning-core-configuration]] +=== Managing System-Specific Configuration + +The principal location for system configuration information is [.filename]#/etc/rc.conf#. + +This file contains a wide range of configuration information and it is read at system startup to configure the system. +It provides the configuration information for the [.filename]#rc*# files. + +The entries in [.filename]#/etc/rc.conf# override the default settings in [.filename]#/etc/defaults/rc.conf#. + +[TIP] +==== +The file [.filename]#/etc/defaults/rc.conf# containing the default settings should not be edited. +Instead, all system-specific changes should be made to [.filename]#/etc/rc.conf#. +==== + +A number of strategies may be applied in clustered applications to separate site-wide configuration from system-specific configuration in order to reduce administration overhead. + +The recommended approach is to place system-specific configuration into [.filename]#/etc/rc.conf.local#. + +For example, these entries in [.filename]#/etc/rc.conf# apply to all systems: + +[.programlisting] +.... +sshd_enable="YES" +keyrate="fast" +defaultrouter="10.1.1.254" +.... + +Whereas these entries in [.filename]#/etc/rc.conf.local# apply to this system only: + +[.programlisting] +.... +hostname="node1.example.org" +ifconfig_fxp0="inet 10.1.1.1/8" +.... + +Distribute [.filename]#/etc/rc.conf# to every system using an application such as rsync or puppet, while [.filename]#/etc/rc.conf.local# remains unique. + +Upgrading the system will not overwrite [.filename]#/etc/rc.conf#, so system configuration information will not be lost. + +[TIP] +==== +Both [.filename]#/etc/rc.conf# and [.filename]#/etc/rc.conf.local# are parsed by man:sh[1]. +This allows system operators to create complex configuration scenarios. +Refer to man:rc.conf[5] for further information on this topic. +==== + +[[configtuning-rcd]] +== Managing Services in FreeBSD + +FreeBSD uses the man:rc[8] system of startup scripts during system initialization and for managing services. + +The scripts listed in [.filename]#/etc/rc.d# provide basic services which can be controlled with the `start`, `stop`, and `restart` options to man:service[8]. -Now that FreeBSD includes [.filename]#rc.d#, configuration of application startup is easier and provides more features. -Using the key words discussed in <>, applications can be set to start after certain other services and extra flags can be passed through [.filename]#/etc/rc.conf# in place of hard coded flags in the startup script. A basic script may look similar to the following: [.programlisting] @@ -108,17 +397,86 @@ run_rc_command "$1" .... -This script will ensure that the provided `utility` will be started after the `DAEMON` pseudo-service. -It also provides a method for setting and tracking the process ID (PID). +Refer to extref:{rc-scripting}[this article] for instructions on how to create custom man:rc[8] scripts. + +[[configtuning-starting-services]] +=== Starting Services + +Many users install third party software on FreeBSD from the Ports Collection and require the installed services to be started upon system initialization. + +Services, such as package:security/openssh-portable[] or package:www/nginx[] are just two of the many software packages which may be started during system initialization. +This section explains the procedures available for starting services. + +Since the man:rc[8] system is primarily intended to start and stop services at system startup and shutdown time, the `start`, `stop` and `restart` options will only perform their action if the appropriate [.filename]#/etc/rc.conf# variable is set. + +So the first step to start a service, like for example package:www/nginx[] is to add it to [.filename]#/etc/rc.conf# by executing the following command: + +[source,shell] +.... +# sysrc nginx_enable="YES" +.... + +Then nginx can be started executing the following command: + +[source,shell] +.... +# service nginx start +.... + +[TIP] +==== +To `start`, `stop` or `restart` a service regardless of the settings in [.filename]#/etc/rc.conf#, these commands should be prefixed with "one". +For instance, to start package:www/nginx[] regardless of the current [.filename]#/etc/rc.conf# setting, execute the following command: + +[source,shell] +.... +# service nginx onestart +.... +==== + +[[configtuning-status-services]] +=== Status of a Service + +To determine if a service is running, use the `status` subcommand. + +For example, to verify that package:www/nginx[] is running: + +[source,shell] +.... +# service nginx status +.... -This application could then have the following line placed in [.filename]#/etc/rc.conf#: +The output should be similar to the following: [.programlisting] .... -utility_enable="YES" +nginx is running as pid 27871. .... -This method allows for easier manipulation of command line arguments, inclusion of the default functions provided in [.filename]#/etc/rc.subr#, compatibility with man:rcorder[8], and provides for easier configuration via [.filename]#rc.conf#. +[[configtuning-reload-services]] +=== Reload a Service + +In some cases, it is also possible to `reload` a service. +This attempts to send a signal to an individual service, forcing the service to reload its configuration files. + +In most cases, this means sending the service a `SIGHUP` signal. + +*Not all services support this feature.* + +The man:rc[8] system is used for network services and it also contributes to most of the system initialization. +For instance, when the [.filename]#/etc/rc.d/bgfsck# script is executed, it prints out the following message: + +[source,shell] +.... +Starting background file system checks in 60 seconds. +.... + +This script is used for background file system checks, which occur only during system initialization. + +Many system services depend on other services to function properly. +For example, man:yp[8] and other RPC-based services may fail to start until after the man:rpcbind[8] service has started. + +Additional information can be found in man:rc[8] and man:rc.subr[8]. === Using Services to Start Services @@ -132,12 +490,21 @@ The `@reboot` feature of man:cron[8], may be used in place of the time specification. This causes the job to run when man:cron[8] is started, normally during system initialization. +[[cron-periodic]] +== Cron and Periodic + +Scheduling tasks to run at a certain day or time is a very common task on FreeBSD. +The tool in charge of performing this task is man:cron[8]. + +In addition to tasks that can be scheduled by the user via man:cron[8], FreeBSD performs routine background tasks managed by man:periodic[8]. + [[configtuning-cron]] -== Configuring man:cron[8] +=== Cron + +The man:cron[8] utility runs in the background and regularly checks [.filename]#/etc/crontab# for tasks to execute and searches [.filename]#/var/cron/tabs# for custom crontab files. -One of the most useful utilities in FreeBSD is cron. -This utility runs in the background and regularly checks [.filename]#/etc/crontab# for tasks to execute and searches [.filename]#/var/cron/tabs# for custom crontab files. These files are used to schedule tasks which cron runs at the specified times. + Each entry in a crontab defines a task to run and is known as a _cron job_. Two different types of configuration files are used: the system crontab, which should not be modified, and user crontabs, which can be created and edited as needed. @@ -155,14 +522,28 @@ .... # /etc/crontab - root's crontab for FreeBSD # -# $FreeBSD$ -# <.> +# $FreeBSD$ <.> +# SHELL=/bin/sh -PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin <.> +PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin <.> +# +#minute hour mday month wday who command <.> +# +# Save some entropy so that /dev/random can re-seed on boot. +*/11 * * * * operator /usr/libexec/save-entropy <.> # -#minute hour mday month wday who command <.> +# Rotate log files every hour, if necessary. +0 * * * * root newsyslog # -*/5 * * * * root /usr/libexec/atrun <.> +# Perform daily/weekly/monthly maintenance. +1 3 * * * root periodic daily +15 4 * * 6 root periodic weekly +30 5 1 * * root periodic monthly +# +# Adjust the time zone if the CMOS clock keeps local time, as opposed to +# UTC time. See adjkerntz(8) for details. +1,31 0-5 * * * root adjkerntz -a + .... <.> Lines that begin with the `+#+` character are comments. A comment can be placed in the file as a reminder of what and why a desired action is performed. Comments cannot be on the same line as a command or else they will be interpreted as part of the command; they must be on a new line. Blank lines are ignored. @@ -171,7 +552,7 @@ <.> This line defines the seven fields used in a system crontab: `minute`, `hour`, `mday`, `month`, `wday`, `who`, and `command`. The `minute` field is the time in minutes when the specified command will be run, the `hour` is the hour when the specified command will be run, the `mday` is the day of the month, `month` is the month, and `wday` is the day of the week. These fields must be numeric values, representing the twenty-four hour clock, or a `*`, representing all values for that field. The `who` field only exists in the system crontab and specifies which user the command should be run as. The last field is the command to be executed. -<.> This entry defines the values for this cron job. The `\*/5`, followed by several more `*` characters, specifies that `/usr/libexec/atrun` is invoked by `root` every five minutes of every hour, of every day and day of the week, of every month.Commands can include any number of switches. However, commands which extend to multiple lines need to be broken with the backslash "\" continuation character. +<.> This entry defines the values for this cron job. The `\*/11`, followed by several more `*` characters, specifies that `/usr/libexec/save-entropy` is invoked by `operator` every eleven minutes of every hour, of every day and day of the week, of every month. Commands can include any number of switches. However, commands which extend to multiple lines need to be broken with the backslash "\" continuation character. [[configtuning-installcrontab]] === Creating a User Crontab @@ -192,9 +573,9 @@ [.programlisting] .... SHELL=/bin/sh -PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin +PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin # Order of crontab fields -# minute hour mday month wday command +# minute hour mday month wday command .... Then add a line for each command or script to run, specifying the time to run the command. @@ -203,18 +584,17 @@ [.programlisting] .... -0 14 * * * /usr/home/dru/bin/mycustomscript.sh +0 14 * * * /home/user/bin/mycustomscript.sh .... [TIP] ==== - Before using a custom script, make sure it is executable and test it with the limited set of environment variables set by cron. To replicate the environment that would be used to run the above cron entry, use: [.programlisting] .... -env -i SHELL=/bin/sh PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin HOME=/home/dru LOGNAME=dru /usr/home/dru/bin/mycustomscript.sh +env -i SHELL=/bin/sh PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin HOME=/home/user LOGNAME=user /home/user/bin/mycustomscript.sh .... The environment set by cron is discussed in man:crontab[5]. @@ -222,160 +602,93 @@ ==== When finished editing the crontab, save the file. -It will automatically be installed and cron will read the crontab and run its cron jobs at their specified times. +It will automatically be installed, and cron will read the crontab and run its cron jobs at their specified times. To list the cron jobs in a crontab, use this command: [source,shell] .... % crontab -l -0 14 * * * /usr/home/dru/bin/mycustomscript.sh .... -To remove all of the cron jobs in a user crontab: +The output should be similar to the following: -[source,shell] +[.programlisting] .... -% crontab -r -remove crontab for dru? y +0 14 * * * /home/user/bin/mycustomscript.sh .... -[[configtuning-rcd]] -== Managing Services in FreeBSD - -FreeBSD uses the man:rc[8] system of startup scripts during system initialization and for managing services. -The scripts listed in [.filename]#/etc/rc.d# provide basic services which can be controlled with the `start`, `stop`, and `restart` options to man:service[8]. -For instance, man:sshd[8] can be restarted with the following command: +To remove all of the cron jobs in a user crontab: [source,shell] .... -# service sshd restart +% crontab -r .... -This procedure can be used to start services on a running system. -Services will be started automatically at boot time as specified in man:rc.conf[5]. -For example, to enable man:natd[8] at system startup, add the following line to [.filename]#/etc/rc.conf#: +The output should be similar to the following: [.programlisting] .... -natd_enable="YES" +remove crontab for user? y .... -If a `natd_enable="NO"` line is already present, change the `NO` to `YES`. -The man:rc[8] scripts will automatically load any dependent services during the next boot, as described below. +[[configtuning-periodic]] +=== Periodic -Since the man:rc[8] system is primarily intended to start and stop services at system startup and shutdown time, the `start`, `stop` and `restart` options will only perform their action if the appropriate [.filename]#/etc/rc.conf# variable is set. -For instance, `sshd restart` will only work if `sshd_enable` is set to `YES` in [.filename]#/etc/rc.conf#. -To `start`, `stop` or `restart` a service regardless of the settings in [.filename]#/etc/rc.conf#, these commands should be prefixed with "one". -For instance, to restart man:sshd[8] regardless of the current [.filename]#/etc/rc.conf# setting, execute the following command: +FreeBSD provides a set of system management scripts to check status of various subsystems, perform security-related checks, rotate log files, etc. +These scripts are run on a periodic basis: daily. weekly, or monthly. +The management of these tasks is performed by man:periodic[8] and its configuration resides in man:periodic.conf[5]. +The periodic tasks are initiated by entries in the system crontab, shown above. -[source,shell] -.... -# service sshd onerestart -.... +Scripts executed by man:periodic[8] are located in [.filename]#/etc/periodic/# for base utilities and in [.filename]#/usr/local/etc/periodic/# for third-party software. -To check if a service is enabled in [.filename]#/etc/rc.conf#, run the appropriate man:rc[8] script with `rcvar`. -This example checks to see if man:sshd[8] is enabled in [.filename]#/etc/rc.conf#: +They are organized in 4 subdirectories, daily, weekly, monthly and security. -[source,shell] -.... -# service sshd rcvar -# sshd -# -sshd_enable="YES" -# (default: "") -.... +[[enable-disable-periodic]] +=== Enable or Disable Periodic Tasks -[NOTE] -==== -The `# sshd` line is output from the above command, not a `root` console. -==== +FreeBSD has some scripts enabled by default to run periodically. -To determine whether or not a service is running, use `status`. -For instance, to verify that man:sshd[8] is running: +To enable or disable a task, the first step is to edit [.filename]#/etc/periodic.conf# executing the following command: [source,shell] .... -# service sshd status -sshd is running as pid 433. +# ee /etc/periodic.conf .... -In some cases, it is also possible to `reload` a service. -This attempts to send a signal to an individual service, forcing the service to reload its configuration files. -In most cases, this means sending the service a `SIGHUP` signal. -Support for this feature is not included for every service. - -The man:rc[8] system is used for network services and it also contributes to most of the system initialization. -For instance, when the [.filename]#/etc/rc.d/bgfsck# script is executed, it prints out the following message: +And then to enable, for example, `daily_status_zfs_enable` put the following content in the file: -[source,shell] +[.programlisting] .... -Starting background file system checks in 60 seconds. +daily_status_zfs_enable="YES" .... -This script is used for background file system checks, which occur only during system initialization. - -Many system services depend on other services to function properly. -For example, man:yp[8] and other RPC-based services may fail to start until after the man:rpcbind[8] service has started. -To resolve this issue, information about dependencies and other meta-data is included in the comments at the top of each startup script. -The man:rcorder[8] program is used to parse these comments during system initialization to determine the order in which system services should be invoked to satisfy the dependencies. - -The following key word must be included in all startup scripts as it is required by man:rc.subr[8] to "enable" the startup script: - -* `PROVIDE`: Specifies the services this file provides. - -The following key words may be included at the top of each startup script. -They are not strictly necessary, but are useful as hints to man:rcorder[8]: - -* `REQUIRE`: Lists services which are required for this service. The script containing this key word will run _after_ the specified services. -* `BEFORE`: Lists services which depend on this service. The script containing this key word will run _before_ the specified services. - -By carefully setting these keywords for each startup script, an administrator has a fine-grained level of control of the startup order of the scripts, without the need for "runlevels" used by some UNIX(R) operating systems. +To disable a task that is active by default, all that needs to be done is to change `YES` to `NO`. -Additional information can be found in man:rc[8] and man:rc.subr[8]. -Refer to extref:{rc-scripting}[this article] for instructions on how to create custom man:rc[8] scripts. - -[[configtuning-core-configuration]] -=== Managing System-Specific Configuration +[[configuring-output-periodic-tasks]] +=== Configuring the Output of Periodic Tasks -The principal location for system configuration information is [.filename]#/etc/rc.conf#. -This file contains a wide range of configuration information and it is read at system startup to configure the system. -It provides the configuration information for the [.filename]#rc*# files. +In [.filename]#/etc/periodic.conf# the variables `daily_output`, `weekly_output` and `monthly_output` specifies where to send the results of the script execution. -The entries in [.filename]#/etc/rc.conf# override the default settings in [.filename]#/etc/defaults/rc.conf#. -The file containing the default settings should not be edited. -Instead, all system-specific changes should be made to [.filename]#/etc/rc.conf#. +By default the output of the periodic scripts are emailed to root, and therefore it is best to read root's mail or alias root to a mailbox that is monitored. -A number of strategies may be applied in clustered applications to separate site-wide configuration from system-specific configuration in order to reduce administration overhead. -The recommended approach is to place system-specific configuration into [.filename]#/etc/rc.conf.local#. -For example, these entries in [.filename]#/etc/rc.conf# apply to all systems: +To send the results to another email or to other emails, add the email addresses separated by spaces to [.filename]#/etc/periodic.conf#: [.programlisting] .... -sshd_enable="YES" -keyrate="fast" -defaultrouter="10.1.1.254" +daily_output="email1@example.com email2@example.com" +weekly_output="email1@example.com email2@example.com" +monthly_output="email1@example.com email2@example.com" .... -Whereas these entries in [.filename]#/etc/rc.conf.local# apply to this system only: +To log periodic output instead of receiving it as email, add the following lines to [.filename]#/etc/periodic.conf#. man:newsyslog[8] will rotate these files at the appropriate times: [.programlisting] .... -hostname="node1.example.org" -ifconfig_fxp0="inet 10.1.1.1/8" +daily_output=/var/log/daily.log +weekly_output=/var/log/weekly.log +monthly_output=/var/log/monthly.log .... -Distribute [.filename]#/etc/rc.conf# to every system using an application such as rsync or puppet, while [.filename]#/etc/rc.conf.local# remains unique. - -Upgrading the system will not overwrite [.filename]#/etc/rc.conf#, so system configuration information will not be lost. - -[TIP] -==== - -Both [.filename]#/etc/rc.conf# and [.filename]#/etc/rc.conf.local# are parsed by man:sh[1]. -This allows system operators to create complex configuration scenarios. -Refer to man:rc.conf[5] for further information on this topic. -==== - [[configtuning-syslog]] == Configuring System Logging @@ -384,11 +697,8 @@ This information also plays an important role in security auditing and incident response. Most system daemons and applications will generate log entries. -FreeBSD provides a system logger, syslogd, to manage logging. -By default, syslogd is started when the system boots. -This is controlled by the variable `syslogd_enable` in [.filename]#/etc/rc.conf#. -There are numerous application arguments that can be set using `syslogd_flags` in [.filename]#/etc/rc.conf#. -Refer to man:syslogd[8] for more information on the available arguments. +FreeBSD provides a system logger, man:syslogd[8], to manage logging. +By default, syslogd is enabled and started when the system boots. This section describes how to configure the FreeBSD system logger for both local and remote logging and how to perform log rotation and log management. @@ -406,7 +716,8 @@ Multiple selector fields can be used for the same action, and are separated with a semicolon (`;`). Using `*` will match everything. The action field denotes where to send the log message, such as to a file or remote log host. -As an example, here is the default [.filename]#syslog.conf# from FreeBSD: + +As an example, here is the default [.filename]#/etc/syslog.conf# from FreeBSD: [.programlisting] .... @@ -417,18 +728,18 @@ # separators. If you are sharing this file between systems, you # may want to use only tabs as field separators here. # Consult the syslog.conf(5) manpage. -*.err;kern.warning;auth.notice;mail.crit /dev/console +*.err;kern.warning;auth.notice;mail.crit /dev/console <.> *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err /var/log/messages security.* /var/log/security auth.info;authpriv.info /var/log/auth.log -mail.info /var/log/maillog -lpr.info /var/log/lpd-errs -ftp.info /var/log/xferlog +mail.info /var/log/maillog <.> cron.* /var/log/cron !-devd -*.=debug /var/log/debug.log +*.=debug /var/log/debug.log <.> *.emerg * +daemon.info /var/log/daemon.log # uncomment this to log all writes to /dev/console to /var/log/console.log +# touch /var/log/console.log and chmod it to mode 600 before it will work #console.info /var/log/console.log # uncomment this to enable logging of all log messages to /var/log/all.log # touch /var/log/all.log and chmod it to mode 600 before it will work @@ -441,48 +752,177 @@ # news.notice /var/log/news/news.notice # Uncomment this if you wish to see messages produced by devd # !devd -# *.>=info -!ppp -*.* /var/log/ppp.log +# *.>=notice /var/log/devd.log <.> !* +include /etc/syslog.d +include /usr/local/etc/syslog.d .... -In this example: +<.> Matches all messages with a level of `err` or higher, as well as `kern.warning`, `auth.notice` and `mail.crit`, and sends these log messages to the console ([.filename]#/dev/console#). +<.> Matches all messages from the `mail` facility at level `info` or above and logs the messages to [.filename]#/var/log/maillog#. +<.> Uses a comparison flag (`=`) to only match messages at level `debug` and logs them to [.filename]#/var/log/debug.log#. +<.> Is an example usage of a program specification. This makes the rules following it only valid for the specified program. In this case, only the messages generated by man:devd[8] are logged to [.filename]#/var/log/devd.log#. + +For more information about [.filename]#/etc/syslog.conf#, its syntax, and more advanced usage examples, see man:syslog.conf[5]. + +[[logging-facilities]] +=== Logging Facilities + +A facility describes the part of the system generating the message. +Facilities are a way of separating the different messages so that it is easier for the user to consult the logs. + +.syslog facilities +[options="header", cols="1,1"] +|=== +| Name | Description + +| auth +| The authorization system: man:login[1], man:su[1], man:getty[8], etc. + +| authpriv +| The same as auth, but logged to a file readable only by root. + +| console +| Messages written to [.filename]#/dev/console# by the kernel console output driver. + +| cron +| Messages written by the man:cron[8] daemon. + +| daemon +| System daemons, such as man:routed[8], that are not provided for explicitly by other facilities. + +| ftp +| The file transfer protocol daemons: man:ftpd[8], man:tftpd[8]. + +| kern +| Messages generated by the kernel. These cannot be generated by any user processes. + +| lpr +| The line printer spooling system: man:lpr[1], man:lpc[8], man:lpd[8], etc. + +| mail +| The mail system. + +| mark +| This facility adds a record every 20 minutes. + +| news +| The network news system. + +| ntp +| The network time protocol system. + +| security +| Security subsystems, such as man:ipfw[4]. + +| syslog +| Messages generated internally by syslogd(8). + +| user +| Messages generated by random user processes. *This is the default facility identifier if none is specified*. + +| uucp +| The Unix-to-Unix Copy system. An ancient protocol. Really weird to see messages from this facility. + +| local0 through local7 +| Reserved for local use. + +|=== + +[[logging-levels]] +=== Logging Levels + +The level describes the severity of the message, and is a keyword from the following ordered list (higher to lower): + +.syslog levels +[options="header", cols="1,1"] +|=== +| Name | Description + +| emerg +| A panic condition. This is normally broadcast to all users. + +| alert +| A condition that should be corrected immediately, such as a corrupted system database. + +| crit +| Critical conditions, e.g., hard device errors. + +| err +| Errors. + +| warning +| Warning messages. + +| notice +| Conditions that are not error conditions, but should possibly be handled specially. + +| info +| Informational messages. + +| debug +| Messages that contain information normally of use only when debugging a program. + +| none +| This special level disables a particular facility. + +|=== + +[[read-log-messages]] +=== Read Log Messages -* Line 8 matches all messages with a level of `err` or higher, as well as `kern.warning`, `auth.notice` and `mail.crit`, and sends these log messages to the console ([.filename]#/dev/console#). -* Line 12 matches all messages from the `mail` facility at level `info` or above and logs the messages to [.filename]#/var/log/maillog#. -* Line 17 uses a comparison flag (`=`) to only match messages at level `debug` and logs them to [.filename]#/var/log/debug.log#. -* Line 33 is an example usage of a program specification. This makes the rules following it only valid for the specified program. In this case, only the messages generated by ppp are logged to [.filename]#/var/log/ppp.log#. +By default FreeBSD log files use the format link:https://datatracker.ietf.org/doc/html/rfc3164[rfc3164], also known as The BSD syslog Protocol. +Learn more about other formats and how to use them at man:syslog[8]. -The available levels, in order from most to least critical are `emerg`, `alert`, `crit`, `err`, `warning`, `notice`, `info`, and `debug`. +Typically the logs have the following syntax: -The facilities, in no particular order, are `auth`, `authpriv`, `console`, `cron`, `daemon`, `ftp`, `kern`, `lpr`, `mail`, `mark`, `news`, `security`, `syslog`, `user`, `uucp`, and `local0` through `local7`. -Be aware that other operating systems might have different facilities. +[.programlisting] +.... +date time hostname program[pid]: the message +.... -To log everything of level `notice` and higher to [.filename]#/var/log/daemon.log#, add the following entry: +The output of the [.filename]#/var/log/cron# file will be used as an example: [.programlisting] .... -daemon.notice /var/log/daemon.log +[...] +Jul 16 12:40:00 FreeBSD /usr/sbin/cron[81519]: (root) CMD (/usr/libexec/atrun) +Jul 16 12:44:00 FreeBSD /usr/sbin/cron[83072]: (operator) CMD (/usr/libexec/save-entropy) +[...] .... -For more information about the different levels and facilities, refer to man:syslog[3] and man:syslogd[8]. -For more information about [.filename]#/etc/syslog.conf#, its syntax, and more advanced usage examples, see man:syslog.conf[5]. +Verbose logging, so the facility and the level on each message will be added, can be enabled in man:syslog[8] by running the following command: + +[source,shell] +.... +# sysrc syslogd_flags="-vv" +.... + +Once the function is activated, the facility and the level will be displayed in the log as shown in the following example: + +[.programlisting] +.... +[...] +Jul 16 17:40:00 FreeBSD /usr/sbin/cron[1016]: (root) CMD (/usr/libexec/atrun) +Jul 16 17:44:00 FreeBSD /usr/sbin/cron[1030]: (operator) CMD (/usr/libexec/save-entropy) +[...] +.... === Log Management and Rotation Log files can grow quickly, taking up disk space and making it more difficult to locate useful information. -Log management attempts to mitigate this. -In FreeBSD, newsyslog is used to manage log files. -This built-in program periodically rotates and compresses log files, and optionally creates missing log files and signals programs when log files are moved. -The log files may be generated by syslogd or by any other program which generates log files. -While newsyslog is normally run from man:cron[8], it is not a system daemon. + +In FreeBSD, man:newsyslog[8] is used to manage log files and attempt to mitigate this. + +This built-in program periodically rotates and compresses log files, and optionally creates missing log files and signals programs when log files are moved. + +[NOTE] +==== +Since newsyslog is run from man:cron[8], it cannot rotate files more often than it is scheduled to run from man:cron[8]. In the default configuration, it runs every hour. +==== -To know which actions to take, newsyslog reads its configuration file, [.filename]#/etc/newsyslog.conf#. -This file contains one line for each log file that newsyslog manages. -Each line states the file owner, permissions, when to rotate that file, optional flags that affect log rotation, such as compression, and programs to signal when the log is rotated. -Here is the default configuration in FreeBSD: +Here is the default configuration in FreeBSD, more information in man:newsyslog.conf[5]: [.programlisting] .... @@ -496,8 +936,6 @@ # is no process which needs to be signalled when a given log file is # rotated, then the entry for that file should include the 'N' flag. # -# The 'flags' field is one or more of the letters: BCDGJNUXZ or a '-'. -# # Note: some sites will want to select more restrictive protections than the # defaults. In particular, it may be desirable to switch many of the 644 # entries to 640 or 600. For example, some sites will consider the @@ -506,37 +944,40 @@ # # logfilename [owner:group] mode count size when flags [/pid_file] [sig_num] /var/log/all.log 600 7 * @T00 J -/var/log/amd.log 644 7 100 * J -/var/log/auth.log 600 7 100 @0101T JC -/var/log/console.log 600 5 100 * J -/var/log/cron 600 3 100 * JC +/var/log/auth.log 600 7 1000 @0101T JC +/var/log/console.log 600 5 1000 * J +/var/log/cron 600 3 1000 * JC /var/log/daily.log 640 7 * @T00 JN -/var/log/debug.log 600 7 100 * JC -/var/log/kerberos.log 600 7 100 * J -/var/log/lpd-errs 644 7 100 * JC +/var/log/debug.log 600 7 1000 * JC +/var/log/init.log 644 3 1000 * J +/var/log/kerberos.log 600 7 1000 * J /var/log/maillog 640 7 * @T00 JC -/var/log/messages 644 5 100 @0101T JC +/var/log/messages 644 5 1000 @0101T JC /var/log/monthly.log 640 12 * $M1D0 JN -/var/log/pflog 600 3 100 * JB /var/run/pflogd.pid -/var/log/ppp.log root:network 640 3 100 * JC -/var/log/devd.log 644 3 100 * JC -/var/log/security 600 10 100 * JC -/var/log/sendmail.st 640 10 * 168 B +/var/log/devd.log 644 3 1000 * JC +/var/log/security 600 10 1000 * JC /var/log/utx.log 644 3 * @01T05 B -/var/log/weekly.log 640 5 1 $W6D0 JN -/var/log/xferlog 600 7 100 * JC +/var/log/weekly.log 640 5 * $W6D0 JN +/var/log/daemon.log 644 5 1000 @0101T JC + + /etc/newsyslog.conf.d/[!.]*.conf + /usr/local/etc/newsyslog.conf.d/[!.]*.conf .... -Each line starts with the name of the log to be rotated, optionally followed by an owner and group for both rotated and newly created files. -The `mode` field sets the permissions on the log file and `count` denotes how many rotated log files should be kept. -The `size` and `when` fields tell newsyslog when to rotate the file. -A log file is rotated when either its size is larger than the `size` field or when the time in the `when` field has passed. -An asterisk (`*`) means that this field is ignored. -The _flags_ field gives further instructions, such as how to compress the rotated file or to create the log file if it is missing. -The last two fields are optional and specify the name of the Process ID (PID) file of a process and a signal number to send to that process when the file is rotated. +. `logfilename` - Name of the system log file to be archived. +. `[owner:group]` - This optional field specifies the owner and group for the archive file. +. `mode` - Specify the file mode of the log file and archives. Valid mode bits are 0666. (That is, read and write permissions for the rotated log may be specified for the owner, group, and others.) +. `count` - Specify the maximum number of archive files which may exist. +. `size` - When the size of the log file reaches size in kilobytes, the log file will be trimmed as described above. If this field contains an asterisk ('*'), the log file will not be trimmed based on size. +. `when` - Consist of an interval, a specific time, or both. Supported options in man:newsyslog.conf[5]. +. `flags` - Indicates the flags that newsyslog accepts, supported options in man:newsyslog.conf[5]. +. `[/pid_file]` - This optional field specifies the file name containing a daemon's process ID or to find a group process ID. +. `[sig_num]` - This optional field specifies the signal that will be sent to the daemon process. -For more information on all fields, valid flags, and how to specify the rotation time, refer to man:newsyslog.conf[5]. -Since newsyslog is run from man:cron[8], it cannot rotate files more often than it is scheduled to run from man:cron[8]. +[NOTE] +==== +The last two fields are optional and specify the name of the Process ID (PID) file of a process and a signal number to send to that process when the file is rotated. +==== [[network-syslogd]] === Configuring Remote Logging @@ -545,12 +986,15 @@ Configuring centralized logging can reduce some of the administrative burden of log file administration. In FreeBSD, centralized log file aggregation, merging, and rotation can be configured using syslogd and newsyslog. + This section demonstrates an example configuration, where host `A`, named `logserv.example.com`, will collect logging information for the local network. + Host `B`, named `logclient.example.com`, will be configured to pass logging information to the logging server. ==== Log Server Configuration A log server is a system that has been configured to accept logging information from other hosts. + Before configuring a log server, check the following: * If there is a firewall between the logging server and any logging clients, ensure that the firewall ruleset allows UDP port 514 for both the clients and the server. @@ -574,12 +1018,12 @@ When adding multiple log clients, add a similar two-line entry for each client. More information about the available facilities may be found in man:syslog.conf[5]. -Next, configure [.filename]#/etc/rc.conf#: +Next, execute the following commands: -[.programlisting] +[source,shell] .... -syslogd_enable="YES" -syslogd_flags="-a logclient.example.com -v -v" +# sysrc syslogd_enable="YES" +# sysrc syslogd_flags="-a logclient.example.com -v -v" .... The first entry starts syslogd at system boot. @@ -614,12 +1058,12 @@ A logging client sends log entries to a logging server on the network. The client also keeps a local copy of its own logs. -Once a logging server has been configured, edit [.filename]#/etc/rc.conf# on the logging client: +Once a logging server has been configured, execute the following commands on the logging client: -[.programlisting] +[source,shell] .... -syslogd_enable="YES" -syslogd_flags="-s -v -v" +# sysrc syslogd_enable="YES" +# sysrc syslogd_flags="-s -v -v" .... The first entry enables syslogd on boot up. @@ -630,7 +1074,7 @@ [.programlisting] .... -*.* @logserv.example.com +*.* @logserv.example.com .... After saving the edit, restart syslogd for the changes to take effect: @@ -658,11 +1102,12 @@ If the `ping` succeeds on both hosts but log messages are still not being received, temporarily increase logging verbosity to narrow down the configuration issue. In the following example, [.filename]#/var/log/logclient.log# on the logging server is empty and [.filename]#/var/log/messages# on the logging client does not indicate a reason for the failure. + To increase debugging output, edit the `syslogd_flags` entry on the logging server and issue a restart: -[.programlisting] +[source,shell] .... -syslogd_flags="-d -a logclient.example.com -v -v" +sysrc syslogd_flags="-d -a logclient.example.com -v -v" .... [source,shell] @@ -672,7 +1117,7 @@ Debugging data similar to the following will flash on the console immediately after the restart: -[source,shell] +[.programlisting] .... logmsg: pri 56, flags 4, from logserv.example.com, msg syslogd: restart syslogd: restarted @@ -691,6 +1136,12 @@ [source,shell] .... # service syslogd restart +.... + +The output should be similar to the following: + +[.programlisting] +.... logmsg: pri 56, flags 4, from logserv.example.com, msg syslogd: restart syslogd: restarted logmsg: pri 6, flags 4, from logserv.example.com, msg syslogd: kernel boot file is /boot/kernel/kernel @@ -722,790 +1173,328 @@ Setting log files to mode `600` should prevent unwanted access by local users. Refer to man:newsyslog.conf[5] for additional information. -[[configtuning-configfiles]] -== Configuration Files - -=== [.filename]#/etc# Layout - -There are a number of directories in which configuration information is kept. -These include: - -[.informaltable] -[cols="1,1", frame="none"] -|=== - -|[.filename]#/etc# -|Generic system-specific configuration information. - -|[.filename]#/etc/defaults# -|Default versions of system configuration files. - -|[.filename]#/etc/mail# -|Extra man:sendmail[8] configuration and other MTA configuration files. - -|[.filename]#/etc/ppp# -|Configuration for both user- and kernel-ppp programs. +[[acpi-overview]] +== Power and Resource Management -|[.filename]#/usr/local/etc# -|Configuration files for installed applications. May contain per-application subdirectories. +It is important to utilize hardware resources in an efficient manner. +Power and resource management allows the operating system to monitor system limits and to possibly run some actions triggered by events related to those limits. -|[.filename]#/usr/local/etc/rc.d# -|man:rc[8] scripts for installed applications. +[[acpi-config]] +=== ACPI configuration -|[.filename]#/var/db# -|Automatically generated system-specific database files, such as the package database and the man:locate[1] database. -|=== +On FreeBSD the management of these resources is managed by the man:acpi[4] kernel device. -[[configtuning-sysctl]] -== Tuning with man:sysctl[8] +[NOTE] +==== +In FreeBSD the man:acpi[4] driver is loaded by default at system boot. -man:sysctl[8] is used to make changes to a running FreeBSD system. -This includes many advanced options of the TCP/IP stack and virtual memory system that can dramatically improve performance for an experienced system administrator. -Over five hundred system variables can be read and set using man:sysctl[8]. +This driver *cannot be unloaded after boot* because the system bus uses it for various hardware interactions. +==== -At its core, man:sysctl[8] serves two functions: to read and to modify system settings. +In addition to man:acpi[4], FreeBSD has several dedicated kernel modules for various ACPI vendor subsystems. +These modules will add some extra functionality like fan speed, keyboard backlit or screen brightness. -To view all readable variables: +The list can be obtained by running the following command: [source,shell] .... -% sysctl -a +% ls /boot/kernel | grep acpi .... -To read a particular variable, specify its name: +The output should be similar to the following: -[source,shell] +[.programlisting] .... -% sysctl kern.maxproc -kern.maxproc: 1044 +acpi_asus.ko +acpi_asus_wmi.ko +acpi_dock.ko +acpi_fujitsu.ko +acpi_hp.ko +acpi_ibm.ko +acpi_panasonic.ko +acpi_sony.ko +acpi_toshiba.ko +acpi_video.ko +acpi_wmi.ko +sdhci_acpi.ko +uacpi.ko .... -To set a particular variable, use the _variable_=_value_ syntax: +In the event that, for example, an IBM/Lenovo laptop is used, it will be necessary to load the module man:acpi_ibm[4] by executing the following command: [source,shell] .... -# sysctl kern.maxfiles=5000 -kern.maxfiles: 2088 -> 5000 +# kldload acpi_ibm .... -Settings of sysctl variables are usually either strings, numbers, or booleans, where a boolean is `1` for yes or `0` for no. - -To automatically set some variables each time the machine boots, add them to [.filename]#/etc/sysctl.conf#. -For more information, refer to man:sysctl.conf[5] and <>. - -[[configtuning-sysctlconf]] -=== [.filename]#sysctl.conf# - -The configuration file for man:sysctl[8], [.filename]#/etc/sysctl.conf#, looks much like [.filename]#/etc/rc.conf#. -Values are set in a `variable=value` form. -The specified values are set after the system goes into multi-user mode. -Not all variables are settable in this mode. - -For example, to turn off logging of fatal signal exits and prevent users from seeing processes started by other users, the following tunables can be set in [.filename]#/etc/sysctl.conf#: +And add this line to [.filename]#/boot/loader.conf# to load it at boot: [.programlisting] .... -# Do not log fatal signal exits (e.g., sig 11) -kern.logsigexit=0 - -# Prevent users from seeing information about processes that -# are being run under another UID. -security.bsd.see_other_uids=0 +acpi_ibm_load="YES" .... -[[sysctl-readonly]] -=== man:sysctl[8] Read-only +[[cpu-power-management]] +=== CPU Power Management + +CPU is the most consuming part of the system. +Knowing how to improve CPU efficiency is a fundamental part of our system in order to save energy. -In some cases it may be desirable to modify read-only man:sysctl[8] values, which will require a reboot of the system. +In order to make proper use of the machine's resources in a correct way, FreeBSD supports technologies such as Intel Turbo Boost, AMD Turbo Core, Intel Speed Shift among others through the use of man:powerd[8] and cpufreq[4]. -For instance, on some laptop models the man:cardbus[4] device will not probe memory ranges and will fail with errors similar to: +The first step will be to obtain the CPU information by executing the following command: [source,shell] .... -cbb0: Could not map register memory -device_probe_and_attach: cbb0 attach returned 12 +% sysctl dev.cpu.0 <.> .... -The fix requires the modification of a read-only man:sysctl[8] setting. -Add `hw.pci.allow_unsupported_io_range=1` to [.filename]#/boot/loader.conf# and reboot. -Now man:cardbus[4] should work properly. - -[[configtuning-disk]] -== Tuning Disks - -The following section will discuss various tuning mechanisms and options which may be applied to disk devices. -In many cases, disks with mechanical parts, such as SCSI drives, will be the bottleneck driving down the overall system performance. -While a solution is to install a drive without mechanical parts, such as a solid state drive, mechanical drives are not going away anytime in the near future. -When tuning disks, it is advisable to utilize the features of the man:iostat[8] command to test various changes to the system. -This command will allow the user to obtain valuable information on system IO. - -=== Sysctl Variables - -==== `vfs.vmiodirenable` - -The `vfs.vmiodirenable` man:sysctl[8] variable may be set to either `0` (off) or `1` (on). -It is set to `1` by default. This variable controls how directories are cached by the system. -Most directories are small, using just a single fragment (typically 1 K) in the file system and typically 512 bytes in the buffer cache. -With this variable turned off, the buffer cache will only cache a fixed number of directories, even if the system has a huge amount of memory. -When turned on, this man:sysctl[8] allows the buffer cache to use the VM page cache to cache the directories, making all the memory available for caching directories. -However, the minimum in-core memory used to cache a directory is the physical page size (typically 4 K) rather than 512 bytes. -Keeping this option enabled is recommended if the system is running any services which manipulate large numbers of files. -Such services can include web caches, large mail systems, and news systems. -Keeping this option on will generally not reduce performance, even with the wasted memory, but one should experiment to find out. - -==== `vfs.write_behind` - -The `vfs.write_behind` man:sysctl[8] variable defaults to `1` (on). -This tells the file system to issue media writes as full clusters are collected, which typically occurs when writing large sequential files. -This avoids saturating the buffer cache with dirty buffers when it would not benefit I/O performance. -However, this may stall processes and under certain circumstances should be turned off. - -==== `vfs.hirunningspace` - -The `vfs.hirunningspace` man:sysctl[8] variable determines how much outstanding write I/O may be queued to disk controllers system-wide at any given instance. -The default is usually sufficient, but on machines with many disks, try bumping it up to four or five _megabytes_. -Setting too high a value which exceeds the buffer cache's write threshold can lead to bad clustering performance. -Do not set this value arbitrarily high as higher write values may add latency to reads occurring at the same time. - -There are various other buffer cache and VM page cache related man:sysctl[8] values. -Modifying these values is not recommended as the VM system does a good job of automatically tuning itself. - -==== `vm.swap_idle_enabled` - -The `vm.swap_idle_enabled` man:sysctl[8] variable is useful in large multi-user systems with many active login users and lots of idle processes. -Such systems tend to generate continuous pressure on free memory reserves. -Turning this feature on and tweaking the swapout hysteresis (in idle seconds) via `vm.swap_idle_threshold1` and `vm.swap_idle_threshold2` depresses the priority of memory pages associated with idle processes more quickly then the normal pageout algorithm. -This gives a helping hand to the pageout daemon. -Only turn this option on if needed, because the tradeoff is essentially pre-page memory sooner rather than later which eats more swap and disk bandwidth. -In a small system this option will have a determinable effect, but in a large system that is already doing moderate paging, this option allows the VM system to stage whole processes into and out of memory easily. +<.> In this case the `0` digit represents the first core of the CPU. -==== `hw.ata.wc` +The output should be similar to the following: -Turning off IDE write caching reduces write bandwidth to IDE disks, but may sometimes be necessary due to data consistency issues introduced by hard drive vendors. -The problem is that some IDE drives lie about when a write completes. -With IDE write caching turned on, IDE hard drives write data to disk out of order and will sometimes delay writing some blocks indefinitely when under heavy disk load. -A crash or power failure may cause serious file system corruption. -Check the default on the system by observing the `hw.ata.wc` man:sysctl[8] variable. -If IDE write caching is turned off, one can set this read-only variable to `1` in [.filename]#/boot/loader.conf# in order to enable it at boot time. - -For more information, refer to man:ata[4]. - -==== `SCSI_DELAY` (`kern.cam.scsi_delay`) - -The `SCSI_DELAY` kernel configuration option may be used to reduce system boot times. -The defaults are fairly high and can be responsible for `15` seconds of delay in the boot process. -Reducing it to `5` seconds usually works with modern drives. -The `kern.cam.scsi_delay` boot time tunable should be used. -The tunable and kernel configuration option accept values in terms of _milliseconds_ and _not seconds_. - -[[soft-updates]] -=== Soft Updates - -To fine-tune a file system, use man:tunefs[8]. -This program has many different options. -To toggle Soft Updates on and off, use: - -[source,shell] +[.programlisting] .... -# tunefs -n enable /filesystem -# tunefs -n disable /filesystem -.... - -A file system cannot be modified with man:tunefs[8] while it is mounted. -A good time to enable Soft Updates is before any partitions have been mounted, in single-user mode. - -Soft Updates is recommended for UFS file systems as it drastically improves meta-data performance, mainly file creation and deletion, through the use of a memory cache. -There are two downsides to Soft Updates to be aware of. -First, Soft Updates guarantee file system consistency in the case of a crash, but could easily be several seconds or even a minute behind updating the physical disk. -If the system crashes, unwritten data may be lost. -Secondly, Soft Updates delay the freeing of file system blocks. -If the root file system is almost full, performing a major update, such as `make installworld`, can cause the file system to run out of space and the update to fail. - -==== More Details About Soft Updates - -Meta-data updates are updates to non-content data like inodes or directories. -There are two traditional approaches to writing a file system's meta-data back to disk. - -Historically, the default behavior was to write out meta-data updates synchronously. -If a directory changed, the system waited until the change was actually written to disk. -The file data buffers (file contents) were passed through the buffer cache and backed up to disk later on asynchronously. -The advantage of this implementation is that it operates safely. -If there is a failure during an update, meta-data is always in a consistent state. -A file is either created completely or not at all. -If the data blocks of a file did not find their way out of the buffer cache onto the disk by the time of the crash, man:fsck[8] recognizes this and repairs the file system by setting the file length to `0`. -Additionally, the implementation is clear and simple. -The disadvantage is that meta-data changes are slow. -For example, `rm -r` touches all the files in a directory sequentially, but each directory change will be written synchronously to the disk. -This includes updates to the directory itself, to the inode table, and possibly to indirect blocks allocated by the file. -Similar considerations apply for unrolling large hierarchies using `tar -x`. - -The second approach is to use asynchronous meta-data updates. -This is the default for a UFS file system mounted with `mount -o async`. -Since all meta-data updates are also passed through the buffer cache, they will be intermixed with the updates of the file content data. -The advantage of this implementation is there is no need to wait until each meta-data update has been written to disk, so all operations which cause huge amounts of meta-data updates work much faster than in the synchronous case. -This implementation is still clear and simple, so there is a low risk for bugs creeping into the code. -The disadvantage is that there is no guarantee for a consistent state of the file system -If there is a failure during an operation that updated large amounts of meta-data, like a power failure or someone pressing the reset button, the file system will be left in an unpredictable state. -There is no opportunity to examine the state of the file system when the system comes up again as the data blocks of a file could already have been written to the disk while the updates of the inode table or the associated directory were not. -It is impossible to implement a man:fsck[8] which is able to clean up the resulting chaos because the necessary information is not available on the disk. -If the file system has been damaged beyond repair, the only choice is to reformat it and restore from backup. - -The usual solution for this problem is to implement _dirty region logging_, which is also referred to as _journaling_. -Meta-data updates are still written synchronously, but only into a small region of the disk. -Later on, they are moved to their proper location. -Since the logging area is a small, contiguous region on the disk, there are no long distances for the disk heads to move, even during heavy operations, so these operations are quicker than synchronous updates. -Additionally, the complexity of the implementation is limited, so the risk of bugs being present is low. -A disadvantage is that all meta-data is written twice, once into the logging region and once to the proper location, so performance "pessimization" might result. -On the other hand, in case of a crash, all pending meta-data operations can be either quickly rolled back or completed from the logging area after the system comes up again, resulting in a fast file system startup. - -Kirk McKusick, the developer of Berkeley FFS, solved this problem with Soft Updates. -All pending meta-data updates are kept in memory and written out to disk in a sorted sequence ("ordered meta-data updates"). -This has the effect that, in case of heavy meta-data operations, later updates to an item "catch" the earlier ones which are still in memory and have not already been written to disk. -All operations are generally performed in memory before the update is written to disk and the data blocks are sorted according to their position so that they will not be on the disk ahead of their meta-data. -If the system crashes, an implicit "log rewind" causes all operations which were not written to the disk appear as if they never happened. -A consistent file system state is maintained that appears to be the one of 30 to 60 seconds earlier. -The algorithm used guarantees that all resources in use are marked as such in their blocks and inodes. -After a crash, the only resource allocation error that occurs is that resources are marked as "used" which are actually "free". -man:fsck[8] recognizes this situation, and frees the resources that are no longer used. -It is safe to ignore the dirty state of the file system after a crash by forcibly mounting it with `mount -f`. -In order to free resources that may be unused, man:fsck[8] needs to be run at a later time. -This is the idea behind the _background man:fsck[8]_: at system startup time, only a _snapshot_ of the file system is recorded and man:fsck[8] is run afterwards. -All file systems can then be mounted "dirty", so the system startup proceeds in multi-user mode. -Then, background man:fsck[8] is scheduled for all file systems where this is required, to free resources that may be unused. -File systems that do not use Soft Updates still need the usual foreground man:fsck[8]. - -The advantage is that meta-data operations are nearly as fast as asynchronous updates and are faster than _logging_, which has to write the meta-data twice. -The disadvantages are the complexity of the code, a higher memory consumption, and some idiosyncrasies. -After a crash, the state of the file system appears to be somewhat "older". -In situations where the standard synchronous approach would have caused some zero-length files to remain after the man:fsck[8], these files do not exist at all with Soft Updates because neither the meta-data nor the file contents have been written to disk. -Disk space is not released until the updates have been written to disk, which may take place some time after running man:rm[1]. -This may cause problems when installing large amounts of data on a file system that does not have enough free space to hold all the files twice. - -[[configtuning-kernel-limits]] -== Tuning Kernel Limits - -[[file-process-limits]] -=== File/Process Limits - -[[kern-maxfiles]] -==== `kern.maxfiles` - -The `kern.maxfiles` man:sysctl[8] variable can be raised or lowered based upon system requirements. -This variable indicates the maximum number of file descriptors on the system. -When the file descriptor table is full, `file: table is full` will show up repeatedly in the system message buffer, which can be viewed using man:dmesg[8]. - -Each open file, socket, or fifo uses one file descriptor. -A large-scale production server may easily require many thousands of file descriptors, depending on the kind and number of services running concurrently. - -In older FreeBSD releases, the default value of `kern.maxfiles` is derived from `maxusers` in the kernel configuration file. -`kern.maxfiles` grows proportionally to the value of `maxusers`. -When compiling a custom kernel, consider setting this kernel configuration option according to the use of the system. -From this number, the kernel is given most of its pre-defined limits. -Even though a production machine may not have 256 concurrent users, the resources needed may be similar to a high-scale web server. - -The read-only man:sysctl[8] variable `kern.maxusers` is automatically sized at boot based on the amount of memory available in the system, and may be determined at run-time by inspecting the value of `kern.maxusers`. -Some systems require larger or smaller values of `kern.maxusers` and values of `64`, `128`, and `256` are not uncommon. -Going above `256` is not recommended unless a huge number of file descriptors is needed. -Many of the tunable values set to their defaults by `kern.maxusers` may be individually overridden at boot-time or run-time in [.filename]#/boot/loader.conf#. -Refer to man:loader.conf[5] and [.filename]#/boot/defaults/loader.conf# for more details and some hints. - -In older releases, the system will auto-tune `maxusers` if it is set to `0`. footnote:[The auto-tuning algorithm sets maxusers equal to the amount of memory in the system, with a minimum of 32, and a maximum of 384.]. -When setting this option, set `maxusers` to at least `4`, especially if the system runs Xorg or is used to compile software. -The most important table set by `maxusers` is the maximum number of processes, which is set to `20 + 16 * maxusers`. -If `maxusers` is set to `1`, there can only be `36` simultaneous processes, including the `18` or so that the system starts up at boot time and the `15` or so used by Xorg. -Even a simple task like reading a manual page will start up nine processes to filter, decompress, and view it. -Setting `maxusers` to `64` allows up to `1044` simultaneous processes, which should be enough for nearly all uses. -If, however, the error is displayed when trying to start another program, or a server is running with a large number of simultaneous users, increase the number and rebuild. +dev.cpu.0.cx_method: C1/mwait/hwc C2/mwait/hwc C3/mwait/hwc/bma +dev.cpu.0.cx_usage_counters: 3507294 0 0 +dev.cpu.0.cx_usage: 100.00% 0.00% 0.00% last 3804us +dev.cpu.0.cx_lowest: C3 <1> +dev.cpu.0.cx_supported: C1/1/1 C2/2/1 C3/3/57 <2> +dev.cpu.0.freq_levels: 2267/35000 2266/35000 1600/15000 800/12000 <3> +dev.cpu.0.freq: 1600 <4> +dev.cpu.0.temperature: 40.0C <5> +dev.cpu.0.coretemp.throttle_log: 0 +dev.cpu.0.coretemp.tjmax: 105.0C +dev.cpu.0.coretemp.resolution: 1 +dev.cpu.0.coretemp.delta: 65 +dev.cpu.0.%parent: acpi0 +dev.cpu.0.%pnpinfo: _HID=none _UID=0 _CID=none +dev.cpu.0.%location: handle=\_PR_.CPU0 +dev.cpu.0.%driver: cpu +dev.cpu.0.%desc: ACPI CPU +.... + +<1> Lowest Cx state to use for idling the CPU. +<2> CPU supported Cx states. +<3> Currently available levels for the CPU (frequency/power usage). +<4> Current active CPU frequency in MHz. +<5> Current temperature of the CPU. [NOTE] ==== -`maxusers` does _not_ limit the number of users which can log into the machine. -It instead sets various table sizes to reasonable values considering the maximum number of users on the system and how many processes each user will be running. -==== - -==== `kern.ipc.soacceptqueue` - -The `kern.ipc.soacceptqueue` man:sysctl[8] variable limits the size of the listen queue for accepting new `TCP` connections. -The default value of `128` is typically too low for robust handling of new connections on a heavily loaded web server. -For such environments, it is recommended to increase this value to `1024` or higher. -A service such as man:sendmail[8], or Apache may itself limit the listen queue size, but will often have a directive in its configuration file to adjust the queue size. -Large listen queues do a better job of avoiding Denial of Service (DoS) attacks. - -[[nmbclusters]] -=== Network Limits - -The `NMBCLUSTERS` kernel configuration option dictates the amount of network Mbufs available to the system. -A heavily-trafficked server with a low number of Mbufs will hinder performance. -Each cluster represents approximately 2 K of memory, so a value of `1024` represents `2` megabytes of kernel memory reserved for network buffers. -A simple calculation can be done to figure out how many are needed. -A web server which maxes out at `1000` simultaneous connections where each connection uses a 6 K receive and 16 K send buffer, requires approximately 32 MB worth of network buffers to cover the web server. -A good rule of thumb is to multiply by `2`, so 2x32 MB / 2 KB = 64 MB / 2 kB = `32768`. -Values between `4096` and `32768` are recommended for machines with greater amounts of memory. -Never specify an arbitrarily high value for this parameter as it could lead to a boot time crash. -To observe network cluster usage, use `-m` with man:netstat[1]. - -The `kern.ipc.nmbclusters` loader tunable should be used to tune this at boot time. -Only older versions of FreeBSD will require the use of the `NMBCLUSTERS` kernel man:config[8] option. - -For busy servers that make extensive use of the man:sendfile[2] system call, it may be necessary to increase the number of man:sendfile[2] buffers via the `NSFBUFS` kernel configuration option or by setting its value in [.filename]#/boot/loader.conf# (see man:loader[8] for details). -A common indicator that this parameter needs to be adjusted is when processes are seen in the `sfbufa` state. -The man:sysctl[8] variable `kern.ipc.nsfbufs` is read-only. -This parameter nominally scales with `kern.maxusers`, however it may be necessary to tune accordingly. - -[IMPORTANT] -==== -Even though a socket has been marked as non-blocking, calling man:sendfile[2] on the non-blocking socket may result in the man:sendfile[2] call blocking until enough ``struct sf_buf``'s are made available. +If the temperature information is not displayed, load the man:coretemp[4] module. +In case of using an AMD CPU, load the man:amdtemp[4] module. ==== -==== `net.inet.ip.portrange.*` - -The `net.inet.ip.portrange.*` man:sysctl[8] variables control the port number ranges automatically bound to `TCP` and `UDP` sockets. -There are three ranges: a low range, a default range, and a high range. -Most network programs use the default range which is controlled by `net.inet.ip.portrange.first` and `net.inet.ip.portrange.last`, which default to `1024` and `5000`, respectively. -Bound port ranges are used for outgoing connections and it is possible to run the system out of ports under certain circumstances. -This most commonly occurs when running a heavily loaded web proxy. -The port range is not an issue when running a server which handles mainly incoming connections, such as a web server, or has a limited number of outgoing connections, such as a mail relay. -For situations where there is a shortage of ports, it is recommended to increase `net.inet.ip.portrange.last` modestly. -A value of `10000`, `20000` or `30000` may be reasonable. Consider firewall effects when changing the port range. -Some firewalls may block large ranges of ports, usually low-numbered ports, and expect systems to use higher ranges of ports for outgoing connections. -For this reason, it is not recommended that the value of `net.inet.ip.portrange.first` be lowered. - -=== Virtual Memory - -==== `kern.maxvnodes` +Once the CPU information is available the easiest way to configure power saving is to let man:powerd[8] take over. -A vnode is the internal representation of a file or directory. -Increasing the number of vnodes available to the operating system reduces disk I/O. -Normally, this is handled by the operating system and does not need to be changed. -In some cases where disk I/O is a bottleneck and the system is running out of vnodes, this setting needs to be increased. -The amount of inactive and free RAM will need to be taken into account. - -To see the current number of vnodes in use: +Enable man:powerd[8] service in [.filename]#/etc/rc.conf# to start at system boot: [source,shell] .... -# sysctl vfs.numvnodes -vfs.numvnodes: 91349 +# sysrc powerd_enable=YES .... -To see the maximum vnodes: +It will also be necessary to indicate certain parameters to man:powerd[8] to tell it how to manage the state of the CPU executing the following command: [source,shell] .... -# sysctl kern.maxvnodes -kern.maxvnodes: 100000 +# sysrc powerd_flags="-a hiadaptive -i 25 -r 85 -N" .... -If the current vnode usage is near the maximum, try increasing `kern.maxvnodes` by a value of `1000`. -Keep an eye on the number of `vfs.numvnodes`. -If it climbs up to the maximum again, `kern.maxvnodes` will need to be increased further. -Otherwise, a shift in memory usage as reported by man:top[1] should be visible and more memory should be active. - -[[adding-swap-space]] -== Adding Swap Space - -Sometimes a system requires more swap space. -This section describes two methods to increase swap space: adding swap to an existing partition or new hard drive, and creating a swap file on an existing partition. - -For information on how to encrypt swap space, which options exist, and why it should be done, refer to crossref:disks[swap-encrypting,“Encrypting Swap”]. - -[[new-drive-swap]] -=== Swap on a New Hard Drive or Existing Partition +. `-a`: Selects the mode to use while on AC power. +. `hiadaptive`: Operation mode. More info at man:powerd[8]. +. `-i`: Specifies the CPU load percent level when adaptive mode should begin to degrade performance to save power. +. `-r`: Specifies the CPU load percent level where adaptive mode should consider the CPU running and increase performance. +. `-N`: Treat "nice" time as idle for the purpose of load calculation; i.e., do not increase the CPU frequency if the CPU is only busy with "nice" processes. -Adding a new hard drive for swap gives better performance than using a partition on an existing drive. -Setting up partitions and hard drives is explained in crossref:disks[disks-adding,“Adding Disks”] while crossref:bsdinstall[configtuning-initial,“Designing the Partition Layout”] discusses partition layouts and swap partition size considerations. - -Use `swapon` to add a swap partition to the system. -For example: +And then enable the service executing the following command: [source,shell] .... -# swapon /dev/ada1s1b -.... - -[WARNING] -==== - -It is possible to use any partition not currently mounted, even if it already contains data. -Using `swapon` on a partition that contains data will overwrite and destroy that data. -Make sure that the partition to be added as swap is really the intended partition before running `swapon`. -==== - -To automatically add this swap partition on boot, add an entry to [.filename]#/etc/fstab#: - -[.programlisting] +# service powerd start .... -/dev/ada1s1b none swap sw 0 0 -.... - -See man:fstab[5] for an explanation of the entries in [.filename]#/etc/fstab#. -More information about `swapon` can be found in man:swapon[8]. -[[create-swapfile]] -=== Creating a Swap File -These examples create a 512M swap file called [.filename]#/usr/swap0# instead of using a partition. -Using swap files requires that the module needed by man:md[4] has either been built into the kernel or has been loaded before swap is enabled. -See crossref:kernelconfig[kernelconfig,Configuring the FreeBSD Kernel] for information about building a custom kernel. +[[graphics-card-power-management]] +=== Graphics Card Power Management -[[swapfile-10-and-later]] -.Creating a Swap File -[example] -==== -[.procedure] -. Create the swap file: -+ -[source,shell] -.... -# dd if=/dev/zero of=/usr/swap0 bs=1m count=512 -.... +Graphics cards have become a fundamental part of computing in recent years. +Some graphics cards may have excessive power consumption. +FreeBSD allows certain configurations to improve power consumption. -. Set the proper permissions on the new file: -+ -[source,shell] -.... -# chmod 0600 /usr/swap0 -.... +In case of using a Intel(R) graphics card with the package:graphics/drm-kmod[] driver these options can be added to [.filename]#/boot/loader.conf#: -. Inform the system about the swap file by adding a line to [.filename]#/etc/fstab#: -+ [.programlisting] .... -md none swap sw,file=/usr/swap0,late 0 0 -.... -+ -. Swap space will be added on system startup. To add swap space immediately, use man:swapon[8]: -+ -[source,shell] -.... -# swapon -aL +compat.linuxkpi.fastboot=1 <.> +compat.linuxkpi.enable_dc=2 <.> +compat.linuxkpi.enable_fbc=1 <.> .... -==== - -[[acpi-overview]] -== Power and Resource Management +<.> Try to skip unnecessary mode sets at boot time. +<.> Enable power-saving display C-states. +<.> Enable frame buffer compression for power savings -It is important to utilize hardware resources in an efficient manner. -Power and resource management allows the operating system to monitor system limits and to possibly provide an alert if the system temperature increases unexpectedly. -An early specification for providing power management was the Advanced Power Management (APM) facility. -APM controls the power usage of a system based on its activity. -However, it was difficult and inflexible for operating systems to manage the power usage and thermal properties of a system. -The hardware was managed by the BIOS and the user had limited configurability and visibility into the power management settings. -The APMBIOS is supplied by the vendor and is specific to the hardware platform. -An APM driver in the operating system mediates access to the APM Software Interface, which allows management of power levels. - -There are four major problems in APM. -First, power management is done by the vendor-specific BIOS, separate from the operating system. -For example, the user can set idle-time values for a hard drive in the APMBIOS so that, when exceeded, the BIOS spins down the hard drive without the consent of the operating system. -Second, the APM logic is embedded in the BIOS, and it operates outside the scope of the operating system. -This means that users can only fix problems in the APMBIOS by flashing a new one into the ROM, which is a dangerous procedure with the potential to leave the system in an unrecoverable state if it fails. -Third, APM is a vendor-specific technology, meaning that there is a lot of duplication of efforts and bugs found in one vendor's BIOS may not be solved in others. -Lastly, the APMBIOS did not have enough room to implement a sophisticated power policy or one that can adapt well to the purpose of the machine. - -The Plug and Play BIOS (PNPBIOS) was unreliable in many situations. -PNPBIOS is 16-bit technology, so the operating system has to use 16-bit emulation in order to interface with PNPBIOS methods. -FreeBSD provides an APM driver as APM should still be used for systems manufactured at or before the year 2000. -The driver is documented in man:apm[4]. - -The successor to APM is the Advanced Configuration and Power Interface (ACPI). -ACPI is a standard written by an alliance of vendors to provide an interface for hardware resources and power management. -It is a key element in _Operating System-directed configuration and Power Management_ as it provides more control and flexibility to the operating system. - -This chapter demonstrates how to configure ACPI on FreeBSD. -It then offers some tips on how to debug ACPI and how to submit a problem report containing debugging information so that developers can diagnosis and fix ACPI issues. - -[[acpi-config]] -=== Configuring ACPI +=== Suspend/Resume -In FreeBSD the man:acpi[4] driver is loaded by default at system boot and should _not_ be compiled into the kernel. -This driver cannot be unloaded after boot because the system bus uses it for various hardware interactions. -However, if the system is experiencing problems, ACPI can be disabled altogether by rebooting after setting `hint.acpi.0.disabled="1"` in [.filename]#/boot/loader.conf# or by setting this variable at the loader prompt, as described in crossref:boot[boot-loader,“Stage Three”]. +The suspend/resume function allows the machine to be kept in a state in which there is no a big energy consumption and allows the system to be resumed without having to lose the state of the running programs. [NOTE] ==== -ACPI and APM cannot coexist and should be used separately. -The last one to load will terminate if the driver notices the other is running. -==== +In order for the suspend/resume functionality to work correctly the graphics drivers must be loaded on the system. +In non-KMS-supported graphics cards man:sc[4] must be used not to break the suspend/resume functionality. -ACPI can be used to put the system into a sleep mode with `acpiconf`, the `-s` flag, and a number from `1` to `5`. -Most users only need `1` (quick suspend to RAM) or `3` (suspend to RAM). -Option `5` performs a soft-off which is the same as running `halt -p`. - -The man:acpi_video[4] driver uses link:https://uefi.org/specs/ACPI/6.4/Apx_B_Video_Extensions/Apx_B_Video_Extensions.html[ACPI Video Extensions] to control display switching and backlight brightness. -It must be loaded after any of the DRM kernel modules. -After loading the driver, the kbd:[Fn] brightness keys will change the brightness of the screen. -It is possible to check the ACPI events by inspecting [.filename]#/var/run/devd.pipe#: - -[source,shell] -... -# cat /var/run/devd.pipe -!system=ACPI subsystem=Video type=brightness notify=62 -!system=ACPI subsystem=Video type=brightness notify=63 -!system=ACPI subsystem=Video type=brightness notify=64 -... - -Other options are available using `sysctl`. -Refer to man:acpi[4] and man:acpiconf[8] for more information. +More information about which driver to use and how to configure it can be found at the crossref:x11[x11, The X Window System chapter]. +==== -[[ACPI-comprob]] -=== Common Problems +man:acpi[4] supports the next list of sleep states: -ACPI is present in all modern computers that conform to the ia32 (x86) and amd64 (AMD) architectures. -The full standard has many features including CPU performance management, power planes control, thermal zones, various battery systems, embedded controllers, and bus enumeration. -Most systems implement less than the full standard. -For instance, a desktop system usually only implements bus enumeration while a laptop might have cooling and battery management support as well. -Laptops also have suspend and resume, with their own associated complexity. +.Supported Sleep States +[options="header", cols="1,1"] +|=== -An ACPI-compliant system has various components. -The BIOS and chipset vendors provide various fixed tables, such as FADT, in memory that specify things like the APIC map (used for SMP), config registers, and simple configuration values. -Additionally, a bytecode table, the Differentiated System Description Table DSDT, specifies a tree-like name space of devices and methods. +|S1 +|Quick suspend to RAM. The CPU enters a lower power state, but most peripherals are left running. -The ACPI driver must parse the fixed tables, implement an interpreter for the bytecode, and modify device drivers and the kernel to accept information from the ACPI subsystem. -For FreeBSD, Intel(R) has provided an interpreter (ACPI-CA) that is shared with Linux(R) and NetBSD. -The path to the ACPI-CA source code is [.filename]#src/sys/contrib/dev/acpica#. -The glue code that allows ACPI-CA to work on FreeBSD is in [.filename]#src/sys/dev/acpica/Osd#. -Finally, drivers that implement various ACPI devices are found in [.filename]#src/sys/dev/acpica#. +|S2 +|Lower power state than S1, but with the same basic characteristics. Not supported by many systems. -For ACPI to work correctly, all the parts have to work correctly. -Here are some common problems, in order of frequency of appearance, and some possible workarounds or fixes. -If a fix does not resolve the issue, refer to <> for instructions on how to submit a bug report. +|S3 (Sleep mode) +|Suspend to RAM. Most devices are powered off, and the system stops running except for memory refresh. -==== Mouse Issues +|S4 (Hibernation) +|Suspend to disk. All devices are powered off, and the system stops running. When resuming, the system starts as if from a cold power on. *Not yet supported by FreeBSD*. -In some cases, resuming from a suspend operation will cause the mouse to fail. -A known work around is to add `hint.psm.0.flags="0x3000"` to [.filename]#/boot/loader.conf#. +|S5 +|System shuts down cleanly and powers off. -==== Suspend/Resume +|=== -ACPI has three suspend to RAM (STR) states, `S1`-`S3`, and one suspend to disk state (STD), called `S4`. -STD can be implemented in two separate ways. -The ``S4``BIOS is a BIOS-assisted suspend to disk and ``S4``OS is implemented entirely by the operating system. -The normal state the system is in when plugged in but not powered up is "soft off" (`S5`). +[[configure-suspend-resume]] +==== Configuring Suspend/Resume -Use `sysctl hw.acpi` to check for the suspend-related items. -These example results are from a Thinkpad: +The first step will be to know which type of sleep states supports the hardware we are using executing the following command: [source,shell] .... -hw.acpi.supported_sleep_state: S3 S4 S5 -hw.acpi.s4bios: 0 +% sysctl hw.acpi.supported_sleep_state .... -Use `acpiconf -s` to test `S3`, `S4`, and `S5`. -An `s4bios` of one (`1`) indicates ``S4``BIOS support instead of `S4` operating system support. - -When testing suspend/resume, start with `S1`, if supported. -This state is most likely to work since it does not require much driver support. -No one has implemented `S2`, which is similar to `S1`. -Next, try `S3`. -This is the deepest STR state and requires a lot of driver support to properly reinitialize the hardware. - -A common problem with suspend/resume is that many device drivers do not save, restore, or reinitialize their firmware, registers, or device memory properly. -As a first attempt at debugging the problem, try: +The output should be similar to the following: -[source,shell] +[.programlisting] .... -# sysctl debug.bootverbose=1 -# sysctl debug.acpi.suspend_bounce=1 -# acpiconf -s 3 +hw.acpi.supported_sleep_state: S3 S4 S5 .... -This test emulates the suspend/resume cycle of all device drivers without actually going into `S3` state. -In some cases, problems such as losing firmware state, device watchdog time out, and retrying forever, can be captured with this method. -Note that the system will not really enter `S3` state, which means devices may not lose power, and many will work fine even if suspend/resume methods are totally missing, unlike real `S3` state. +[WARNING] +==== +As stated above FreeBSD does *not* yet support the `S4` state. +==== -If the previous test worked, on a laptop it is possible to configure the system to suspend into `S3` on lid close and resume when it is open back again: +man:acpiconf[8] can be used to check if the `S3` state works correctly by running the following command, if it succeeds, the screen should go black and the machine will turn off: [source,shell] .... -# sysctl hw.acpi.lid_switch_state=S3 +# acpiconf -s 3 .... -This change can be made persistent across reboots: +In the vast majority of cases the Suspend/Resume functionality wants to be used on a laptop. -[source,shell] +FreeBSD can be configured to enter the `S3` state when closing the lid by adding the following line to the [.filename]#/etc/sysctl.conf# file. + +[.programlisting] .... -# echo 'hw.acpi.lid_switch_state=S3' >> /etc/sysctl.conf +hw.acpi.lid_switch_state=S3 .... -Harder cases require additional hardware, such as a serial port and cable for debugging through a serial console, a Firewire port and cable for using man:dcons[4], and kernel debugging skills. - -To help isolate the problem, unload as many drivers as possible. -If it works, narrow down which driver is the problem by loading drivers until it fails again. -Typically, binary drivers like [.filename]#nvidia.ko#, display drivers, and USB will have the most problems while Ethernet interfaces usually work fine. -If drivers can be properly loaded and unloaded, automate this by putting the appropriate commands in [.filename]#/etc/rc.suspend# and [.filename]#/etc/rc.resume#. -Try setting `hw.acpi.reset_video` to `1` if the display is messed up after resume. -Try setting longer or shorter values for `hw.acpi.sleep_delay` to see if that helps. +[[troubleshooting-suspend-resume]] +==== Troubleshooting in Suspend/Resume -Try loading a recent Linux(R) distribution to see if suspend/resume works on the same hardware. -If it works on Linux(R), it is likely a FreeBSD driver problem. -Narrowing down which driver causes the problem will assist developers in fixing the problem. -Since the ACPI maintainers rarely maintain other drivers, such as sound or ATA, any driver problems should also be posted to the {freebsd-current} and mailed to the driver maintainer. -Advanced users can include debugging man:printf[3]s in a problematic driver to track down where in its resume function it hangs. +A lot of effort has been made to make the Suspend and Resume functions work properly and in the best way on FreeBSD. +But currently the Suspend and Resume functions only work properly on some specific laptops. -Finally, try disabling ACPI and enabling APM instead. -If suspend/resume works with APM, stick with APM, especially on older hardware (pre-2000). -It took vendors a while to get ACPI support correct and older hardware is more likely to have BIOS problems with ACPI. +Some checks can be done in case it doesn't work properly. -==== System Hangs +In some cases it is enough to turn off the bluetooth. +In others it is enough loading the correct driver for the graphics card, etc. -Most system hangs are a result of lost interrupts or an interrupt storm. -Chipsets may have problems based on boot, how the BIOS configures interrupts before correctness of the APIC (MADT) table, and routing of the System Control Interrupt (SCI). +In case it doesn't work correctly, some tips can be found on the FreeBSD Wiki in the section link:https://wiki.freebsd.org/SuspendResume[Suspend/Resume]. -Interrupt storms can be distinguished from lost interrupts by checking the output of `vmstat -i` and looking at the line that has `acpi0`. -If the counter is increasing at more than a couple per second, there is an interrupt storm. -If the system appears hung, try breaking to DDB (kbd:[CTRL+ALT+ESC] on console) and type `show interrupts`. - -When dealing with interrupt problems, try disabling APIC support with `hint.apic.0.disabled="1"` in [.filename]#/boot/loader.conf#. - -==== Panics +[[adding-swap-space]] +== Adding Swap Space -Panics are relatively rare for ACPI and are the top priority to be fixed. -The first step is to isolate the steps to reproduce the panic, if possible, and get a backtrace. -Follow the advice for enabling `options DDB` and setting up a serial console in crossref:serialcomms[serialconsole-ddb,“Entering the DDB Debugger from the Serial Line”] or setting up a dump partition. -To get a backtrace in DDB, use `tr`. -When handwriting the backtrace, get at least the last five and the top five lines in the trace. +Sometimes a FreeBSD system requires more swap space. +This section describes two methods to increase swap space: adding swap to an existing partition or new hard drive, and creating a swap file on an existing file system. -Then, try to isolate the problem by booting with ACPI disabled. -If that works, isolate the ACPI subsystem by using various values of `debug.acpi.disable`. -See man:acpi[4] for some examples. +For information on how to encrypt swap space, which options exist, and why it should be done, refer to crossref:disks[swap-encrypting,“Encrypting Swap”]. -==== System Powers Up After Suspend or Shutdown +[[new-drive-swap]] +=== Swap on a New Hard Drive or Existing Partition -First, try setting `hw.acpi.disable_on_poweroff="0"` in [.filename]#/boot/loader.conf#. -This keeps ACPI from disabling various events during the shutdown process. -Some systems need this value set to `1` (the default) for the same reason. -This usually fixes the problem of a system powering up spontaneously after a suspend or poweroff. +Adding a new drive for swap gives better performance than using a partition on an existing drive. +Setting up partitions and drives is explained in crossref:disks[disks-adding,"Adding Disks"] while crossref:bsdinstall[configtuning-initial,"Designing the Partition Layout"] discusses partition layouts and swap partition size considerations. -[[ACPI-aslanddump]] -==== BIOS Contains Buggy Bytecode +[WARNING] +==== +It is possible to use any partition not currently mounted, even if it already contains data. +Using `swapon` on a partition that contains data will overwrite and destroy that data. +Make sure that the partition to be added as swap is really the intended partition before running `swapon`. +==== -Some BIOS vendors provide incorrect or buggy bytecode. -This is usually manifested by kernel console messages like this: +man:swapon[8] can be used to add a swap partition to the system executing the following command: [source,shell] .... -ACPI-1287: *** Error: Method execution failed [\\_SB_.PCI0.LPC0.FIGD._STA] \\ -(Node 0xc3f6d160), AE_NOT_FOUND +# swapon /dev/ada1p2 .... -Often, these problems may be resolved by updating the BIOS to the latest revision. -Most console messages are harmless, but if there are other problems, like the battery status is not working, these messages are a good place to start looking for problems. - -=== Overriding the Default AML - -The BIOS bytecode, known as ACPI Machine Language (AML), is compiled from a source language called ACPI Source Language (ASL). -The AML is found in the table known as the Differentiated System Description Table (DSDT). - -The goal of FreeBSD is for everyone to have working ACPI without any user intervention. -Workarounds are still being developed for common mistakes made by BIOS vendors. -The Microsoft(R) interpreter ([.filename]#acpi.sys# and [.filename]#acpiec.sys#) does not strictly check for adherence to the standard, and thus many BIOS vendors who only test ACPI under Windows(R) never fix their ASL. -FreeBSD developers continue to identify and document which non-standard behavior is allowed by Microsoft(R)'s interpreter and replicate it so that FreeBSD can work without forcing users to fix the ASL. - -To help identify buggy behavior and possibly fix it manually, a copy can be made of the system's ASL. -To copy the system's ASL to a specified file name, use `acpidump` with `-t`, to show the contents of the fixed tables, and `-d`, to disassemble the AML: +To automatically add this swap partition on boot, add an entry to [.filename]#/etc/fstab#: -[source,shell] +[.programlisting] .... -# acpidump -td > my.asl +/dev/ada1p2 none swap sw 0 0 .... -Some AML versions assume the user is running Windows(R). -To override this, set `hw.acpi.osname=_"Windows 2009"_` in [.filename]#/boot/loader.conf#, using the most recent Windows(R) version listed in the ASL. +See man:fstab[5] for an explanation of the entries in [.filename]#/etc/fstab#. -Other workarounds may require [.filename]#my.asl# to be customized. -If this file is edited, compile the new ASL using the following command. -Warnings can usually be ignored, but errors are bugs that will usually prevent ACPI from working correctly. +[[create-swapfile]] +=== Creating a Swap File -[source,shell] -.... -# iasl -f my.asl -.... +[[swapfile-10-and-later]] +These examples create a 512M swap file called [.filename]#/usr/swap0#. -Including `-f` forces creation of the AML, even if there are errors during compilation. -Some errors, such as missing return statements, are automatically worked around by the FreeBSD interpreter. +[WARNING] +==== +Swap files on ZFS file systems are strongly discouraged, as swapping can lead to system hangs. +==== -The default output filename for `iasl` is [.filename]#DSDT.aml#. -Load this file instead of the BIOS's buggy copy, which is still present in flash memory, by editing [.filename]#/boot/loader.conf# as follows: +The first step is to create the swap file: -[.programlisting] +[source,shell] .... -acpi_dsdt_load="YES" -acpi_dsdt_name="/boot/DSDT.aml" +# dd if=/dev/zero of=/usr/swap0 bs=1m count=512 .... -Be sure to copy [.filename]#DSDT.aml# to [.filename]#/boot#, then reboot the system. -If this fixes the problem, send a man:diff[1] of the old and new ASL to the {freebsd-acpi} so that developers can work around the buggy behavior in [.filename]#acpica#. - -[[ACPI-submitdebug]] -=== Getting and Submitting Debugging Info - -The ACPI driver has a flexible debugging facility. A set of subsystems and the level of verbosity can be specified. -The subsystems to debug are specified as layers and are broken down into components (`ACPI_ALL_COMPONENTS`) and ACPI hardware support (`ACPI_ALL_DRIVERS`). -The verbosity of debugging output is specified as the level and ranges from just report errors (`ACPI_LV_ERROR`) to everything (`ACPI_LV_VERBOSE`). -The level is a bitmask so multiple options can be set at once, separated by spaces. -In practice, a serial console should be used to log the output so it is not lost as the console message buffer flushes. -A full list of the individual layers and levels is found in man:acpi[4]. - -Debugging output is not enabled by default. To enable it, add `options ACPI_DEBUG` to the custom kernel configuration file if ACPI is compiled into the kernel. -Add `ACPI_DEBUG=1` to [.filename]#/etc/make.conf# to enable it globally. -If a module is used instead of a custom kernel, recompile just the [.filename]#acpi.ko# module as follows: +The second step is to put the proper permissions on the new file: [source,shell] .... -# cd /sys/modules/acpi/acpi && make clean && make ACPI_DEBUG=1 +# chmod 0600 /usr/swap0 .... -Copy the compiled [.filename]#acpi.ko# to [.filename]#/boot/kernel# and add the desired level and layer to [.filename]#/boot/loader.conf#. -The entries in this example enable debug messages for all ACPI components and hardware drivers and output error messages at the least verbose level: +The third step is to inform the system about the swap file by adding a line to [.filename]#/etc/fstab#: [.programlisting] .... -debug.acpi.layer="ACPI_ALL_COMPONENTS ACPI_ALL_DRIVERS" -debug.acpi.level="ACPI_LV_ERROR" +md none swap sw,file=/usr/swap0,late 0 0 .... -If the required information is triggered by a specific event, such as a suspend and then resume, do not modify [.filename]#/boot/loader.conf#. -Instead, use `sysctl` to specify the layer and level after booting and preparing the system for the specific event. -The variables which can be set using `sysctl` are named the same as the tunables in [.filename]#/boot/loader.conf#. - -Once the debugging information is gathered, it can be sent to the {freebsd-acpi} so that it can be used by the FreeBSD ACPI maintainers to identify the root cause of the problem and to develop a solution. - -[NOTE] -==== -Before submitting debugging information to this mailing list, ensure the latest BIOS version is installed and, if available, the embedded controller firmware version. -==== - -When submitting a problem report, include the following information: +Swap space will be added on system startup. To add swap space immediately, use man:swapon[8]: -* Description of the buggy behavior, including system type, model, and anything that causes the bug to appear. Note as accurately as possible when the bug began occurring if it is new. -* The output of `dmesg` after running `boot -v`, including any error messages generated by the bug. -* The `dmesg` output from `boot -v` with ACPI disabled, if disabling ACPI helps to fix the problem. -* Output from `sysctl hw.acpi`. This lists which features the system offers. -* The URL to a pasted version of the system's ASL. Do _not_ send the ASL directly to the list as it can be very large. Generate a copy of the ASL by running this command: -+ [source,shell] .... -# acpidump -dt > name-system.asl +# swapon -aL .... -+ -Substitute the login name for _name_ and manufacturer/model for _system_. -For example, use [.filename]#njl-FooCo6000.asl#. - -Most FreeBSD developers watch the {freebsd-current}, but one should submit problems to the {freebsd-acpi} to be sure it is seen. -Be patient when waiting for a response. -If the bug is not immediately apparent, submit a bug report. -When entering a PR, include the same information as requested above. -This helps developers to track the problem and resolve it. -Do not send a PR without emailing the {freebsd-acpi} first as it is likely that the problem has been reported before. - -[[ACPI-References]] -=== References - -More information about ACPI may be found in the following locations: - -* Archives at https://lists.freebsd.org/pipermail/freebsd-acpi/[] and more recent https://lists.freebsd.org/archives/freebsd-acpi/[] -* The https://uefi.org/specifications#ACPI[ACPI Specification] -* man:acpi[4], man:acpi_thermal[4], man:acpidump[8], man:iasl[8], and man:acpidb[8]