diff options
Diffstat (limited to 'documentation/content/en/books/handbook/config/_index.adoc')
| -rw-r--r-- | documentation/content/en/books/handbook/config/_index.adoc | 2073 |
1 files changed, 839 insertions, 1234 deletions
diff --git a/documentation/content/en/books/handbook/config/_index.adoc b/documentation/content/en/books/handbook/config/_index.adoc index 57e8faf96f..2e77ef70bf 100644 --- a/documentation/content/en/books/handbook/config/_index.adoc +++ b/documentation/content/en/books/handbook/config/_index.adoc @@ -1,24 +1,24 @@ --- -title: Chapter 12. Configuration and Tuning +title: Chapter 14. Configuration, Services, Logging and Power Management part: Part III. System Administration prev: books/handbook/partiii next: books/handbook/boot -description: This chapter explains much of the FreeBSD configuration process, including some of the parameters which can be set to tune a FreeBSD system. -tags: ["configuration", "tuning", "services", "cron", "virtual hosts", "logging", "configuration files", "sysctl", "tuning disks", "kernel limits", "swap", "power management"] +description: This chapter explains much of the FreeBSD configuration files, how to enable or disable a service, how to configure the logging system and the power management area. +tags: ["configuration", "services", "cron", "periodic", "logging", "configuration files", "sysctl", "swap", "power management"] showBookMenu: true -weight: 16 -path: "/books/handbook/" +weight: 18 +path: "/books/handbook/config/" --- [[config-tuning]] -= Configuration and Tuning += Configuration, Services, Logging and Power Management :doctype: book :toc: macro :toclevels: 1 :icons: font :sectnums: :sectnumlevels: 6 -:sectnumoffset: 12 +:sectnumoffset: 14 :partnums: :source-highlighter: rouge :experimental: @@ -54,301 +54,285 @@ endif::[] One of the important aspects of FreeBSD is proper system configuration. This chapter explains much of the FreeBSD configuration process, including some of the parameters which can be set to tune a FreeBSD system. +Before reading this chapter, you should: + +* Understand UNIX(R) and FreeBSD basics (crossref:basics[basics,FreeBSD Basics]). + After reading this chapter, you will know: -* The basics of [.filename]#rc.conf# configuration and [.filename]#/usr/local/etc/rc.d# startup scripts. -* How to configure and test a network card. -* How to configure virtual hosts on network devices. * How to use the various configuration files in [.filename]#/etc#. +* The basics of [.filename]#rc.conf# configuration and [.filename]#/usr/local/etc/rc.d# startup scripts. * How to tune FreeBSD using man:sysctl[8] variables. -* How to tune disk performance and modify kernel limitations. +* How to configure the power management in FreeBSD. -Before reading this chapter, you should: +[[configtuning-configfiles]] +== Configuration Files -* Understand UNIX(R) and FreeBSD basics (crossref:basics[basics,FreeBSD Basics]). -* Be familiar with the basics of kernel configuration and compilation (crossref:kernelconfig[kernelconfig,Configuring the FreeBSD Kernel]). +FreeBSD maintains a clear separation between the base system and third party applications and therefore this affects where the configuration files of these applications are located. -[[configtuning-starting-services]] -== Starting Services +FreeBSD base system configuration is located at the [.filename]#/etc# directory, +and the [.filename]#/usr/local/etc# directory contains all the configuration files of the applications installed on the system through the ports collection and packages. -Many users install third party software on FreeBSD from the Ports Collection and require the installed services to be started upon system initialization. -Services, such as package:mail/postfix[] or package:www/apache22[] are just two of the many software packages which may be started during system initialization. -This section explains the procedures available for starting third party software. +The kernel state configuration is located in [.filename]#/etc/sysctl.conf#. +In the section <<configtuning-sysctl>>, the operation of man:sysctl[8] will be explained in more detail. -In FreeBSD, most included services, such as man:cron[8], are started through the system startup scripts. +For more information about the FreeBSD file system structure refer to man:hier[7]. -=== Extended Application Configuration +As a general rule, configuration files do not use a standard on what syntax they must follow. +Although it is true that the `#` character is normally used to comment a line and that each line has a configuration variable. -Now that FreeBSD includes [.filename]#rc.d#, configuration of application startup is easier and provides more features. -Using the key words discussed in <<configtuning-rcd>>, applications can be set to start after certain other services and extra flags can be passed through [.filename]#/etc/rc.conf# in place of hard coded flags in the startup script. -A basic script may look similar to the following: +[NOTE] +==== +Some applications like man:pkg[8] are starting to use the link:https://github.com/vstakhov/libucl[Universal Configuration Language (UCL)]. +==== -[.programlisting] -.... -#!/bin/sh -# -# PROVIDE: utility -# REQUIRE: DAEMON -# KEYWORD: shutdown +=== The [.filename]#/etc# directory -. /etc/rc.subr +The [.filename]#/etc# directory contains all of the FreeBSD base system configuration files that are responsible for configuring FreeBSD. -name=utility -rcvar=utility_enable +[CAUTION] +==== +*Extreme* caution must be taken when modifying files in the [.filename]#/etc# directory; misconfiguration could make FreeBSD unbootable or malfunction. +==== -command="/usr/local/sbin/utility" +[.informaltable] +[cols="1,1", frame="none"] +|=== -load_rc_config $name +|[.filename]#/etc# +|System configuration files and scripts. -# -# DO NOT CHANGE THESE DEFAULT VALUES HERE -# SET THEM IN THE /etc/rc.conf FILE -# -utility_enable=${utility_enable-"NO"} -pidfile=${utility_pidfile-"/var/run/utility.pid"} +|[.filename]#/etc/defaults# +|Default system configuration files, see man:rc[8] for more information. -run_rc_command "$1" -.... +|[.filename]#/etc/fstab# +|man:fstab[5] contains descriptive information about the various file systems. -This script will ensure that the provided `utility` will be started after the `DAEMON` pseudo-service. -It also provides a method for setting and tracking the process ID (PID). +|[.filename]#/etc/mail# +|Extra man:sendmail[8] configuration and other MTA configuration files. -This application could then have the following line placed in [.filename]#/etc/rc.conf#: +|[.filename]#/etc/mtree# +|mtree configuration files, see man: mtree[8] for more information. -[.programlisting] -.... -utility_enable="YES" -.... +|[.filename]#/etc/pam.d# +|Configuration files for the Pluggable Authentication Modules (PAM) library. -This method allows for easier manipulation of command line arguments, inclusion of the default functions provided in [.filename]#/etc/rc.subr#, compatibility with man:rcorder[8], and provides for easier configuration via [.filename]#rc.conf#. +|[.filename]#/etc/periodic# +|Scripts that are run daily, weekly, and monthly, via man:cron[8], see man:periodic[8] for more information. -=== Using Services to Start Services +|[.filename]#/etc/rc.d# +|System and daemon startup/control scripts, see man:rc[8] for more information. -Other services can be started using man:inetd[8]. -Working with man:inetd[8] and its configuration is described in depth in crossref:network-servers[network-inetd,“The inetd Super-Server”]. +|[.filename]#/etc/rc.conf# +|Contains descriptive information about the local host name, configuration details for any potential network interfaces and which services should be started up at system initial boot time. More information in <<configtuning-core-configuration>> -In some cases, it may make more sense to use man:cron[8] to start system services. -This approach has a number of advantages as man:cron[8] runs these processes as the owner of the man:crontab[5]. -This allows regular users to start and maintain their own applications. +|[.filename]#/etc/security# +|OpenBSM audit configuration files, see man:audit[8] for more information. -The `@reboot` feature of man:cron[8], may be used in place of the time specification. -This causes the job to run when man:cron[8] is started, normally during system initialization. +|[.filename]#/etc/ppp# +|ppp configuration files, see man:ppp[8] for more information. -[[configtuning-cron]] -== Configuring man:cron[8] +|[.filename]#/etc/ssh# +|OpenSSH configuration files, see man:ssh[1] for more information. -One of the most useful utilities in FreeBSD is cron. -This utility runs in the background and regularly checks [.filename]#/etc/crontab# for tasks to execute and searches [.filename]#/var/cron/tabs# for custom crontab files. -These files are used to schedule tasks which cron runs at the specified times. -Each entry in a crontab defines a task to run and is known as a _cron job_. +|[.filename]#/etc/ssl# +|OpenSSL configuration files. -Two different types of configuration files are used: the system crontab, which should not be modified, and user crontabs, which can be created and edited as needed. -The format used by these files is documented in man:crontab[5]. -The format of the system crontab, [.filename]#/etc/crontab# includes a `who` column which does not exist in user crontabs. -In the system crontab, cron runs the command as the user specified in this column. -In a user crontab, all commands run as the user who created the crontab. +|[.filename]#/etc/sysctl.conf# +|Contains settings for the kernel. More information in <<configtuning-sysctl>> -User crontabs allow individual users to schedule their own tasks. -The `root` user can also have a user [.filename]#crontab# which can be used to schedule tasks that do not exist in the system [.filename]#crontab#. +|=== -Here is a sample entry from the system crontab, [.filename]#/etc/crontab#: +[[configtuning-sysctl]] +=== The sysctl utility -[.programlisting] -.... -# /etc/crontab - root's crontab for FreeBSD -# -# $FreeBSD$ -# <.> -SHELL=/bin/sh -PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin <.> -# -#minute hour mday month wday who command <.> -# -*/5 * * * * root /usr/libexec/atrun <.> -.... +The man:sysctl[8] utility is used to make changes to a running FreeBSD system. -<.> Lines that begin with the `#` character are comments. A comment can be placed in the file as a reminder of what and why a desired action is performed. Comments cannot be on the same line as a command or else they will be interpreted as part of the command; they must be on a new line. Blank lines are ignored. +The man:sysctl[8] utility retrieves kernel state and allows processes with appropriate privilege to set kernel state. +The state to be retrieved or set is described using a "Management Information Base" ("MIB") style name, described as a dotted set of components. -<.> The equals (`=`) character is used to define any environment settings. In this example, it is used to define the `SHELL` and `PATH`. If the `SHELL` is omitted, cron will use the default Bourne shell. If the `PATH` is omitted, the full path must be given to the command or script to run. +.Management Information Base +[.informaltable] +[cols="1,1", frame="none"] +|=== -<.> This line defines the seven fields used in a system crontab: `minute`, `hour`, `mday`, `month`, `wday`, `who`, and `command`. The `minute` field is the time in minutes when the specified command will be run, the `hour` is the hour when the specified command will be run, the `mday` is the day of the month, `month` is the month, and `wday` is the day of the week. These fields must be numeric values, representing the twenty-four hour clock, or a `*`, representing all values for that field. The `who` field only exists in the system crontab and specifies which user the command should be run as. The last field is the command to be executed. +|sysctl +|"Magic" numbers -<.> This entry defines the values for this cron job. The `\*/5`, followed by several more `*` characters, specifies that `/usr/libexec/atrun` is invoked by `root` every five minutes of every hour, of every day and day of the week, of every month.Commands can include any number of switches. However, commands which extend to multiple lines need to be broken with the backslash "\" continuation character. +|kern +|Kernel functions and features -[[configtuning-installcrontab]] -=== Creating a User Crontab +|vm +|virtual memory -To create a user crontab, invoke `crontab` in editor mode: +|vfs +|Filesystem -[source,shell] -.... -% crontab -e -.... +|net +|Network -This will open the user's crontab using the default text editor. -The first time a user runs this command, it will open an empty file. -Once a user creates a crontab, this command will open that file for editing. +|debug +|Debugging parameters -It is useful to add these lines to the top of the crontab file in order to set the environment variables and to remember the meanings of the fields in the crontab: +|hw +|Hardware -[.programlisting] -.... -SHELL=/bin/sh -PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin -# Order of crontab fields -# minute hour mday month wday command -.... +|machdep +|Machine dependent -Then add a line for each command or script to run, specifying the time to run the command. -This example runs the specified custom Bourne shell script every day at two in the afternoon. -Since the path to the script is not specified in `PATH`, the full path to the script is given: +|user +|Userland -[.programlisting] +|p1003_1b +|POSIX 1003.1B + +|=== + +At its core, man:sysctl[8] serves two functions: to read and to modify system settings. + +To view all readable variables: + +[source,shell] .... -0 14 * * * /usr/home/dru/bin/mycustomscript.sh +% sysctl -a .... -[TIP] -==== - -Before using a custom script, make sure it is executable and test it with the limited set of environment variables set by cron. -To replicate the environment that would be used to run the above cron entry, use: +The output should be similar to the following: [.programlisting] .... -env -i SHELL=/bin/sh PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin HOME=/home/dru LOGNAME=dru /usr/home/dru/bin/mycustomscript.sh +kern.ostype: FreeBSD +... +vm.swap_enabled: 1 +vm.overcommit: 0 +vm.domain.0.pidctrl.kdd: 8 +vm.domain.0.pidctrl.kid: 4 +vm.domain.0.pidctrl.kpd: 3 +... +vfs.zfs.sync_pass_rewrite: 2 +vfs.zfs.sync_pass_dont_compress: 8 +vfs.zfs.sync_pass_deferred_free: 2 .... -The environment set by cron is discussed in man:crontab[5]. -Checking that scripts operate correctly in a cron environment is especially important if they include any commands that delete files using wildcards. -==== - -When finished editing the crontab, save the file. -It will automatically be installed and cron will read the crontab and run its cron jobs at their specified times. -To list the cron jobs in a crontab, use this command: +To read a particular variable, specify its name: [source,shell] .... -% crontab -l -0 14 * * * /usr/home/dru/bin/mycustomscript.sh +% sysctl kern.maxproc .... -To remove all of the cron jobs in a user crontab: +The output should be similar to the following: -[source,shell] +[.programlisting] .... -% crontab -r -remove crontab for dru? y +kern.maxproc: 1044 .... -[[configtuning-rcd]] -== Managing Services in FreeBSD - -FreeBSD uses the man:rc[8] system of startup scripts during system initialization and for managing services. -The scripts listed in [.filename]#/etc/rc.d# provide basic services which can be controlled with the `start`, `stop`, and `restart` options to man:service[8]. -For instance, man:sshd[8] can be restarted with the following command: +The Management Information Base (MIB) is hierarchical and hence, specifying a prefix prints all the nodes hanging from it: [source,shell] .... -# service sshd restart +% sysctl net .... -This procedure can be used to start services on a running system. -Services will be started automatically at boot time as specified in man:rc.conf[5]. -For example, to enable man:natd[8] at system startup, add the following line to [.filename]#/etc/rc.conf#: +The output should be similar to the following: [.programlisting] .... -natd_enable="YES" +net.local.stream.recvspace: 8192 +net.local.stream.sendspace: 8192 +net.local.dgram.recvspace: 16384 +net.local.dgram.maxdgram: 2048 +net.local.seqpacket.recvspace: 8192 +net.local.seqpacket.maxseqpacket: 8192 +net.local.sockcount: 60 +net.local.taskcount: 25 +net.local.recycled: 0 +net.local.deferred: 0 +net.local.inflight: 0 +net.inet.ip.portrange.randomtime: 1 +net.inet.ip.portrange.randomcps: 9999 +[...] .... -If a `natd_enable="NO"` line is already present, change the `NO` to `YES`. -The man:rc[8] scripts will automatically load any dependent services during the next boot, as described below. - -Since the man:rc[8] system is primarily intended to start and stop services at system startup and shutdown time, the `start`, `stop` and `restart` options will only perform their action if the appropriate [.filename]#/etc/rc.conf# variable is set. -For instance, `sshd restart` will only work if `sshd_enable` is set to `YES` in [.filename]#/etc/rc.conf#. -To `start`, `stop` or `restart` a service regardless of the settings in [.filename]#/etc/rc.conf#, these commands should be prefixed with "one". -For instance, to restart man:sshd[8] regardless of the current [.filename]#/etc/rc.conf# setting, execute the following command: +To set a particular variable, use the _variable_=_value_ syntax: [source,shell] .... -# service sshd onerestart +# sysctl kern.maxfiles=5000 .... -To check if a service is enabled in [.filename]#/etc/rc.conf#, run the appropriate man:rc[8] script with `rcvar`. -This example checks to see if man:sshd[8] is enabled in [.filename]#/etc/rc.conf#: +The output should be similar to the following: -[source,shell] +[.programlisting] .... -# service sshd rcvar -# sshd -# -sshd_enable="YES" -# (default: "") +kern.maxfiles: 2088 -> 5000 .... [NOTE] ==== -The `# sshd` line is output from the above command, not a `root` console. +To keep the configuration after a reboot it is necessary to add these variables to the [.filename]#/etc/sysctl.conf# file as explained below. ==== -To determine whether or not a service is running, use `status`. -For instance, to verify that man:sshd[8] is running: - -[source,shell] -.... -# service sshd status -sshd is running as pid 433. -.... - -In some cases, it is also possible to `reload` a service. -This attempts to send a signal to an individual service, forcing the service to reload its configuration files. -In most cases, this means sending the service a `SIGHUP` signal. -Support for this feature is not included for every service. +[[configtuning-sysctlconf]] +=== The [.filename]#/etc/sysctl.conf# file -The man:rc[8] system is used for network services and it also contributes to most of the system initialization. -For instance, when the [.filename]#/etc/rc.d/bgfsck# script is executed, it prints out the following message: +The configuration file for man:sysctl[8], [.filename]#/etc/sysctl.conf#, looks much like [.filename]#/etc/rc.conf#. -[source,shell] -.... -Starting background file system checks in 60 seconds. -.... +Values are set using a `variable=value` syntax. -This script is used for background file system checks, which occur only during system initialization. +[NOTE] +==== +The specified values are set after the system goes into multi-user mode. +Not all variables are settable in this mode. +==== -Many system services depend on other services to function properly. -For example, man:yp[8] and other RPC-based services may fail to start until after the man:rpcbind[8] service has started. -To resolve this issue, information about dependencies and other meta-data is included in the comments at the top of each startup script. -The man:rcorder[8] program is used to parse these comments during system initialization to determine the order in which system services should be invoked to satisfy the dependencies. +For example, to turn off logging of fatal signal exits and prevent users from seeing processes started by other users, the following tunables can be set in [.filename]#/etc/sysctl.conf#: -The following key word must be included in all startup scripts as it is required by man:rc.subr[8] to "enable" the startup script: +[.programlisting] +.... +# Do not log fatal signal exits (e.g., sig 11) +kern.logsigexit=0 -* `PROVIDE`: Specifies the services this file provides. +# Prevent users from seeing information about processes that +# are being run under another UID. +security.bsd.see_other_uids=0 +.... -The following key words may be included at the top of each startup script. -They are not strictly necessary, but are useful as hints to man:rcorder[8]: +To obtain more information about what function a particular sysctl has, the following command can be executed: -* `REQUIRE`: Lists services which are required for this service. The script containing this key word will run _after_ the specified services. -* `BEFORE`: Lists services which depend on this service. The script containing this key word will run _before_ the specified services. +[source,shell] +.... +% sysctl -d kern.dfldsiz +.... -By carefully setting these keywords for each startup script, an administrator has a fine-grained level of control of the startup order of the scripts, without the need for "runlevels" used by some UNIX(R) operating systems. +The output should be similar to the following: -Additional information can be found in man:rc[8] and man:rc.subr[8]. -Refer to extref:{rc-scripting}[this article] for instructions on how to create custom man:rc[8] scripts. +[.programlisting] +.... +kern.dfldsiz: Initial data size limit +.... [[configtuning-core-configuration]] === Managing System-Specific Configuration The principal location for system configuration information is [.filename]#/etc/rc.conf#. + This file contains a wide range of configuration information and it is read at system startup to configure the system. It provides the configuration information for the [.filename]#rc*# files. The entries in [.filename]#/etc/rc.conf# override the default settings in [.filename]#/etc/defaults/rc.conf#. -The file containing the default settings should not be edited. + +[TIP] +==== +The file [.filename]#/etc/defaults/rc.conf# containing the default settings should not be edited. Instead, all system-specific changes should be made to [.filename]#/etc/rc.conf#. +==== A number of strategies may be applied in clustered applications to separate site-wide configuration from system-specific configuration in order to reduce administration overhead. + The recommended approach is to place system-specific configuration into [.filename]#/etc/rc.conf.local#. + For example, these entries in [.filename]#/etc/rc.conf# apply to all systems: [.programlisting] @@ -372,382 +356,337 @@ Upgrading the system will not overwrite [.filename]#/etc/rc.conf#, so system con [TIP] ==== - Both [.filename]#/etc/rc.conf# and [.filename]#/etc/rc.conf.local# are parsed by man:sh[1]. This allows system operators to create complex configuration scenarios. Refer to man:rc.conf[5] for further information on this topic. ==== -[[config-network-setup]] -== Setting Up Network Interface Cards +[[configtuning-rcd]] +== Managing Services in FreeBSD -Adding and configuring a network interface card (NIC) is a common task for any FreeBSD administrator. +FreeBSD uses the man:rc[8] system of startup scripts during system initialization and for managing services. -=== Locating the Correct Driver +The scripts listed in [.filename]#/etc/rc.d# provide basic services which can be controlled with the `start`, `stop`, and `restart` options to man:service[8]. -First, determine the model of the NIC and the chip it uses. -FreeBSD supports a wide variety of NICs. -Check the Hardware Compatibility List for the FreeBSD release to see if the NIC is supported. +A basic script may look similar to the following: -If the NIC is supported, determine the name of the FreeBSD driver for the NIC. -Refer to [.filename]#/usr/src/sys/conf/NOTES# and [.filename]#/usr/src/sys/arch/conf/NOTES# for the list of NIC drivers with some information about the supported chipsets. -When in doubt, read the manual page of the driver as it will provide more information about the supported hardware and any known limitations of the driver. +[.programlisting] +.... +#!/bin/sh +# +# PROVIDE: utility +# REQUIRE: DAEMON +# KEYWORD: shutdown -The drivers for common NICs are already present in the [.filename]#GENERIC# kernel, meaning the NIC should be probed during boot. -The system's boot messages can be viewed by typing `more /var/run/dmesg.boot` and using the spacebar to scroll through the text. -In this example, two Ethernet NICs using the man:dc[4] driver are present on the system: +. /etc/rc.subr -[source,shell] -.... -dc0: <82c169 PNIC 10/100BaseTX> port 0xa000-0xa0ff mem 0xd3800000-0xd38 -000ff irq 15 at device 11.0 on pci0 -miibus0: <MII bus> on dc0 -bmtphy0: <BCM5201 10/100baseTX PHY> PHY 1 on miibus0 -bmtphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto -dc0: Ethernet address: 00:a0:cc:da:da:da -dc0: [ITHREAD] -dc1: <82c169 PNIC 10/100BaseTX> port 0x9800-0x98ff mem 0xd3000000-0xd30 -000ff irq 11 at device 12.0 on pci0 -miibus1: <MII bus> on dc1 -bmtphy1: <BCM5201 10/100baseTX PHY> PHY 1 on miibus1 -bmtphy1: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto -dc1: Ethernet address: 00:a0:cc:da:da:db -dc1: [ITHREAD] -.... +name=utility +rcvar=utility_enable -If the driver for the NIC is not present in [.filename]#GENERIC#, but a driver is available, the driver will need to be loaded before the NIC can be configured and used. -This may be accomplished in one of two ways: +command="/usr/local/sbin/utility" -* The easiest way is to load a kernel module for the NIC using man:kldload[8]. To also automatically load the driver at boot time, add the appropriate line to [.filename]#/boot/loader.conf#. Not all NIC drivers are available as modules. -* Alternatively, statically compile support for the NIC into a custom kernel. Refer to [.filename]#/usr/src/sys/conf/NOTES#, [.filename]#/usr/src/sys/arch/conf/NOTES# and the manual page of the driver to determine which line to add to the custom kernel configuration file. For more information about recompiling the kernel, refer to crossref:kernelconfig[kernelconfig,Configuring the FreeBSD Kernel]. If the NIC was detected at boot, the kernel does not need to be recompiled. +load_rc_config $name -[[config-network-ndis]] -==== Using Windows(R) NDIS Drivers +# +# DO NOT CHANGE THESE DEFAULT VALUES HERE +# SET THEM IN THE /etc/rc.conf FILE +# +utility_enable=${utility_enable-"NO"} +pidfile=${utility_pidfile-"/var/run/utility.pid"} -Unfortunately, there are still many vendors that do not provide schematics for their drivers to the open source community because they regard such information as trade secrets. -Consequently, the developers of FreeBSD and other operating systems are left with two choices: develop the drivers by a long and pain-staking process of reverse engineering or using the existing driver binaries available for Microsoft(R) Windows(R) platforms. +run_rc_command "$1" +.... -FreeBSD provides "native" support for the Network Driver Interface Specification (NDIS). -It includes man:ndisgen[8] which can be used to convert a Windows(R) XP driver into a format that can be used on FreeBSD. -As the man:ndis[4] driver uses a Windows(R) XP binary, it only runs on i386(TM) and amd64 systems. -PCI, CardBus, PCMCIA, and USB devices are supported. +Refer to extref:{rc-scripting}[this article] for instructions on how to create custom man:rc[8] scripts. -To use man:ndisgen[8], three things are needed: +[[configtuning-starting-services]] +=== Starting Services -. FreeBSD kernel sources. -. A Windows(R) XP driver binary with a [.filename]#.SYS# extension. -. A Windows(R) XP driver configuration file with a [.filename]#.INF# extension. +Many users install third party software on FreeBSD from the Ports Collection and require the installed services to be started upon system initialization. -Download the [.filename]#.SYS# and [.filename]#.INF# files for the specific NIC. -Generally, these can be found on the driver CD or at the vendor's website. -The following examples use [.filename]#W32DRIVER.SYS# and [.filename]#W32DRIVER.INF#. +Services, such as package:security/openssh-portable[] or package:www/nginx[] are just two of the many software packages which may be started during system initialization. +This section explains the procedures available for starting services. -The driver bit width must match the version of FreeBSD. -For FreeBSD/i386, use a Windows(R) 32-bit driver. -For FreeBSD/amd64, a Windows(R) 64-bit driver is needed. +Since the man:rc[8] system is primarily intended to start and stop services at system startup and shutdown time, the `start`, `stop` and `restart` options will only perform their action if the appropriate [.filename]#/etc/rc.conf# variable is set. -The next step is to compile the driver binary into a loadable kernel module. -As `root`, use man:ndisgen[8]: +So the first step to start a service, like for example package:www/nginx[] is to add it to [.filename]#/etc/rc.conf# by executing the following command: [source,shell] .... -# ndisgen /path/to/W32DRIVER.INF /path/to/W32DRIVER.SYS +# sysrc nginx_enable="YES" .... -This command is interactive and prompts for any extra information it requires. -A new kernel module will be generated in the current directory. -Use man:kldload[8] to load the new module: +Then nginx can be started executing the following command: [source,shell] .... -# kldload ./W32DRIVER_SYS.ko +# service nginx start .... -In addition to the generated kernel module, the [.filename]#ndis.ko# and [.filename]#if_ndis.ko# modules must be loaded. -This should happen automatically when any module that depends on man:ndis[4] is loaded. -If not, load them manually, using the following commands: +[TIP] +==== +To `start`, `stop` or `restart` a service regardless of the settings in [.filename]#/etc/rc.conf#, these commands should be prefixed with "one". +For instance, to start package:www/nginx[] regardless of the current [.filename]#/etc/rc.conf# setting, execute the following command: [source,shell] .... -# kldload ndis -# kldload if_ndis +# service nginx onestart .... +==== + +[[configtuning-status-services]] +=== Status of a Service -The first command loads the man:ndis[4] miniport driver wrapper and the second loads the generated NIC driver. +To determine if a service is running, use the `status` subcommand. -Check man:dmesg[8] to see if there were any load errors. -If all went well, the output should be similar to the following: +For example, to verify that package:www/nginx[] is running: [source,shell] .... -ndis0: <Wireless-G PCI Adapter> mem 0xf4100000-0xf4101fff irq 3 at device 8.0 on pci1 -ndis0: NDIS API version: 5.0 -ndis0: Ethernet address: 0a:b1:2c:d3:4e:f5 -ndis0: 11b rates: 1Mbps 2Mbps 5.5Mbps 11Mbps -ndis0: 11g rates: 6Mbps 9Mbps 12Mbps 18Mbps 36Mbps 48Mbps 54Mbps +# service nginx status .... -From here, [.filename]#ndis0# can be configured like any other NIC. - -To configure the system to load the man:ndis[4] modules at boot time, copy the generated module, [.filename]#W32DRIVER_SYS.ko#, to [.filename]#/boot/modules#. -Then, add the following line to [.filename]#/boot/loader.conf#: +The output should be similar to the following: [.programlisting] .... -W32DRIVER_SYS_load="YES" +nginx is running as pid 27871. .... -=== Configuring the Network Card +[[configtuning-reload-services]] +=== Reload a Service + +In some cases, it is also possible to `reload` a service. +This attempts to send a signal to an individual service, forcing the service to reload its configuration files. -Once the right driver is loaded for the NIC, the card needs to be configured. -It may have been configured at installation time by man:bsdinstall[8]. +In most cases, this means sending the service a `SIGHUP` signal. -To display the NIC configuration, enter the following command: +*Not all services support this feature.* -[source,shell] -.... -% ifconfig -dc0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 - options=80008<VLAN_MTU,LINKSTATE> - ether 00:a0:cc:da:da:da - inet 192.168.1.3 netmask 0xffffff00 broadcast 192.168.1.255 - media: Ethernet autoselect (100baseTX <full-duplex>) - status: active -dc1: flags=8802<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500 - options=80008<VLAN_MTU,LINKSTATE> - ether 00:a0:cc:da:da:db - inet 10.0.0.1 netmask 0xffffff00 broadcast 10.0.0.255 - media: Ethernet 10baseT/UTP - status: no carrier -lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384 - options=3<RXCSUM,TXCSUM> - inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4 - inet6 ::1 prefixlen 128 - inet 127.0.0.1 netmask 0xff000000 - nd6 options=3<PERFORMNUD,ACCEPT_RTADV> -.... - -In this example, the following devices were displayed: - -* [.filename]#dc0#: The first Ethernet interface. -* [.filename]#dc1#: The second Ethernet interface. -* [.filename]#lo0#: The loopback device. - -FreeBSD uses the driver name followed by the order in which the card is detected at boot to name the NIC. -For example, [.filename]#sis2# is the third NIC on the system using the man:sis[4] driver. - -In this example, [.filename]#dc0# is up and running. -The key indicators are: - -. `UP` means that the card is configured and ready. -. The card has an Internet (`inet`) address, `192.168.1.3`. -. It has a valid subnet mask (`netmask`), where `0xffffff00` is the same as `255.255.255.0`. -. It has a valid broadcast address, `192.168.1.255`. -. The MAC address of the card (`ether`) is `00:a0:cc:da:da:da`. -. The physical media selection is on autoselection mode (`media: Ethernet autoselect (100baseTX <full-duplex>)`). In this example, [.filename]#dc1# is configured to run with `10baseT/UTP` media. For more information on available media types for a driver, refer to its manual page. -. The status of the link (`status`) is `active`, indicating that the carrier signal is detected. For [.filename]#dc1#, the `status: no carrier` status is normal when an Ethernet cable is not plugged into the card. - -If the man:ifconfig[8] output had shown something similar to: +The man:rc[8] system is used for network services and it also contributes to most of the system initialization. +For instance, when the [.filename]#/etc/rc.d/bgfsck# script is executed, it prints out the following message: [source,shell] .... -dc0: flags=8843<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500 - options=80008<VLAN_MTU,LINKSTATE> - ether 00:a0:cc:da:da:da - media: Ethernet autoselect (100baseTX <full-duplex>) - status: active +Starting background file system checks in 60 seconds. .... -it would indicate the card has not been configured. +This script is used for background file system checks, which occur only during system initialization. -The card must be configured as `root`. -The NIC configuration can be performed from the command line with man:ifconfig[8] but will not persist after a reboot unless the configuration is also added to [.filename]#/etc/rc.conf#. -If a DHCP server is present on the LAN, just add this line: +Many system services depend on other services to function properly. +For example, man:yp[8] and other RPC-based services may fail to start until after the man:rpcbind[8] service has started. -[.programlisting] -.... -ifconfig_dc0="DHCP" -.... +Additional information can be found in man:rc[8] and man:rc.subr[8]. -Replace _dc0_ with the correct value for the system. +=== Using Services to Start Services -The line added, then, follow the instructions given in <<config-network-testing>>. +Other services can be started using man:inetd[8]. +Working with man:inetd[8] and its configuration is described in depth in crossref:network-servers[network-inetd,“The inetd Super-Server”]. -[NOTE] -==== -If the network was configured during installation, some entries for the NIC(s) may be already present. -Double check [.filename]#/etc/rc.conf# before adding any lines. -==== +In some cases, it may make more sense to use man:cron[8] to start system services. +This approach has a number of advantages as man:cron[8] runs these processes as the owner of the man:crontab[5]. +This allows regular users to start and maintain their own applications. + +The `@reboot` feature of man:cron[8], may be used in place of the time specification. +This causes the job to run when man:cron[8] is started, normally during system initialization. + +[[cron-periodic]] +== Cron and Periodic + +Scheduling tasks to run at a certain day or time is a very common task on FreeBSD. +The tool in charge of performing this task is man:cron[8]. + +In addition to tasks that can be scheduled by the user via man:cron[8], FreeBSD performs routine background tasks managed by man:periodic[8]. + +[[configtuning-cron]] +=== Cron + +The man:cron[8] utility runs in the background and regularly checks [.filename]#/etc/crontab# for tasks to execute and searches [.filename]#/var/cron/tabs# for custom crontab files. -If there is no DHCP server, the NIC(s) must be configured manually. -Add a line for each NIC present on the system, as seen in this example: +These files are used to schedule tasks which cron runs at the specified times. + +Each entry in a crontab defines a task to run and is known as a _cron job_. + +Two different types of configuration files are used: the system crontab, which should not be modified, and user crontabs, which can be created and edited as needed. +The format used by these files is documented in man:crontab[5]. +The format of the system crontab, [.filename]#/etc/crontab# includes a `who` column which does not exist in user crontabs. +In the system crontab, cron runs the command as the user specified in this column. +In a user crontab, all commands run as the user who created the crontab. + +User crontabs allow individual users to schedule their own tasks. +The `root` user can also have a user [.filename]#crontab# which can be used to schedule tasks that do not exist in the system [.filename]#crontab#. + +Here is a sample entry from the system crontab, [.filename]#/etc/crontab#: [.programlisting] .... -ifconfig_dc0="inet 192.168.1.3 netmask 255.255.255.0" -ifconfig_dc1="inet 10.0.0.1 netmask 255.255.255.0 media 10baseT/UTP" +# /etc/crontab - root's crontab for FreeBSD +# +# <.> +# +SHELL=/bin/sh +PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin <.> +# +#minute hour mday month wday who command <.> +# +# Save some entropy so that /dev/random can re-seed on boot. +*/11 * * * * operator /usr/libexec/save-entropy <.> +# +# Rotate log files every hour, if necessary. +0 * * * * root newsyslog +# +# Perform daily/weekly/monthly maintenance. +1 3 * * * root periodic daily +15 4 * * 6 root periodic weekly +30 5 1 * * root periodic monthly +# +# Adjust the time zone if the CMOS clock keeps local time, as opposed to +# UTC time. See adjkerntz(8) for details. +1,31 0-5 * * * root adjkerntz -a + .... -Replace [.filename]#dc0# and [.filename]#dc1# and the IP address information with the correct values for the system. -Refer to the man page for the driver, man:ifconfig[8], and man:rc.conf[5] for more details about the allowed options and the syntax of [.filename]#/etc/rc.conf#. +<.> Lines that begin with the `+#+` character are comments. A comment can be placed in the file as a reminder of what and why a desired action is performed. Comments cannot be on the same line as a command or else they will be interpreted as part of the command; they must be on a new line. Blank lines are ignored. -If the network is not using DNS, edit [.filename]#/etc/hosts# to add the names and IP addresses of the hosts on the LAN, if they are not already there. -For more information, refer to man:hosts[5] and to [.filename]#/usr/share/examples/etc/hosts#. +<.> The equals (`=`) character is used to define any environment settings. In this example, it is used to define the `SHELL` and `PATH`. If the `SHELL` is omitted, cron will use the default Bourne shell. If the `PATH` is omitted, the full path must be given to the command or script to run. -[NOTE] -==== -If there is no DHCP server and access to the Internet is needed, manually configure the default gateway and the nameserver: +<.> This line defines the seven fields used in a system crontab: `minute`, `hour`, `mday`, `month`, `wday`, `who`, and `command`. The `minute` field is the time in minutes when the specified command will be run, the `hour` is the hour when the specified command will be run, the `mday` is the day of the month, `month` is the month, and `wday` is the day of the week. These fields must be numeric values, representing the twenty-four hour clock, or a `*`, representing all values for that field. The `who` field only exists in the system crontab and specifies which user the command should be run as. The last field is the command to be executed. + +<.> This entry defines the values for this cron job. The `\*/11`, followed by several more `*` characters, specifies that `/usr/libexec/save-entropy` is invoked by `operator` every eleven minutes of every hour, of every day and day of the week, of every month. Commands can include any number of switches. However, commands which extend to multiple lines need to be broken with the backslash "\" continuation character. + +[[configtuning-installcrontab]] +=== Creating a User Crontab + +To create a user crontab, invoke `crontab` in editor mode: [source,shell] .... -# sysrc defaultrouter="your_default_router" -# echo 'nameserver your_DNS_server' >> /etc/resolv.conf +% crontab -e .... -==== - -[[config-network-testing]] -=== Testing and Troubleshooting +This will open the user's crontab using the default text editor. +The first time a user runs this command, it will open an empty file. +Once a user creates a crontab, this command will open that file for editing. -Once the necessary changes to [.filename]#/etc/rc.conf# are saved, a reboot can be used to test the network configuration and to verify that the system restarts without any configuration errors. -Alternatively, apply the settings to the networking system with this command: +It is useful to add these lines to the top of the crontab file in order to set the environment variables and to remember the meanings of the fields in the crontab: -[source,shell] +[.programlisting] .... -# service netif restart +SHELL=/bin/sh +PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin +# Order of crontab fields +# minute hour mday month wday command .... -[NOTE] -==== -If a default gateway has been set in [.filename]#/etc/rc.conf#, also issue this command: +Then add a line for each command or script to run, specifying the time to run the command. +This example runs the specified custom Bourne shell script every day at two in the afternoon. +Since the path to the script is not specified in `PATH`, the full path to the script is given: -[source,shell] +[.programlisting] .... -# service routing restart +0 14 * * * /home/user/bin/mycustomscript.sh .... +[TIP] ==== +Before using a custom script, make sure it is executable and test it with the limited set of environment variables set by cron. +To replicate the environment that would be used to run the above cron entry, use: -Once the networking system has been relaunched, test the NICs. +[.programlisting] +.... +env -i SHELL=/bin/sh PATH=/etc:/bin:/sbin:/usr/bin:/usr/sbin HOME=/home/user LOGNAME=user /home/user/bin/mycustomscript.sh +.... -==== Testing the Ethernet Card +The environment set by cron is discussed in man:crontab[5]. +Checking that scripts operate correctly in a cron environment is especially important if they include any commands that delete files using wildcards. +==== -To verify that an Ethernet card is configured correctly, man:ping[8] the interface itself, and then man:ping[8] another machine on the LAN: +When finished editing the crontab, save the file. +It will automatically be installed, and cron will read the crontab and run its cron jobs at their specified times. +To list the cron jobs in a crontab, use this command: [source,shell] .... -% ping -c5 192.168.1.3 -PING 192.168.1.3 (192.168.1.3): 56 data bytes -64 bytes from 192.168.1.3: icmp_seq=0 ttl=64 time=0.082 ms -64 bytes from 192.168.1.3: icmp_seq=1 ttl=64 time=0.074 ms -64 bytes from 192.168.1.3: icmp_seq=2 ttl=64 time=0.076 ms -64 bytes from 192.168.1.3: icmp_seq=3 ttl=64 time=0.108 ms -64 bytes from 192.168.1.3: icmp_seq=4 ttl=64 time=0.076 ms +% crontab -l +.... + +The output should be similar to the following: ---- 192.168.1.3 ping statistics --- -5 packets transmitted, 5 packets received, 0% packet loss -round-trip min/avg/max/stddev = 0.074/0.083/0.108/0.013 ms +[.programlisting] +.... +0 14 * * * /home/user/bin/mycustomscript.sh .... +To remove all of the cron jobs in a user crontab: + [source,shell] .... -% ping -c5 192.168.1.2 -PING 192.168.1.2 (192.168.1.2): 56 data bytes -64 bytes from 192.168.1.2: icmp_seq=0 ttl=64 time=0.726 ms -64 bytes from 192.168.1.2: icmp_seq=1 ttl=64 time=0.766 ms -64 bytes from 192.168.1.2: icmp_seq=2 ttl=64 time=0.700 ms -64 bytes from 192.168.1.2: icmp_seq=3 ttl=64 time=0.747 ms -64 bytes from 192.168.1.2: icmp_seq=4 ttl=64 time=0.704 ms - ---- 192.168.1.2 ping statistics --- -5 packets transmitted, 5 packets received, 0% packet loss -round-trip min/avg/max/stddev = 0.700/0.729/0.766/0.025 ms +% crontab -r .... -To test network resolution, use the host name instead of the IP address. -If there is no DNS server on the network, [.filename]#/etc/hosts# must first be configured. -To this purpose, edit [.filename]#/etc/hosts# to add the names and IP addresses of the hosts on the LAN, if they are not already there. -For more information, refer to man:hosts[5] and to [.filename]#/usr/share/examples/etc/hosts#. - -==== Troubleshooting +The output should be similar to the following: -When troubleshooting hardware and software configurations, check the simple things first. -Is the network cable plugged in? Are the network services properly configured? Is the firewall configured correctly? Is the NIC supported by FreeBSD? Before sending a bug report, always check the Hardware Notes, update the version of FreeBSD to the latest STABLE version, check the mailing list archives, and search the Internet. +[.programlisting] +.... +remove crontab for user? y +.... -If the card works, yet performance is poor, read through man:tuning[7]. -Also, check the network configuration as incorrect network settings can cause slow connections. +[[configtuning-periodic]] +=== Periodic -Some users experience one or two `device timeout` messages, which is normal for some cards. -If they continue, or are bothersome, determine if the device is conflicting with another device. -Double check the cable connections. -Consider trying another card. +FreeBSD provides a set of system management scripts to check status of various subsystems, perform security-related checks, rotate log files, etc. +These scripts are run on a periodic basis: daily. weekly, or monthly. +The management of these tasks is performed by man:periodic[8] and its configuration resides in man:periodic.conf[5]. +The periodic tasks are initiated by entries in the system crontab, shown above. -To resolve `watchdog timeout` errors, first check the network cable. -Many cards require a PCI slot which supports bus mastering. -On some old motherboards, only one PCI slot allows it, usually slot 0. -Check the NIC and the motherboard documentation to determine if that may be the problem. +Scripts executed by man:periodic[8] are located in [.filename]#/etc/periodic/# for base utilities and in [.filename]#/usr/local/etc/periodic/# for third-party software. -`No route to host` messages occur if the system is unable to route a packet to the destination host. -This can happen if no default route is specified or if a cable is unplugged. -Check the output of `netstat -rn` and make sure there is a valid route to the host. -If there is not, read crossref:advanced-networking[network-routing,“Gateways and Routes”]. +They are organized in 4 subdirectories, daily, weekly, monthly and security. -`ping: sendto: Permission denied` error messages are often caused by a misconfigured firewall. -If a firewall is enabled on FreeBSD but no rules have been defined, the default policy is to deny all traffic, even man:ping[8]. -Refer to crossref:firewalls[firewalls,Firewalls] for more information. +[[enable-disable-periodic]] +=== Enable or Disable Periodic Tasks -Sometimes performance of the card is poor or below average. -In these cases, try setting the media selection mode from `autoselect` to the correct media selection. -While this works for most hardware, it may or may not resolve the issue. -Again, check all the network settings, and refer to man:tuning[7]. +FreeBSD has some scripts enabled by default to run periodically. -[[configtuning-virtual-hosts]] -== Virtual Hosts +To enable or disable a task, the first step is to edit [.filename]#/etc/periodic.conf# executing the following command: -A common use of FreeBSD is virtual site hosting, where one server appears to the network as many servers. -This is achieved by assigning multiple network addresses to a single interface. +[source,shell] +.... +# ee /etc/periodic.conf +.... -A given network interface has one "real" address, and may have any number of "alias" addresses. -These aliases are normally added by placing alias entries in [.filename]#/etc/rc.conf#, as seen in this example: +And then to enable, for example, `daily_status_zfs_enable` put the following content in the file: [.programlisting] .... -ifconfig_fxp0_alias0="inet xxx.xxx.xxx.xxx netmask xxx.xxx.xxx.xxx" +daily_status_zfs_enable="YES" .... -Alias entries must start with `alias__0__` using a sequential number such as `alias0`, `alias1`, and so on. -The configuration process will stop at the first missing number. +To disable a task that is active by default, all that needs to be done is to change `YES` to `NO`. -The calculation of alias netmasks is important. -For a given interface, there must be one address which correctly represents the network's netmask. -Any other addresses which fall within this network must have a netmask of all ``1``s, expressed as either `255.255.255.255` or `0xffffffff`. +[[configuring-output-periodic-tasks]] +=== Configuring the Output of Periodic Tasks -For example, consider the case where the [.filename]#fxp0# interface is connected to two networks: `10.1.1.0` with a netmask of `255.255.255.0` and `202.0.75.16` with a netmask of `255.255.255.240`. -The system is to be configured to appear in the ranges `10.1.1.1` through `10.1.1.5` and `202.0.75.17` through `202.0.75.20`. -Only the first address in a given network range should have a real netmask. -All the rest (`10.1.1.2` through `10.1.1.5` and `202.0.75.18` through `202.0.75.20`) must be configured with a netmask of `255.255.255.255`. +In [.filename]#/etc/periodic.conf# the variables `daily_output`, `weekly_output` and `monthly_output` specifies where to send the results of the script execution. -The following [.filename]#/etc/rc.conf# entries configure the adapter correctly for this scenario: +By default the output of the periodic scripts are emailed to root, and therefore it is best to read root's mail or alias root to a mailbox that is monitored. + +To send the results to another email or to other emails, add the email addresses separated by spaces to [.filename]#/etc/periodic.conf#: [.programlisting] .... -ifconfig_fxp0="inet 10.1.1.1 netmask 255.255.255.0" -ifconfig_fxp0_alias0="inet 10.1.1.2 netmask 255.255.255.255" -ifconfig_fxp0_alias1="inet 10.1.1.3 netmask 255.255.255.255" -ifconfig_fxp0_alias2="inet 10.1.1.4 netmask 255.255.255.255" -ifconfig_fxp0_alias3="inet 10.1.1.5 netmask 255.255.255.255" -ifconfig_fxp0_alias4="inet 202.0.75.17 netmask 255.255.255.240" -ifconfig_fxp0_alias5="inet 202.0.75.18 netmask 255.255.255.255" -ifconfig_fxp0_alias6="inet 202.0.75.19 netmask 255.255.255.255" -ifconfig_fxp0_alias7="inet 202.0.75.20 netmask 255.255.255.255" +daily_output="email1@example.com email2@example.com" +weekly_output="email1@example.com email2@example.com" +monthly_output="email1@example.com email2@example.com" .... -A simpler way to express this is with a space-separated list of IP address ranges. -The first address will be given the indicated subnet mask and the additional addresses will have a subnet mask of `255.255.255.255`. +To log periodic output instead of receiving it as email, add the following lines to [.filename]#/etc/periodic.conf#. man:newsyslog[8] will rotate these files at the appropriate times: [.programlisting] .... -ifconfig_fxp0_aliases="inet 10.1.1.1-5/24 inet 202.0.75.17-20/28" +daily_output=/var/log/daily.log +weekly_output=/var/log/weekly.log +monthly_output=/var/log/monthly.log .... [[configtuning-syslog]] @@ -758,11 +697,8 @@ The information in system logs can be used to detect hardware and software issue This information also plays an important role in security auditing and incident response. Most system daemons and applications will generate log entries. -FreeBSD provides a system logger, syslogd, to manage logging. -By default, syslogd is started when the system boots. -This is controlled by the variable `syslogd_enable` in [.filename]#/etc/rc.conf#. -There are numerous application arguments that can be set using `syslogd_flags` in [.filename]#/etc/rc.conf#. -Refer to man:syslogd[8] for more information on the available arguments. +FreeBSD provides a system logger, man:syslogd[8], to manage logging. +By default, syslogd is enabled and started when the system boots. This section describes how to configure the FreeBSD system logger for both local and remote logging and how to perform log rotation and log management. @@ -780,29 +716,28 @@ It is also possible to add an optional comparison flag before the level to speci Multiple selector fields can be used for the same action, and are separated with a semicolon (`;`). Using `*` will match everything. The action field denotes where to send the log message, such as to a file or remote log host. -As an example, here is the default [.filename]#syslog.conf# from FreeBSD: + +As an example, here is the default [.filename]#/etc/syslog.conf# from FreeBSD: [.programlisting] .... -# $FreeBSD$ -# # Spaces ARE valid field separators in this file. However, # other *nix-like systems still insist on using tabs as field # separators. If you are sharing this file between systems, you # may want to use only tabs as field separators here. # Consult the syslog.conf(5) manpage. -*.err;kern.warning;auth.notice;mail.crit /dev/console +*.err;kern.warning;auth.notice;mail.crit /dev/console <.> *.notice;authpriv.none;kern.debug;lpr.info;mail.crit;news.err /var/log/messages security.* /var/log/security auth.info;authpriv.info /var/log/auth.log -mail.info /var/log/maillog -lpr.info /var/log/lpd-errs -ftp.info /var/log/xferlog +mail.info /var/log/maillog <.> cron.* /var/log/cron !-devd -*.=debug /var/log/debug.log +*.=debug /var/log/debug.log <.> *.emerg * +daemon.info /var/log/daemon.log # uncomment this to log all writes to /dev/console to /var/log/console.log +# touch /var/log/console.log and chmod it to mode 600 before it will work #console.info /var/log/console.log # uncomment this to enable logging of all log messages to /var/log/all.log # touch /var/log/all.log and chmod it to mode 600 before it will work @@ -815,53 +750,181 @@ cron.* /var/log/cron # news.notice /var/log/news/news.notice # Uncomment this if you wish to see messages produced by devd # !devd -# *.>=info -!ppp -*.* /var/log/ppp.log +# *.>=notice /var/log/devd.log <.> !* +include /etc/syslog.d +include /usr/local/etc/syslog.d .... -In this example: +<.> Matches all messages with a level of `err` or higher, as well as `kern.warning`, `auth.notice` and `mail.crit`, and sends these log messages to the console ([.filename]#/dev/console#). +<.> Matches all messages from the `mail` facility at level `info` or above and logs the messages to [.filename]#/var/log/maillog#. +<.> Uses a comparison flag (`=`) to only match messages at level `debug` and logs them to [.filename]#/var/log/debug.log#. +<.> Is an example usage of a program specification. This makes the rules following it only valid for the specified program. In this case, only the messages generated by man:devd[8] are logged to [.filename]#/var/log/devd.log#. + +For more information about [.filename]#/etc/syslog.conf#, its syntax, and more advanced usage examples, see man:syslog.conf[5]. + +[[logging-facilities]] +=== Logging Facilities + +A facility describes the part of the system generating the message. +Facilities are a way of separating the different messages so that it is easier for the user to consult the logs. + +.syslog facilities +[options="header", cols="1,1"] +|=== +| Name | Description + +| auth +| The authorization system: man:login[1], man:su[1], man:getty[8], etc. + +| authpriv +| The same as auth, but logged to a file readable only by root. + +| console +| Messages written to [.filename]#/dev/console# by the kernel console output driver. + +| cron +| Messages written by the man:cron[8] daemon. + +| daemon +| System daemons, such as man:routed[8], that are not provided for explicitly by other facilities. + +| ftp +| The file transfer protocol daemons: man:ftpd[8], man:tftpd[8]. + +| kern +| Messages generated by the kernel. These cannot be generated by any user processes. + +| lpr +| The line printer spooling system: man:lpr[1], man:lpc[8], man:lpd[8], etc. + +| mail +| The mail system. + +| mark +| This facility adds a record every 20 minutes. + +| news +| The network news system. + +| ntp +| The network time protocol system. + +| security +| Security subsystems, such as man:ipfw[4]. + +| syslog +| Messages generated internally by syslogd(8). + +| user +| Messages generated by random user processes. *This is the default facility identifier if none is specified*. + +| uucp +| The Unix-to-Unix Copy system. An ancient protocol. Really weird to see messages from this facility. + +| local0 through local7 +| Reserved for local use. + +|=== + +[[logging-levels]] +=== Logging Levels + +The level describes the severity of the message, and is a keyword from the following ordered list (higher to lower): + +.syslog levels +[options="header", cols="1,1"] +|=== +| Name | Description + +| emerg +| A panic condition. This is normally broadcast to all users. + +| alert +| A condition that should be corrected immediately, such as a corrupted system database. + +| crit +| Critical conditions, e.g., hard device errors. + +| err +| Errors. + +| warning +| Warning messages. -* Line 8 matches all messages with a level of `err` or higher, as well as `kern.warning`, `auth.notice` and `mail.crit`, and sends these log messages to the console ([.filename]#/dev/console#). -* Line 12 matches all messages from the `mail` facility at level `info` or above and logs the messages to [.filename]#/var/log/maillog#. -* Line 17 uses a comparison flag (`=`) to only match messages at level `debug` and logs them to [.filename]#/var/log/debug.log#. -* Line 33 is an example usage of a program specification. This makes the rules following it only valid for the specified program. In this case, only the messages generated by ppp are logged to [.filename]#/var/log/ppp.log#. +| notice +| Conditions that are not error conditions, but should possibly be handled specially. -The available levels, in order from most to least critical are `emerg`, `alert`, `crit`, `err`, `warning`, `notice`, `info`, and `debug`. +| info +| Informational messages. -The facilities, in no particular order, are `auth`, `authpriv`, `console`, `cron`, `daemon`, `ftp`, `kern`, `lpr`, `mail`, `mark`, `news`, `security`, `syslog`, `user`, `uucp`, and `local0` through `local7`. -Be aware that other operating systems might have different facilities. +| debug +| Messages that contain information normally of use only when debugging a program. -To log everything of level `notice` and higher to [.filename]#/var/log/daemon.log#, add the following entry: +| none +| This special level disables a particular facility. + +|=== + +[[read-log-messages]] +=== Read Log Messages + +By default FreeBSD log files use the format link:https://datatracker.ietf.org/doc/html/rfc3164[rfc3164], also known as The BSD syslog Protocol. +Learn more about other formats and how to use them at man:syslog[8]. + +Typically the logs have the following syntax: [.programlisting] .... -daemon.notice /var/log/daemon.log +date time hostname program[pid]: the message .... -For more information about the different levels and facilities, refer to man:syslog[3] and man:syslogd[8]. -For more information about [.filename]#/etc/syslog.conf#, its syntax, and more advanced usage examples, see man:syslog.conf[5]. +The output of the [.filename]#/var/log/cron# file will be used as an example: + +[.programlisting] +.... +[...] +Jul 16 12:40:00 FreeBSD /usr/sbin/cron[81519]: (root) CMD (/usr/libexec/atrun) +Jul 16 12:44:00 FreeBSD /usr/sbin/cron[83072]: (operator) CMD (/usr/libexec/save-entropy) +[...] +.... + +Verbose logging, so the facility and the level on each message will be added, can be enabled in man:syslog[8] by running the following command: + +[source,shell] +.... +# sysrc syslogd_flags="-vv" +.... + +Once the function is activated, the facility and the level will be displayed in the log as shown in the following example: + +[.programlisting] +.... +[...] +Jul 16 17:40:00 <cron.info> FreeBSD /usr/sbin/cron[1016]: (root) CMD (/usr/libexec/atrun) +Jul 16 17:44:00 <cron.info> FreeBSD /usr/sbin/cron[1030]: (operator) CMD (/usr/libexec/save-entropy) +[...] +.... === Log Management and Rotation Log files can grow quickly, taking up disk space and making it more difficult to locate useful information. -Log management attempts to mitigate this. -In FreeBSD, newsyslog is used to manage log files. -This built-in program periodically rotates and compresses log files, and optionally creates missing log files and signals programs when log files are moved. -The log files may be generated by syslogd or by any other program which generates log files. -While newsyslog is normally run from man:cron[8], it is not a system daemon. + +In FreeBSD, man:newsyslog[8] is used to manage log files and attempt to mitigate this. + +This built-in program periodically rotates and compresses log files, and optionally creates missing log files and signals programs when log files are moved. + +[NOTE] +==== +Since newsyslog is run from man:cron[8], it cannot rotate files more often than it is scheduled to run from man:cron[8]. In the default configuration, it runs every hour. +==== -To know which actions to take, newsyslog reads its configuration file, [.filename]#/etc/newsyslog.conf#. -This file contains one line for each log file that newsyslog manages. -Each line states the file owner, permissions, when to rotate that file, optional flags that affect log rotation, such as compression, and programs to signal when the log is rotated. -Here is the default configuration in FreeBSD: +Here is the default configuration in FreeBSD, more information in man:newsyslog.conf[5]: [.programlisting] .... # configuration file for newsyslog -# $FreeBSD$ # # Entries which do not specify the '/pid_file' field will cause the # syslogd process to be signalled when that log file is rotated. This @@ -870,8 +933,6 @@ Here is the default configuration in FreeBSD: # is no process which needs to be signalled when a given log file is # rotated, then the entry for that file should include the 'N' flag. # -# The 'flags' field is one or more of the letters: BCDGJNUXZ or a '-'. -# # Note: some sites will want to select more restrictive protections than the # defaults. In particular, it may be desirable to switch many of the 644 # entries to 640 or 600. For example, some sites will consider the @@ -880,37 +941,40 @@ Here is the default configuration in FreeBSD: # # logfilename [owner:group] mode count size when flags [/pid_file] [sig_num] /var/log/all.log 600 7 * @T00 J -/var/log/amd.log 644 7 100 * J -/var/log/auth.log 600 7 100 @0101T JC -/var/log/console.log 600 5 100 * J -/var/log/cron 600 3 100 * JC +/var/log/auth.log 600 7 1000 @0101T JC +/var/log/console.log 600 5 1000 * J +/var/log/cron 600 3 1000 * JC /var/log/daily.log 640 7 * @T00 JN -/var/log/debug.log 600 7 100 * JC -/var/log/kerberos.log 600 7 100 * J -/var/log/lpd-errs 644 7 100 * JC +/var/log/debug.log 600 7 1000 * JC +/var/log/init.log 644 3 1000 * J +/var/log/kerberos.log 600 7 1000 * J /var/log/maillog 640 7 * @T00 JC -/var/log/messages 644 5 100 @0101T JC +/var/log/messages 644 5 1000 @0101T JC /var/log/monthly.log 640 12 * $M1D0 JN -/var/log/pflog 600 3 100 * JB /var/run/pflogd.pid -/var/log/ppp.log root:network 640 3 100 * JC -/var/log/devd.log 644 3 100 * JC -/var/log/security 600 10 100 * JC -/var/log/sendmail.st 640 10 * 168 B +/var/log/devd.log 644 3 1000 * JC +/var/log/security 600 10 1000 * JC /var/log/utx.log 644 3 * @01T05 B -/var/log/weekly.log 640 5 1 $W6D0 JN -/var/log/xferlog 600 7 100 * JC +/var/log/weekly.log 640 5 * $W6D0 JN +/var/log/daemon.log 644 5 1000 @0101T JC + +<include> /etc/newsyslog.conf.d/[!.]*.conf +<include> /usr/local/etc/newsyslog.conf.d/[!.]*.conf .... -Each line starts with the name of the log to be rotated, optionally followed by an owner and group for both rotated and newly created files. -The `mode` field sets the permissions on the log file and `count` denotes how many rotated log files should be kept. -The `size` and `when` fields tell newsyslog when to rotate the file. -A log file is rotated when either its size is larger than the `size` field or when the time in the `when` field has passed. -An asterisk (`*`) means that this field is ignored. -The _flags_ field gives further instructions, such as how to compress the rotated file or to create the log file if it is missing. -The last two fields are optional and specify the name of the Process ID (PID) file of a process and a signal number to send to that process when the file is rotated. +. `logfilename` - Name of the system log file to be archived. +. `[owner:group]` - This optional field specifies the owner and group for the archive file. +. `mode` - Specify the file mode of the log file and archives. Valid mode bits are 0666. (That is, read and write permissions for the rotated log may be specified for the owner, group, and others.) +. `count` - Specify the maximum number of archive files which may exist. +. `size` - When the size of the log file reaches size in kilobytes, the log file will be trimmed as described above. If this field contains an asterisk ('*'), the log file will not be trimmed based on size. +. `when` - Consist of an interval, a specific time, or both. Supported options in man:newsyslog.conf[5]. +. `flags` - Indicates the flags that newsyslog accepts, supported options in man:newsyslog.conf[5]. +. `[/pid_file]` - This optional field specifies the file name containing a daemon's process ID or to find a group process ID. +. `[sig_num]` - This optional field specifies the signal that will be sent to the daemon process. -For more information on all fields, valid flags, and how to specify the rotation time, refer to man:newsyslog.conf[5]. -Since newsyslog is run from man:cron[8], it cannot rotate files more often than it is scheduled to run from man:cron[8]. +[NOTE] +==== +The last two fields are optional and specify the name of the Process ID (PID) file of a process and a signal number to send to that process when the file is rotated. +==== [[network-syslogd]] === Configuring Remote Logging @@ -919,12 +983,15 @@ Monitoring the log files of multiple hosts can become unwieldy as the number of Configuring centralized logging can reduce some of the administrative burden of log file administration. In FreeBSD, centralized log file aggregation, merging, and rotation can be configured using syslogd and newsyslog. + This section demonstrates an example configuration, where host `A`, named `logserv.example.com`, will collect logging information for the local network. + Host `B`, named `logclient.example.com`, will be configured to pass logging information to the logging server. ==== Log Server Configuration A log server is a system that has been configured to accept logging information from other hosts. + Before configuring a log server, check the following: * If there is a firewall between the logging server and any logging clients, ensure that the firewall ruleset allows UDP port 514 for both the clients and the server. @@ -948,12 +1015,12 @@ This example adds the hostname of `B`, logs all facilities, and stores the log e When adding multiple log clients, add a similar two-line entry for each client. More information about the available facilities may be found in man:syslog.conf[5]. -Next, configure [.filename]#/etc/rc.conf#: +Next, execute the following commands: -[.programlisting] +[source,shell] .... -syslogd_enable="YES" -syslogd_flags="-a logclient.example.com -v -v" +# sysrc syslogd_enable="YES" +# sysrc syslogd_flags="-a logclient.example.com -v -v" .... The first entry starts syslogd at system boot. @@ -988,12 +1055,12 @@ If the server did not restart, consult [.filename]#/var/log/messages# for the er A logging client sends log entries to a logging server on the network. The client also keeps a local copy of its own logs. -Once a logging server has been configured, edit [.filename]#/etc/rc.conf# on the logging client: +Once a logging server has been configured, execute the following commands on the logging client: -[.programlisting] +[source,shell] .... -syslogd_enable="YES" -syslogd_flags="-s -v -v" +# sysrc syslogd_enable="YES" +# sysrc syslogd_flags="-s -v -v" .... The first entry enables syslogd on boot up. @@ -1004,7 +1071,7 @@ In this example, all logged facilities are sent to a remote system, denoted by t [.programlisting] .... -*.* @logserv.example.com +*.* @logserv.example.com .... After saving the edit, restart syslogd for the changes to take effect: @@ -1032,11 +1099,12 @@ Repeat until the `ping` is successful from both hosts. If the `ping` succeeds on both hosts but log messages are still not being received, temporarily increase logging verbosity to narrow down the configuration issue. In the following example, [.filename]#/var/log/logclient.log# on the logging server is empty and [.filename]#/var/log/messages# on the logging client does not indicate a reason for the failure. + To increase debugging output, edit the `syslogd_flags` entry on the logging server and issue a restart: -[.programlisting] +[source,shell] .... -syslogd_flags="-d -a logclient.example.com -v -v" +sysrc syslogd_flags="-d -a logclient.example.com -v -v" .... [source,shell] @@ -1046,7 +1114,7 @@ syslogd_flags="-d -a logclient.example.com -v -v" Debugging data similar to the following will flash on the console immediately after the restart: -[source,shell] +[.programlisting] .... logmsg: pri 56, flags 4, from logserv.example.com, msg syslogd: restart syslogd: restarted @@ -1065,6 +1133,12 @@ Fix the typo, issue a restart, and verify the results: [source,shell] .... # service syslogd restart +.... + +The output should be similar to the following: + +[.programlisting] +.... logmsg: pri 56, flags 4, from logserv.example.com, msg syslogd: restart syslogd: restarted logmsg: pri 6, flags 4, from logserv.example.com, msg syslogd: kernel boot file is /boot/kernel/kernel @@ -1096,886 +1170,417 @@ The built-in log rotator, newsyslog, supports setting permissions on newly creat Setting log files to mode `600` should prevent unwanted access by local users. Refer to man:newsyslog.conf[5] for additional information. -[[configtuning-configfiles]] -== Configuration Files - -=== [.filename]#/etc# Layout - -There are a number of directories in which configuration information is kept. -These include: - -[.informaltable] -[cols="1,1", frame="none"] -|=== - -|[.filename]#/etc# -|Generic system-specific configuration information. - -|[.filename]#/etc/defaults# -|Default versions of system configuration files. - -|[.filename]#/etc/mail# -|Extra man:sendmail[8] configuration and other MTA configuration files. - -|[.filename]#/etc/ppp# -|Configuration for both user- and kernel-ppp programs. - -|[.filename]#/usr/local/etc# -|Configuration files for installed applications. May contain per-application subdirectories. - -|[.filename]#/usr/local/etc/rc.d# -|man:rc[8] scripts for installed applications. - -|[.filename]#/var/db# -|Automatically generated system-specific database files, such as the package database and the man:locate[1] database. -|=== - -=== Hostnames - -==== [.filename]#/etc/resolv.conf# - -How a FreeBSD system accesses the Internet Domain Name System (DNS) is controlled by man:resolv.conf[5]. - -The most common entries to [.filename]#/etc/resolv.conf# are: - -[.informaltable] -[cols="1,1", frame="none"] -|=== - -|`nameserver` -|The IP address of a name server the resolver should query. The servers are queried in the order listed with a maximum of three. - -|`search` -|Search list for hostname lookup. This is normally determined by the domain of the local hostname. +[[acpi-overview]] +== Power and Resource Management -|`domain` -|The local domain name. -|=== +It is important to utilize hardware resources in an efficient manner. +Power and resource management allows the operating system to monitor system limits and to possibly run some actions triggered by events related to those limits. -A typical [.filename]#/etc/resolv.conf# looks like this: +[[acpi-config]] +=== ACPI configuration -[.programlisting] -.... -search example.com -nameserver 147.11.1.11 -nameserver 147.11.100.30 -.... +On FreeBSD the management of these resources is managed by the man:acpi[4] kernel device. [NOTE] ==== -Only one of the `search` and `domain` options should be used. -==== - -When using DHCP, man:dhclient[8] usually rewrites [.filename]#/etc/resolv.conf# with information received from the DHCP server. - -==== [.filename]#/etc/hosts# +In FreeBSD the man:acpi[4] driver is loaded by default at system boot. -[.filename]#/etc/hosts# is a simple text database which works in conjunction with DNS and NIS to provide host name to IP address mappings. -Entries for local computers connected via a LAN can be added to this file for simplistic naming purposes instead of setting up a man:named[8] server. -Additionally, [.filename]#/etc/hosts# can be used to provide a local record of Internet names, reducing the need to query external DNS servers for commonly accessed names. +This driver *cannot be unloaded after boot* because the system bus uses it for various hardware interactions. +==== -[.programlisting] -.... -# $FreeBSD$ -# -# -# Host Database -# -# This file should contain the addresses and aliases for local hosts that -# share this file. Replace 'my.domain' below with the domainname of your -# machine. -# -# In the presence of the domain name service or NIS, this file may -# not be consulted at all; see /etc/nsswitch.conf for the resolution order. -# -# -::1 localhost localhost.my.domain -127.0.0.1 localhost localhost.my.domain -# -# Imaginary network. -#10.0.0.2 myname.my.domain myname -#10.0.0.3 myfriend.my.domain myfriend -# -# According to RFC 1918, you can use the following IP networks for -# private nets which will never be connected to the Internet: -# -# 10.0.0.0 - 10.255.255.255 -# 172.16.0.0 - 172.31.255.255 -# 192.168.0.0 - 192.168.255.255 -# -# In case you want to be able to connect to the Internet, you need -# real official assigned numbers. Do not try to invent your own network -# numbers but instead get one from your network provider (if any) or -# from your regional registry (ARIN, APNIC, LACNIC, RIPE NCC, or AfriNIC.) -# -.... +In addition to man:acpi[4], FreeBSD has several dedicated kernel modules for various ACPI vendor subsystems. +These modules will add some extra functionality like fan speed, keyboard backlit or screen brightness. -The format of [.filename]#/etc/hosts# is as follows: +The list can be obtained by running the following command: -[.programlisting] +[source,shell] .... -[Internet address] [official hostname] [alias1] [alias2] ... +% ls /boot/kernel | grep acpi .... -For example: +The output should be similar to the following: [.programlisting] .... -10.0.0.1 myRealHostname.example.com myRealHostname foobar1 foobar2 +acpi_asus.ko +acpi_asus_wmi.ko +acpi_dock.ko +acpi_fujitsu.ko +acpi_hp.ko +acpi_ibm.ko +acpi_panasonic.ko +acpi_sony.ko +acpi_toshiba.ko +acpi_video.ko +acpi_wmi.ko +sdhci_acpi.ko +uacpi.ko .... -Consult man:hosts[5] for more information. - -[[configtuning-sysctl]] -== Tuning with man:sysctl[8] - -man:sysctl[8] is used to make changes to a running FreeBSD system. -This includes many advanced options of the TCP/IP stack and virtual memory system that can dramatically improve performance for an experienced system administrator. -Over five hundred system variables can be read and set using man:sysctl[8]. - -At its core, man:sysctl[8] serves two functions: to read and to modify system settings. - -To view all readable variables: +In the event that, for example, an IBM/Lenovo laptop is used, it will be necessary to load the module man:acpi_ibm[4] by executing the following command: [source,shell] .... -% sysctl -a +# kldload acpi_ibm .... -To read a particular variable, specify its name: +And add this line to [.filename]#/boot/loader.conf# to load it at boot: -[source,shell] +[.programlisting] .... -% sysctl kern.maxproc -kern.maxproc: 1044 +acpi_ibm_load="YES" .... -To set a particular variable, use the _variable_=_value_ syntax: +An alternative to the man:acpi_video[4] module is the man:backlight[9] driver. +It provides a generic way for handling a panel backlight. +The default GENERIC kernel includes this driver. +The man:backlight[8] utility can be used to query and adjust the brightness of +the panel backlight. +In this example the brightness is decreased by 10%: [source,shell] .... -# sysctl kern.maxfiles=5000 -kern.maxfiles: 2088 -> 5000 -.... - -Settings of sysctl variables are usually either strings, numbers, or booleans, where a boolean is `1` for yes or `0` for no. - -To automatically set some variables each time the machine boots, add them to [.filename]#/etc/sysctl.conf#. -For more information, refer to man:sysctl.conf[5] and <<configtuning-sysctlconf>>. - -[[configtuning-sysctlconf]] -=== [.filename]#sysctl.conf# - -The configuration file for man:sysctl[8], [.filename]#/etc/sysctl.conf#, looks much like [.filename]#/etc/rc.conf#. -Values are set in a `variable=value` form. -The specified values are set after the system goes into multi-user mode. -Not all variables are settable in this mode. - -For example, to turn off logging of fatal signal exits and prevent users from seeing processes started by other users, the following tunables can be set in [.filename]#/etc/sysctl.conf#: - -[.programlisting] +% backlight decr 10 .... -# Do not log fatal signal exits (e.g., sig 11) -kern.logsigexit=0 -# Prevent users from seeing information about processes that -# are being run under another UID. -security.bsd.see_other_uids=0 -.... +[[cpu-power-management]] +=== CPU Power Management -[[sysctl-readonly]] -=== man:sysctl[8] Read-only +CPU is the most consuming part of the system. +Knowing how to improve CPU efficiency is a fundamental part of our system in order to save energy. -In some cases it may be desirable to modify read-only man:sysctl[8] values, which will require a reboot of the system. +In order to make proper use of the machine's resources in a correct way, FreeBSD supports technologies such as Intel Turbo Boost, AMD Turbo Core, Intel Speed Shift among others through the use of man:powerd[8] and man:cpufreq[4]. -For instance, on some laptop models the man:cardbus[4] device will not probe memory ranges and will fail with errors similar to: +The first step will be to obtain the CPU information by executing the following command: [source,shell] .... -cbb0: Could not map register memory -device_probe_and_attach: cbb0 attach returned 12 +% sysctl dev.cpu.0 <.> .... -The fix requires the modification of a read-only man:sysctl[8] setting. -Add `hw.pci.allow_unsupported_io_range=1` to [.filename]#/boot/loader.conf# and reboot. -Now man:cardbus[4] should work properly. - -[[configtuning-disk]] -== Tuning Disks - -The following section will discuss various tuning mechanisms and options which may be applied to disk devices. -In many cases, disks with mechanical parts, such as SCSI drives, will be the bottleneck driving down the overall system performance. -While a solution is to install a drive without mechanical parts, such as a solid state drive, mechanical drives are not going away anytime in the near future. -When tuning disks, it is advisable to utilize the features of the man:iostat[8] command to test various changes to the system. -This command will allow the user to obtain valuable information on system IO. - -=== Sysctl Variables +<.> In this case the `0` digit represents the first core of the CPU. -==== `vfs.vmiodirenable` +The output should be similar to the following: -The `vfs.vmiodirenable` man:sysctl[8] variable may be set to either `0` (off) or `1` (on). -It is set to `1` by default. This variable controls how directories are cached by the system. -Most directories are small, using just a single fragment (typically 1 K) in the file system and typically 512 bytes in the buffer cache. -With this variable turned off, the buffer cache will only cache a fixed number of directories, even if the system has a huge amount of memory. -When turned on, this man:sysctl[8] allows the buffer cache to use the VM page cache to cache the directories, making all the memory available for caching directories. -However, the minimum in-core memory used to cache a directory is the physical page size (typically 4 K) rather than 512 bytes. -Keeping this option enabled is recommended if the system is running any services which manipulate large numbers of files. -Such services can include web caches, large mail systems, and news systems. -Keeping this option on will generally not reduce performance, even with the wasted memory, but one should experiment to find out. - -==== `vfs.write_behind` - -The `vfs.write_behind` man:sysctl[8] variable defaults to `1` (on). -This tells the file system to issue media writes as full clusters are collected, which typically occurs when writing large sequential files. -This avoids saturating the buffer cache with dirty buffers when it would not benefit I/O performance. -However, this may stall processes and under certain circumstances should be turned off. - -==== `vfs.hirunningspace` - -The `vfs.hirunningspace` man:sysctl[8] variable determines how much outstanding write I/O may be queued to disk controllers system-wide at any given instance. -The default is usually sufficient, but on machines with many disks, try bumping it up to four or five _megabytes_. -Setting too high a value which exceeds the buffer cache's write threshold can lead to bad clustering performance. -Do not set this value arbitrarily high as higher write values may add latency to reads occurring at the same time. - -There are various other buffer cache and VM page cache related man:sysctl[8] values. -Modifying these values is not recommended as the VM system does a good job of automatically tuning itself. - -==== `vm.swap_idle_enabled` - -The `vm.swap_idle_enabled` man:sysctl[8] variable is useful in large multi-user systems with many active login users and lots of idle processes. -Such systems tend to generate continuous pressure on free memory reserves. -Turning this feature on and tweaking the swapout hysteresis (in idle seconds) via `vm.swap_idle_threshold1` and `vm.swap_idle_threshold2` depresses the priority of memory pages associated with idle processes more quickly then the normal pageout algorithm. -This gives a helping hand to the pageout daemon. -Only turn this option on if needed, because the tradeoff is essentially pre-page memory sooner rather than later which eats more swap and disk bandwidth. -In a small system this option will have a determinable effect, but in a large system that is already doing moderate paging, this option allows the VM system to stage whole processes into and out of memory easily. - -==== `hw.ata.wc` - -Turning off IDE write caching reduces write bandwidth to IDE disks, but may sometimes be necessary due to data consistency issues introduced by hard drive vendors. -The problem is that some IDE drives lie about when a write completes. -With IDE write caching turned on, IDE hard drives write data to disk out of order and will sometimes delay writing some blocks indefinitely when under heavy disk load. -A crash or power failure may cause serious file system corruption. -Check the default on the system by observing the `hw.ata.wc` man:sysctl[8] variable. -If IDE write caching is turned off, one can set this read-only variable to `1` in [.filename]#/boot/loader.conf# in order to enable it at boot time. - -For more information, refer to man:ata[4]. - -==== `SCSI_DELAY` (`kern.cam.scsi_delay`) - -The `SCSI_DELAY` kernel configuration option may be used to reduce system boot times. -The defaults are fairly high and can be responsible for `15` seconds of delay in the boot process. -Reducing it to `5` seconds usually works with modern drives. -The `kern.cam.scsi_delay` boot time tunable should be used. -The tunable and kernel configuration option accept values in terms of _milliseconds_ and _not seconds_. - -[[soft-updates]] -=== Soft Updates - -To fine-tune a file system, use man:tunefs[8]. -This program has many different options. -To toggle Soft Updates on and off, use: - -[source,shell] +[.programlisting] .... -# tunefs -n enable /filesystem -# tunefs -n disable /filesystem -.... - -A file system cannot be modified with man:tunefs[8] while it is mounted. -A good time to enable Soft Updates is before any partitions have been mounted, in single-user mode. - -Soft Updates is recommended for UFS file systems as it drastically improves meta-data performance, mainly file creation and deletion, through the use of a memory cache. -There are two downsides to Soft Updates to be aware of. -First, Soft Updates guarantee file system consistency in the case of a crash, but could easily be several seconds or even a minute behind updating the physical disk. -If the system crashes, unwritten data may be lost. -Secondly, Soft Updates delay the freeing of file system blocks. -If the root file system is almost full, performing a major update, such as `make installworld`, can cause the file system to run out of space and the update to fail. - -==== More Details About Soft Updates - -Meta-data updates are updates to non-content data like inodes or directories. -There are two traditional approaches to writing a file system's meta-data back to disk. - -Historically, the default behavior was to write out meta-data updates synchronously. -If a directory changed, the system waited until the change was actually written to disk. -The file data buffers (file contents) were passed through the buffer cache and backed up to disk later on asynchronously. -The advantage of this implementation is that it operates safely. -If there is a failure during an update, meta-data is always in a consistent state. -A file is either created completely or not at all. -If the data blocks of a file did not find their way out of the buffer cache onto the disk by the time of the crash, man:fsck[8] recognizes this and repairs the file system by setting the file length to `0`. -Additionally, the implementation is clear and simple. -The disadvantage is that meta-data changes are slow. -For example, `rm -r` touches all the files in a directory sequentially, but each directory change will be written synchronously to the disk. -This includes updates to the directory itself, to the inode table, and possibly to indirect blocks allocated by the file. -Similar considerations apply for unrolling large hierarchies using `tar -x`. - -The second approach is to use asynchronous meta-data updates. -This is the default for a UFS file system mounted with `mount -o async`. -Since all meta-data updates are also passed through the buffer cache, they will be intermixed with the updates of the file content data. -The advantage of this implementation is there is no need to wait until each meta-data update has been written to disk, so all operations which cause huge amounts of meta-data updates work much faster than in the synchronous case. -This implementation is still clear and simple, so there is a low risk for bugs creeping into the code. -The disadvantage is that there is no guarantee for a consistent state of the file system -If there is a failure during an operation that updated large amounts of meta-data, like a power failure or someone pressing the reset button, the file system will be left in an unpredictable state. -There is no opportunity to examine the state of the file system when the system comes up again as the data blocks of a file could already have been written to the disk while the updates of the inode table or the associated directory were not. -It is impossible to implement a man:fsck[8] which is able to clean up the resulting chaos because the necessary information is not available on the disk. -If the file system has been damaged beyond repair, the only choice is to reformat it and restore from backup. - -The usual solution for this problem is to implement _dirty region logging_, which is also referred to as _journaling_. -Meta-data updates are still written synchronously, but only into a small region of the disk. -Later on, they are moved to their proper location. -Since the logging area is a small, contiguous region on the disk, there are no long distances for the disk heads to move, even during heavy operations, so these operations are quicker than synchronous updates. -Additionally, the complexity of the implementation is limited, so the risk of bugs being present is low. -A disadvantage is that all meta-data is written twice, once into the logging region and once to the proper location, so performance "pessimization" might result. -On the other hand, in case of a crash, all pending meta-data operations can be either quickly rolled back or completed from the logging area after the system comes up again, resulting in a fast file system startup. - -Kirk McKusick, the developer of Berkeley FFS, solved this problem with Soft Updates. -All pending meta-data updates are kept in memory and written out to disk in a sorted sequence ("ordered meta-data updates"). -This has the effect that, in case of heavy meta-data operations, later updates to an item "catch" the earlier ones which are still in memory and have not already been written to disk. -All operations are generally performed in memory before the update is written to disk and the data blocks are sorted according to their position so that they will not be on the disk ahead of their meta-data. -If the system crashes, an implicit "log rewind" causes all operations which were not written to the disk appear as if they never happened. -A consistent file system state is maintained that appears to be the one of 30 to 60 seconds earlier. -The algorithm used guarantees that all resources in use are marked as such in their blocks and inodes. -After a crash, the only resource allocation error that occurs is that resources are marked as "used" which are actually "free". -man:fsck[8] recognizes this situation, and frees the resources that are no longer used. -It is safe to ignore the dirty state of the file system after a crash by forcibly mounting it with `mount -f`. -In order to free resources that may be unused, man:fsck[8] needs to be run at a later time. -This is the idea behind the _background man:fsck[8]_: at system startup time, only a _snapshot_ of the file system is recorded and man:fsck[8] is run afterwards. -All file systems can then be mounted "dirty", so the system startup proceeds in multi-user mode. -Then, background man:fsck[8] is scheduled for all file systems where this is required, to free resources that may be unused. -File systems that do not use Soft Updates still need the usual foreground man:fsck[8]. - -The advantage is that meta-data operations are nearly as fast as asynchronous updates and are faster than _logging_, which has to write the meta-data twice. -The disadvantages are the complexity of the code, a higher memory consumption, and some idiosyncrasies. -After a crash, the state of the file system appears to be somewhat "older". -In situations where the standard synchronous approach would have caused some zero-length files to remain after the man:fsck[8], these files do not exist at all with Soft Updates because neither the meta-data nor the file contents have been written to disk. -Disk space is not released until the updates have been written to disk, which may take place some time after running man:rm[1]. -This may cause problems when installing large amounts of data on a file system that does not have enough free space to hold all the files twice. - -[[configtuning-kernel-limits]] -== Tuning Kernel Limits - -[[file-process-limits]] -=== File/Process Limits - -[[kern-maxfiles]] -==== `kern.maxfiles` - -The `kern.maxfiles` man:sysctl[8] variable can be raised or lowered based upon system requirements. -This variable indicates the maximum number of file descriptors on the system. -When the file descriptor table is full, `file: table is full` will show up repeatedly in the system message buffer, which can be viewed using man:dmesg[8]. - -Each open file, socket, or fifo uses one file descriptor. -A large-scale production server may easily require many thousands of file descriptors, depending on the kind and number of services running concurrently. - -In older FreeBSD releases, the default value of `kern.maxfiles` is derived from `maxusers` in the kernel configuration file. -`kern.maxfiles` grows proportionally to the value of `maxusers`. -When compiling a custom kernel, consider setting this kernel configuration option according to the use of the system. -From this number, the kernel is given most of its pre-defined limits. -Even though a production machine may not have 256 concurrent users, the resources needed may be similar to a high-scale web server. - -The read-only man:sysctl[8] variable `kern.maxusers` is automatically sized at boot based on the amount of memory available in the system, and may be determined at run-time by inspecting the value of `kern.maxusers`. -Some systems require larger or smaller values of `kern.maxusers` and values of `64`, `128`, and `256` are not uncommon. -Going above `256` is not recommended unless a huge number of file descriptors is needed. -Many of the tunable values set to their defaults by `kern.maxusers` may be individually overridden at boot-time or run-time in [.filename]#/boot/loader.conf#. -Refer to man:loader.conf[5] and [.filename]#/boot/defaults/loader.conf# for more details and some hints. - -In older releases, the system will auto-tune `maxusers` if it is set to `0`. footnote:[The auto-tuning algorithm sets maxusers equal to the amount of memory in the system, with a minimum of 32, and a maximum of 384.]. -When setting this option, set `maxusers` to at least `4`, especially if the system runs Xorg or is used to compile software. -The most important table set by `maxusers` is the maximum number of processes, which is set to `20 + 16 * maxusers`. -If `maxusers` is set to `1`, there can only be `36` simultaneous processes, including the `18` or so that the system starts up at boot time and the `15` or so used by Xorg. -Even a simple task like reading a manual page will start up nine processes to filter, decompress, and view it. -Setting `maxusers` to `64` allows up to `1044` simultaneous processes, which should be enough for nearly all uses. -If, however, the error is displayed when trying to start another program, or a server is running with a large number of simultaneous users, increase the number and rebuild. +dev.cpu.0.cx_method: C1/mwait/hwc C2/mwait/hwc C3/mwait/hwc/bma +dev.cpu.0.cx_usage_counters: 3507294 0 0 +dev.cpu.0.cx_usage: 100.00% 0.00% 0.00% last 3804us +dev.cpu.0.cx_lowest: C3 <1> +dev.cpu.0.cx_supported: C1/1/1 C2/2/1 C3/3/57 <2> +dev.cpu.0.freq_levels: 2267/35000 2266/35000 1600/15000 800/12000 <3> +dev.cpu.0.freq: 1600 <4> +dev.cpu.0.temperature: 40.0C <5> +dev.cpu.0.coretemp.throttle_log: 0 +dev.cpu.0.coretemp.tjmax: 105.0C +dev.cpu.0.coretemp.resolution: 1 +dev.cpu.0.coretemp.delta: 65 +dev.cpu.0.%parent: acpi0 +dev.cpu.0.%pnpinfo: _HID=none _UID=0 _CID=none +dev.cpu.0.%location: handle=\_PR_.CPU0 +dev.cpu.0.%driver: cpu +dev.cpu.0.%desc: ACPI CPU +.... + +<1> Lowest Cx state to use for idling the CPU. +<2> CPU supported Cx states. +<3> Currently available levels for the CPU (frequency/power usage). +<4> Current active CPU frequency in MHz. +<5> Current temperature of the CPU. [NOTE] ==== -`maxusers` does _not_ limit the number of users which can log into the machine. -It instead sets various table sizes to reasonable values considering the maximum number of users on the system and how many processes each user will be running. +If the temperature information is not displayed, load the man:coretemp[4] module. +In case of using an AMD CPU, load the man:amdtemp[4] module. ==== -==== `kern.ipc.soacceptqueue` - -The `kern.ipc.soacceptqueue` man:sysctl[8] variable limits the size of the listen queue for accepting new `TCP` connections. -The default value of `128` is typically too low for robust handling of new connections on a heavily loaded web server. -For such environments, it is recommended to increase this value to `1024` or higher. -A service such as man:sendmail[8], or Apache may itself limit the listen queue size, but will often have a directive in its configuration file to adjust the queue size. -Large listen queues do a better job of avoiding Denial of Service (DoS) attacks. - -[[nmbclusters]] -=== Network Limits - -The `NMBCLUSTERS` kernel configuration option dictates the amount of network Mbufs available to the system. -A heavily-trafficked server with a low number of Mbufs will hinder performance. -Each cluster represents approximately 2 K of memory, so a value of `1024` represents `2` megabytes of kernel memory reserved for network buffers. -A simple calculation can be done to figure out how many are needed. -A web server which maxes out at `1000` simultaneous connections where each connection uses a 6 K receive and 16 K send buffer, requires approximately 32 MB worth of network buffers to cover the web server. -A good rule of thumb is to multiply by `2`, so 2x32 MB / 2 KB = 64 MB / 2 kB = `32768`. -Values between `4096` and `32768` are recommended for machines with greater amounts of memory. -Never specify an arbitrarily high value for this parameter as it could lead to a boot time crash. -To observe network cluster usage, use `-m` with man:netstat[1]. - -The `kern.ipc.nmbclusters` loader tunable should be used to tune this at boot time. -Only older versions of FreeBSD will require the use of the `NMBCLUSTERS` kernel man:config[8] option. +Once the CPU information is available the easiest way to configure power saving is to let man:powerd[8] take over. -For busy servers that make extensive use of the man:sendfile[2] system call, it may be necessary to increase the number of man:sendfile[2] buffers via the `NSFBUFS` kernel configuration option or by setting its value in [.filename]#/boot/loader.conf# (see man:loader[8] for details). -A common indicator that this parameter needs to be adjusted is when processes are seen in the `sfbufa` state. -The man:sysctl[8] variable `kern.ipc.nsfbufs` is read-only. -This parameter nominally scales with `kern.maxusers`, however it may be necessary to tune accordingly. - -[IMPORTANT] -==== -Even though a socket has been marked as non-blocking, calling man:sendfile[2] on the non-blocking socket may result in the man:sendfile[2] call blocking until enough ``struct sf_buf``'s are made available. -==== - -==== `net.inet.ip.portrange.*` - -The `net.inet.ip.portrange.*` man:sysctl[8] variables control the port number ranges automatically bound to `TCP` and `UDP` sockets. -There are three ranges: a low range, a default range, and a high range. -Most network programs use the default range which is controlled by `net.inet.ip.portrange.first` and `net.inet.ip.portrange.last`, which default to `1024` and `5000`, respectively. -Bound port ranges are used for outgoing connections and it is possible to run the system out of ports under certain circumstances. -This most commonly occurs when running a heavily loaded web proxy. -The port range is not an issue when running a server which handles mainly incoming connections, such as a web server, or has a limited number of outgoing connections, such as a mail relay. -For situations where there is a shortage of ports, it is recommended to increase `net.inet.ip.portrange.last` modestly. -A value of `10000`, `20000` or `30000` may be reasonable. Consider firewall effects when changing the port range. -Some firewalls may block large ranges of ports, usually low-numbered ports, and expect systems to use higher ranges of ports for outgoing connections. -For this reason, it is not recommended that the value of `net.inet.ip.portrange.first` be lowered. - -=== Virtual Memory - -==== `kern.maxvnodes` - -A vnode is the internal representation of a file or directory. -Increasing the number of vnodes available to the operating system reduces disk I/O. -Normally, this is handled by the operating system and does not need to be changed. -In some cases where disk I/O is a bottleneck and the system is running out of vnodes, this setting needs to be increased. -The amount of inactive and free RAM will need to be taken into account. - -To see the current number of vnodes in use: +Enable man:powerd[8] service in [.filename]#/etc/rc.conf# to start at system boot: [source,shell] .... -# sysctl vfs.numvnodes -vfs.numvnodes: 91349 +# sysrc powerd_enable=YES .... -To see the maximum vnodes: +It will also be necessary to indicate certain parameters to man:powerd[8] to tell it how to manage the state of the CPU executing the following command: [source,shell] .... -# sysctl kern.maxvnodes -kern.maxvnodes: 100000 +# sysrc powerd_flags="-a hiadaptive -i 25 -r 85 -N" .... -If the current vnode usage is near the maximum, try increasing `kern.maxvnodes` by a value of `1000`. -Keep an eye on the number of `vfs.numvnodes`. -If it climbs up to the maximum again, `kern.maxvnodes` will need to be increased further. -Otherwise, a shift in memory usage as reported by man:top[1] should be visible and more memory should be active. +. `-a`: Selects the mode to use while on AC power. +. `hiadaptive`: Operation mode. More info at man:powerd[8]. +. `-i`: Specifies the CPU load percent level when adaptive mode should begin to degrade performance to save power. +. `-r`: Specifies the CPU load percent level where adaptive mode should consider the CPU running and increase performance. +. `-N`: Treat "nice" time as idle for the purpose of load calculation; i.e., do not increase the CPU frequency if the CPU is only busy with "nice" processes. -[[adding-swap-space]] -== Adding Swap Space +And then enable the service executing the following command: -Sometimes a system requires more swap space. -This section describes two methods to increase swap space: adding swap to an existing partition or new hard drive, and creating a swap file on an existing partition. +[source,shell] +.... +# service powerd start +.... -For information on how to encrypt swap space, which options exist, and why it should be done, refer to crossref:disks[swap-encrypting,“Encrypting Swap”]. +[[cpufreq]] +=== CPU Frequency Control -[[new-drive-swap]] -=== Swap on a New Hard Drive or Existing Partition +FreeBSD includes a generic man:cpufreq[4] driver to allow the administrator, or software such as man:powerd[8] and package:sysutils/powerdxx[], to manage the frequency of the CPU to achieve the desired balance between performance and economy. +A lower setting will save power while reducing the heat generated by the CPU. +A higher setting will increase performance at the cost of using additional power and generating more heat. + +[[est]] +=== Intel(R) Enhanced Speed Step(TM) -Adding a new hard drive for swap gives better performance than using a partition on an existing drive. -Setting up partitions and hard drives is explained in crossref:disks[disks-adding,“Adding Disks”] while crossref:bsdinstall[configtuning-initial,“Designing the Partition Layout”] discusses partition layouts and swap partition size considerations. +The Intel(R) Enhanced Speed Step(TM) driver, man:est[4], replaces the generic man:cpufreq[4] driver for CPUs that provide this feature. +The CPU frequency can be statically adjusted using man:sysctl[8], or with the `/etc/rc.d/power_profile` startup script. +Additional software, such as man:powerd[8] or package:sysutils/powerdxx[], can be used to automatically adjust the CPU frequency based on processor utilization. -Use `swapon` to add a swap partition to the system. -For example: +Each supported frequency, along with its expected power consumption, can be listed by examining the man:sysctl[3] tree: [source,shell] .... -# swapon /dev/ada1s1b +# sysctl dev.cpufreq.0.freq_driver dev.cpu.0.freq_levels dev.cpu.0.freq .... -[WARNING] -==== - -It is possible to use any partition not currently mounted, even if it already contains data. -Using `swapon` on a partition that contains data will overwrite and destroy that data. -Make sure that the partition to be added as swap is really the intended partition before running `swapon`. -==== - -To automatically add this swap partition on boot, add an entry to [.filename]#/etc/fstab#: +The output should be similar to the following: [.programlisting] .... -/dev/ada1s1b none swap sw 0 0 +dev.cpufreq.0.freq_driver: est0 +dev.cpu.0.freq_levels: 3001/53000 3000/53000 2900/50301 2700/46082 2600/43525 2400/39557 2300/37137 2100/33398 2000/31112 1800/27610 1700/25455 1500/22171 1400/20144 1200/17084 1100/15181 900/12329 800/10550 +dev.cpu.0.freq: 800 .... -See man:fstab[5] for an explanation of the entries in [.filename]#/etc/fstab#. -More information about `swapon` can be found in man:swapon[8]. +A frequency 1 MHz higher than the maximum frequency of the CPU indicates the Intel(R) Turbo Boost(TM) feature. -[[create-swapfile]] -=== Creating a Swap File +[[hwpstate_intel]] +=== Intel Speed Shift(TM) -These examples create a 512M swap file called [.filename]#/usr/swap0# instead of using a partition. +Users running newer Intel(R) CPUs may find some differences in dynamic frequency control when upgrading to FreeBSD 13. +A new driver for the Intel(R) Speed Shift(TM) feature set, available on certain SKUs, exposes the ability for the hardware to dynamically vary the core frequencies, including on a per core basis. +FreeBSD 13 comes with the man:hwpstate_intel[4] driver to automatically enable Speed Shift(TM) control on equipped CPUs, replacing the older Enhanced Speed Step(TM) man:est[4] driver. +The man:sysctl[8] `dev.cpufreq.%d.freq_driver` will indicate if the system is using Speed Shift. -Using swap files requires that the module needed by man:md[4] has either been built into the kernel or has been loaded before swap is enabled. -See crossref:kernelconfig[kernelconfig,Configuring the FreeBSD Kernel] for information about building a custom kernel. +To determine which frequency control driver is being used, examining the `dev.cpufreq.0.freq_driver` oid. -[[swapfile-10-and-later]] -.Creating a Swap File -[example] -==== -[.procedure] -. Create the swap file: -+ [source,shell] .... -# dd if=/dev/zero of=/usr/swap0 bs=1m count=512 +# sysctl dev.cpufreq.0.freq_driver .... -. Set the proper permissions on the new file: -+ -[source,shell] -.... -# chmod 0600 /usr/swap0 -.... +The output should be similar to the following: -. Inform the system about the swap file by adding a line to [.filename]#/etc/fstab#: -+ [.programlisting] .... -md none swap sw,file=/usr/swap0,late 0 0 +dev.cpufreq.0.freq_driver: hwpstate_intel0 .... -+ -. Swap space will be added on system startup. To add swap space immediately, use man:swapon[8]: -+ + +This indicates that the new man:hwpstate_intel[4] driver is in use. +On such systems, the oid `dev.cpu.%d.freq_levels` will show only the maximum CPU frequency, and will indicate a power consumption level of `-1`. + +The current CPU frequency can be determined by examining the `dev.cpu.%d.freq` oid. + [source,shell] .... -# swapon -aL +# sysctl dev.cpu.0.freq_levels dev.cpu.0.freq .... -==== - -[[acpi-overview]] -== Power and Resource Management - -It is important to utilize hardware resources in an efficient manner. -Power and resource management allows the operating system to monitor system limits and to possibly provide an alert if the system temperature increases unexpectedly. -An early specification for providing power management was the Advanced Power Management (APM) facility. -APM controls the power usage of a system based on its activity. -However, it was difficult and inflexible for operating systems to manage the power usage and thermal properties of a system. -The hardware was managed by the BIOS and the user had limited configurability and visibility into the power management settings. -The APMBIOS is supplied by the vendor and is specific to the hardware platform. -An APM driver in the operating system mediates access to the APM Software Interface, which allows management of power levels. - -There are four major problems in APM. -First, power management is done by the vendor-specific BIOS, separate from the operating system. -For example, the user can set idle-time values for a hard drive in the APMBIOS so that, when exceeded, the BIOS spins down the hard drive without the consent of the operating system. -Second, the APM logic is embedded in the BIOS, and it operates outside the scope of the operating system. -This means that users can only fix problems in the APMBIOS by flashing a new one into the ROM, which is a dangerous procedure with the potential to leave the system in an unrecoverable state if it fails. -Third, APM is a vendor-specific technology, meaning that there is a lot of duplication of efforts and bugs found in one vendor's BIOS may not be solved in others. -Lastly, the APMBIOS did not have enough room to implement a sophisticated power policy or one that can adapt well to the purpose of the machine. - -The Plug and Play BIOS (PNPBIOS) was unreliable in many situations. -PNPBIOS is 16-bit technology, so the operating system has to use 16-bit emulation in order to interface with PNPBIOS methods. -FreeBSD provides an APM driver as APM should still be used for systems manufactured at or before the year 2000. -The driver is documented in man:apm[4]. - -The successor to APM is the Advanced Configuration and Power Interface (ACPI). -ACPI is a standard written by an alliance of vendors to provide an interface for hardware resources and power management. -It is a key element in _Operating System-directed configuration and Power Management_ as it provides more control and flexibility to the operating system. - -This chapter demonstrates how to configure ACPI on FreeBSD. -It then offers some tips on how to debug ACPI and how to submit a problem report containing debugging information so that developers can diagnosis and fix ACPI issues. +The output should be similar to the following: -[[acpi-config]] -=== Configuring ACPI +[.programlisting] +.... +dev.cpu.0.freq_levels: 3696/-1 +dev.cpu.0.freq: 898 +.... -In FreeBSD the man:acpi[4] driver is loaded by default at system boot and should _not_ be compiled into the kernel. -This driver cannot be unloaded after boot because the system bus uses it for various hardware interactions. -However, if the system is experiencing problems, ACPI can be disabled altogether by rebooting after setting `hint.acpi.0.disabled="1"` in [.filename]#/boot/loader.conf# or by setting this variable at the loader prompt, as described in crossref:boot[boot-loader,“Stage Three”]. +For more information, including on how to balance performance and energy use, and on how to disable this driver, refer to the man page man:hwpstate_intel[4]. [NOTE] ==== -ACPI and APM cannot coexist and should be used separately. -The last one to load will terminate if the driver notices the other is running. +Users accustomed to using man:powerd[8] or package:sysutils/powerdxx[] will find these utilities have been superseded by the man:hwpstate_intel[4] driver and no longer work as expected. ==== -ACPI can be used to put the system into a sleep mode with `acpiconf`, the `-s` flag, and a number from `1` to `5`. -Most users only need `1` (quick suspend to RAM) or `3` (suspend to RAM). -Option `5` performs a soft-off which is the same as running `halt -p`. +[[graphics-card-power-management]] +=== Graphics Card Power Management -The man:acpi_video[4] driver uses link:https://uefi.org/specs/ACPI/6.4/Apx_B_Video_Extensions/Apx_B_Video_Extensions.html[ACPI Video Extensions] to control display switching and backlight brightness. -It must be loaded after any of the DRM kernel modules. -After loading the driver, the kbd:[Fn] brightness keys will change the brightness of the screen. -It is possible to check the ACPI events by inspecting [.filename]#/var/run/devd.pipe#: +Graphics cards have become a fundamental part of computing in recent years. +Some graphics cards may have excessive power consumption. +FreeBSD allows certain configurations to improve power consumption. -[source,shell] -... -# cat /var/run/devd.pipe -!system=ACPI subsystem=Video type=brightness notify=62 -!system=ACPI subsystem=Video type=brightness notify=63 -!system=ACPI subsystem=Video type=brightness notify=64 -... +In case of using a Intel(R) graphics card with the package:graphics/drm-kmod[] driver these options can be added to [.filename]#/boot/loader.conf#: -Other options are available using `sysctl`. -Refer to man:acpi[4] and man:acpiconf[8] for more information. +[.programlisting] +.... +compat.linuxkpi.fastboot=1 <.> +compat.linuxkpi.enable_dc=2 <.> +compat.linuxkpi.enable_fbc=1 <.> +.... -[[ACPI-comprob]] -=== Common Problems +<.> Try to skip unnecessary mode sets at boot time. +<.> Enable power-saving display C-states. +<.> Enable frame buffer compression for power savings -ACPI is present in all modern computers that conform to the ia32 (x86) and amd64 (AMD) architectures. -The full standard has many features including CPU performance management, power planes control, thermal zones, various battery systems, embedded controllers, and bus enumeration. -Most systems implement less than the full standard. -For instance, a desktop system usually only implements bus enumeration while a laptop might have cooling and battery management support as well. -Laptops also have suspend and resume, with their own associated complexity. +=== Suspend/Resume -An ACPI-compliant system has various components. -The BIOS and chipset vendors provide various fixed tables, such as FADT, in memory that specify things like the APIC map (used for SMP), config registers, and simple configuration values. -Additionally, a bytecode table, the Differentiated System Description Table DSDT, specifies a tree-like name space of devices and methods. +The suspend/resume function allows the machine to be kept in a state in which there is no a big energy consumption and allows the system to be resumed without having to lose the state of the running programs. -The ACPI driver must parse the fixed tables, implement an interpreter for the bytecode, and modify device drivers and the kernel to accept information from the ACPI subsystem. -For FreeBSD, Intel(R) has provided an interpreter (ACPI-CA) that is shared with Linux(R) and NetBSD. -The path to the ACPI-CA source code is [.filename]#src/sys/contrib/dev/acpica#. -The glue code that allows ACPI-CA to work on FreeBSD is in [.filename]#src/sys/dev/acpica/Osd#. -Finally, drivers that implement various ACPI devices are found in [.filename]#src/sys/dev/acpica#. +[NOTE] +==== +In order for the suspend/resume functionality to work correctly the graphics drivers must be loaded on the system. +In non-KMS-supported graphics cards man:sc[4] must be used not to break the suspend/resume functionality. -For ACPI to work correctly, all the parts have to work correctly. -Here are some common problems, in order of frequency of appearance, and some possible workarounds or fixes. -If a fix does not resolve the issue, refer to <<ACPI-submitdebug>> for instructions on how to submit a bug report. +More information about which driver to use and how to configure it can be found at the crossref:x11[x11, The X Window System chapter]. +==== -==== Mouse Issues +man:acpi[4] supports the next list of sleep states: -In some cases, resuming from a suspend operation will cause the mouse to fail. -A known work around is to add `hint.psm.0.flags="0x3000"` to [.filename]#/boot/loader.conf#. +.Supported Sleep States +[options="header", cols="1,1"] +|=== -==== Suspend/Resume +|S1 +|Quick suspend to RAM. The CPU enters a lower power state, but most peripherals are left running. -ACPI has three suspend to RAM (STR) states, `S1`-`S3`, and one suspend to disk state (STD), called `S4`. -STD can be implemented in two separate ways. -The ``S4``BIOS is a BIOS-assisted suspend to disk and ``S4``OS is implemented entirely by the operating system. -The normal state the system is in when plugged in but not powered up is "soft off" (`S5`). +|S2 +|Lower power state than S1, but with the same basic characteristics. Not supported by many systems. -Use `sysctl hw.acpi` to check for the suspend-related items. -These example results are from a Thinkpad: +|S3 (Sleep mode) +|Suspend to RAM. Most devices are powered off, and the system stops running except for memory refresh. -[source,shell] -.... -hw.acpi.supported_sleep_state: S3 S4 S5 -hw.acpi.s4bios: 0 -.... +|S4 (Hibernation) +|Suspend to disk. All devices are powered off, and the system stops running. When resuming, the system starts as if from a cold power on. *Not yet supported by FreeBSD*. + +|S5 +|System shuts down cleanly and powers off. -Use `acpiconf -s` to test `S3`, `S4`, and `S5`. -An `s4bios` of one (`1`) indicates ``S4``BIOS support instead of `S4` operating system support. +|=== -When testing suspend/resume, start with `S1`, if supported. -This state is most likely to work since it does not require much driver support. -No one has implemented `S2`, which is similar to `S1`. -Next, try `S3`. -This is the deepest STR state and requires a lot of driver support to properly reinitialize the hardware. +[[configure-suspend-resume]] +==== Configuring Suspend/Resume -A common problem with suspend/resume is that many device drivers do not save, restore, or reinitialize their firmware, registers, or device memory properly. -As a first attempt at debugging the problem, try: +The first step will be to know which type of sleep states supports the hardware we are using executing the following command: [source,shell] .... -# sysctl debug.bootverbose=1 -# sysctl debug.acpi.suspend_bounce=1 -# acpiconf -s 3 +% sysctl hw.acpi.supported_sleep_state .... -This test emulates the suspend/resume cycle of all device drivers without actually going into `S3` state. -In some cases, problems such as losing firmware state, device watchdog time out, and retrying forever, can be captured with this method. -Note that the system will not really enter `S3` state, which means devices may not lose power, and many will work fine even if suspend/resume methods are totally missing, unlike real `S3` state. - -If the previous test worked, on a laptop it is possible to configure the system to suspend into `S3` on lid close and resume when it is open back again: +The output should be similar to the following: -[source,shell] +[.programlisting] .... -# sysctl hw.acpi.lid_switch_state=S3 +hw.acpi.supported_sleep_state: S3 S4 S5 .... -This change can be made persistent across reboots: +[WARNING] +==== +As stated above FreeBSD does *not* yet support the `S4` state. +==== + +man:acpiconf[8] can be used to check if the `S3` state works correctly by running the following command, if it succeeds, the screen should go black and the machine will turn off: [source,shell] .... -# echo 'hw.acpi.lid_switch_state=S3' >> /etc/sysctl.conf +# acpiconf -s 3 .... -Harder cases require additional hardware, such as a serial port and cable for debugging through a serial console, a Firewire port and cable for using man:dcons[4], and kernel debugging skills. +In the vast majority of cases the Suspend/Resume functionality wants to be used on a laptop. -To help isolate the problem, unload as many drivers as possible. -If it works, narrow down which driver is the problem by loading drivers until it fails again. -Typically, binary drivers like [.filename]#nvidia.ko#, display drivers, and USB will have the most problems while Ethernet interfaces usually work fine. -If drivers can be properly loaded and unloaded, automate this by putting the appropriate commands in [.filename]#/etc/rc.suspend# and [.filename]#/etc/rc.resume#. -Try setting `hw.acpi.reset_video` to `1` if the display is messed up after resume. -Try setting longer or shorter values for `hw.acpi.sleep_delay` to see if that helps. +FreeBSD can be configured to enter the `S3` state when closing the lid by adding the following line to the [.filename]#/etc/sysctl.conf# file. -Try loading a recent Linux(R) distribution to see if suspend/resume works on the same hardware. -If it works on Linux(R), it is likely a FreeBSD driver problem. -Narrowing down which driver causes the problem will assist developers in fixing the problem. -Since the ACPI maintainers rarely maintain other drivers, such as sound or ATA, any driver problems should also be posted to the {freebsd-current} and mailed to the driver maintainer. -Advanced users can include debugging man:printf[3]s in a problematic driver to track down where in its resume function it hangs. +[.programlisting] +.... +hw.acpi.lid_switch_state=S3 +.... -Finally, try disabling ACPI and enabling APM instead. -If suspend/resume works with APM, stick with APM, especially on older hardware (pre-2000). -It took vendors a while to get ACPI support correct and older hardware is more likely to have BIOS problems with ACPI. +[[troubleshooting-suspend-resume]] +==== Troubleshooting in Suspend/Resume -==== System Hangs +A lot of effort has been made to make the Suspend and Resume functions work properly and in the best way on FreeBSD. +But currently the Suspend and Resume functions only work properly on some specific laptops. -Most system hangs are a result of lost interrupts or an interrupt storm. -Chipsets may have problems based on boot, how the BIOS configures interrupts before correctness of the APIC (MADT) table, and routing of the System Control Interrupt (SCI). +Some checks can be done in case it doesn't work properly. -Interrupt storms can be distinguished from lost interrupts by checking the output of `vmstat -i` and looking at the line that has `acpi0`. -If the counter is increasing at more than a couple per second, there is an interrupt storm. -If the system appears hung, try breaking to DDB (kbd:[CTRL+ALT+ESC] on console) and type `show interrupts`. +In some cases it is enough to turn off the bluetooth. +In others it is enough loading the correct driver for the graphics card, etc. -When dealing with interrupt problems, try disabling APIC support with `hint.apic.0.disabled="1"` in [.filename]#/boot/loader.conf#. +In case it doesn't work correctly, some tips can be found on the FreeBSD Wiki in the section link:https://wiki.freebsd.org/SuspendResume[Suspend/Resume]. -==== Panics +[[adding-swap-space]] +== Adding Swap Space -Panics are relatively rare for ACPI and are the top priority to be fixed. -The first step is to isolate the steps to reproduce the panic, if possible, and get a backtrace. -Follow the advice for enabling `options DDB` and setting up a serial console in crossref:serialcomms[serialconsole-ddb,“Entering the DDB Debugger from the Serial Line”] or setting up a dump partition. -To get a backtrace in DDB, use `tr`. -When handwriting the backtrace, get at least the last five and the top five lines in the trace. +Sometimes a FreeBSD system requires more swap space. +This section describes two methods to increase swap space: adding swap to an existing partition or new hard drive, and creating a swap file on an existing file system. -Then, try to isolate the problem by booting with ACPI disabled. -If that works, isolate the ACPI subsystem by using various values of `debug.acpi.disable`. -See man:acpi[4] for some examples. +For information on how to encrypt swap space, which options exist, and why it should be done, refer to crossref:disks[swap-encrypting,“Encrypting Swap”]. -==== System Powers Up After Suspend or Shutdown +[[new-drive-swap]] +=== Swap on a New Hard Drive or Existing Partition -First, try setting `hw.acpi.disable_on_poweroff="0"` in [.filename]#/boot/loader.conf#. -This keeps ACPI from disabling various events during the shutdown process. -Some systems need this value set to `1` (the default) for the same reason. -This usually fixes the problem of a system powering up spontaneously after a suspend or poweroff. +Adding a new drive for swap gives better performance than using a partition on an existing drive. +Setting up partitions and drives is explained in crossref:disks[disks-adding,"Adding Disks"] while crossref:bsdinstall[configtuning-initial,"Designing the Partition Layout"] discusses partition layouts and swap partition size considerations. -[[ACPI-aslanddump]] -==== BIOS Contains Buggy Bytecode +[WARNING] +==== +It is possible to use any partition not currently mounted, even if it already contains data. +Using `swapon` on a partition that contains data will overwrite and destroy that data. +Make sure that the partition to be added as swap is really the intended partition before running `swapon`. +==== -Some BIOS vendors provide incorrect or buggy bytecode. -This is usually manifested by kernel console messages like this: +man:swapon[8] can be used to add a swap partition to the system executing the following command: [source,shell] .... -ACPI-1287: *** Error: Method execution failed [\\_SB_.PCI0.LPC0.FIGD._STA] \\ -(Node 0xc3f6d160), AE_NOT_FOUND +# swapon /dev/ada1p2 .... -Often, these problems may be resolved by updating the BIOS to the latest revision. -Most console messages are harmless, but if there are other problems, like the battery status is not working, these messages are a good place to start looking for problems. - -=== Overriding the Default AML - -The BIOS bytecode, known as ACPI Machine Language (AML), is compiled from a source language called ACPI Source Language (ASL). -The AML is found in the table known as the Differentiated System Description Table (DSDT). - -The goal of FreeBSD is for everyone to have working ACPI without any user intervention. -Workarounds are still being developed for common mistakes made by BIOS vendors. -The Microsoft(R) interpreter ([.filename]#acpi.sys# and [.filename]#acpiec.sys#) does not strictly check for adherence to the standard, and thus many BIOS vendors who only test ACPI under Windows(R) never fix their ASL. -FreeBSD developers continue to identify and document which non-standard behavior is allowed by Microsoft(R)'s interpreter and replicate it so that FreeBSD can work without forcing users to fix the ASL. - -To help identify buggy behavior and possibly fix it manually, a copy can be made of the system's ASL. -To copy the system's ASL to a specified file name, use `acpidump` with `-t`, to show the contents of the fixed tables, and `-d`, to disassemble the AML: +To automatically add this swap partition on boot, add an entry to [.filename]#/etc/fstab#: -[source,shell] +[.programlisting] .... -# acpidump -td > my.asl +/dev/ada1p2 none swap sw 0 0 .... -Some AML versions assume the user is running Windows(R). -To override this, set `hw.acpi.osname=_"Windows 2009"_` in [.filename]#/boot/loader.conf#, using the most recent Windows(R) version listed in the ASL. +See man:fstab[5] for an explanation of the entries in [.filename]#/etc/fstab#. -Other workarounds may require [.filename]#my.asl# to be customized. -If this file is edited, compile the new ASL using the following command. -Warnings can usually be ignored, but errors are bugs that will usually prevent ACPI from working correctly. +[[create-swapfile]] +=== Creating a Swap File -[source,shell] -.... -# iasl -f my.asl -.... +[[swapfile-10-and-later]] +These examples create a 512M swap file called [.filename]#/usr/swap0#. -Including `-f` forces creation of the AML, even if there are errors during compilation. -Some errors, such as missing return statements, are automatically worked around by the FreeBSD interpreter. +[WARNING] +==== +Swap files on ZFS file systems are strongly discouraged, as swapping can lead to system hangs. +==== -The default output filename for `iasl` is [.filename]#DSDT.aml#. -Load this file instead of the BIOS's buggy copy, which is still present in flash memory, by editing [.filename]#/boot/loader.conf# as follows: +The first step is to create the swap file: -[.programlisting] +[source,shell] .... -acpi_dsdt_load="YES" -acpi_dsdt_name="/boot/DSDT.aml" +# dd if=/dev/zero of=/usr/swap0 bs=1m count=512 .... -Be sure to copy [.filename]#DSDT.aml# to [.filename]#/boot#, then reboot the system. -If this fixes the problem, send a man:diff[1] of the old and new ASL to {freebsd-acpi} so that developers can work around the buggy behavior in [.filename]#acpica#. - -[[ACPI-submitdebug]] -=== Getting and Submitting Debugging Info - -The ACPI driver has a flexible debugging facility. A set of subsystems and the level of verbosity can be specified. -The subsystems to debug are specified as layers and are broken down into components (`ACPI_ALL_COMPONENTS`) and ACPI hardware support (`ACPI_ALL_DRIVERS`). -The verbosity of debugging output is specified as the level and ranges from just report errors (`ACPI_LV_ERROR`) to everything (`ACPI_LV_VERBOSE`). -The level is a bitmask so multiple options can be set at once, separated by spaces. -In practice, a serial console should be used to log the output so it is not lost as the console message buffer flushes. -A full list of the individual layers and levels is found in man:acpi[4]. - -Debugging output is not enabled by default. To enable it, add `options ACPI_DEBUG` to the custom kernel configuration file if ACPI is compiled into the kernel. -Add `ACPI_DEBUG=1` to [.filename]#/etc/make.conf# to enable it globally. -If a module is used instead of a custom kernel, recompile just the [.filename]#acpi.ko# module as follows: +The second step is to put the proper permissions on the new file: [source,shell] .... -# cd /sys/modules/acpi/acpi && make clean && make ACPI_DEBUG=1 +# chmod 0600 /usr/swap0 .... -Copy the compiled [.filename]#acpi.ko# to [.filename]#/boot/kernel# and add the desired level and layer to [.filename]#/boot/loader.conf#. -The entries in this example enable debug messages for all ACPI components and hardware drivers and output error messages at the least verbose level: +The third step is to inform the system about the swap file by adding a line to [.filename]#/etc/fstab#: [.programlisting] .... -debug.acpi.layer="ACPI_ALL_COMPONENTS ACPI_ALL_DRIVERS" -debug.acpi.level="ACPI_LV_ERROR" +md none swap sw,file=/usr/swap0,late 0 0 .... -If the required information is triggered by a specific event, such as a suspend and then resume, do not modify [.filename]#/boot/loader.conf#. -Instead, use `sysctl` to specify the layer and level after booting and preparing the system for the specific event. -The variables which can be set using `sysctl` are named the same as the tunables in [.filename]#/boot/loader.conf#. - -Once the debugging information is gathered, it can be sent to {freebsd-acpi} so that it can be used by the FreeBSD ACPI maintainers to identify the root cause of the problem and to develop a solution. +Swap space will be added on system startup. To add swap space immediately, use man:swapon[8]: -[NOTE] -==== -Before submitting debugging information to this mailing list, ensure the latest BIOS version is installed and, if available, the embedded controller firmware version. -==== - -When submitting a problem report, include the following information: - -* Description of the buggy behavior, including system type, model, and anything that causes the bug to appear. Note as accurately as possible when the bug began occurring if it is new. -* The output of `dmesg` after running `boot -v`, including any error messages generated by the bug. -* The `dmesg` output from `boot -v` with ACPI disabled, if disabling ACPI helps to fix the problem. -* Output from `sysctl hw.acpi`. This lists which features the system offers. -* The URL to a pasted version of the system's ASL. Do _not_ send the ASL directly to the list as it can be very large. Generate a copy of the ASL by running this command: -+ [source,shell] .... -# acpidump -dt > name-system.asl +# swapon -aL .... -+ -Substitute the login name for _name_ and manufacturer/model for _system_. -For example, use [.filename]#njl-FooCo6000.asl#. - -Most FreeBSD developers watch the {freebsd-current}, but one should submit problems to {freebsd-acpi} to be sure it is seen. -Be patient when waiting for a response. -If the bug is not immediately apparent, submit a bug report. -When entering a PR, include the same information as requested above. -This helps developers to track the problem and resolve it. -Do not send a PR without emailing {freebsd-acpi} first as it is likely that the problem has been reported before. - -[[ACPI-References]] -=== References - -More information about ACPI may be found in the following locations: - -* The FreeBSD ACPI Mailing List Archives (https://lists.freebsd.org/pipermail/freebsd-acpi/[https://lists.freebsd.org/pipermail/freebsd-acpi/]) -* The ACPI 2.0 Specification (http://acpi.info/spec.htm[http://acpi.info/spec.htm]) -* man:acpi[4], man:acpi_thermal[4], man:acpidump[8], man:iasl[8], and man:acpidb[8] |