minor service config optimizations

jelmd · Jan 26, 2022 · 6ff11ca · 6ff11ca
1 parent 62c3dd2
commit 6ff11ca
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 3 deletions.
diff --git a/etc/nvmex.service b/etc/nvmex.service
@@ -3,12 +3,13 @@
 [Unit]
 Description=Metrics exporter for Nvidia GPUs
 Documentation=man:nvmex(8)
-After=network.target auditd.service
+After=network.target auditd.service nvidia-persistenced.service
 Before=vmagent.service
 
 [Service]
 Type=forking
-# no special privileges are required
+# Except for nvmex_nvlink_traffic_bytes no special privileges are required.
+# So use an unprivileged user:
 User=daemon
 Group=daemon
 
@@ -22,5 +23,8 @@ ExecStart=/usr/sbin/nvmex -l %L/nvmex/nvmex.log -d $ARGS
 ExecStop=/bin/kill -s SIGTERM $MAINPID
 TimeoutSec=3
 
+MemoryLow=4M
+MemoryMin=2M
+
 [Install]
 WantedBy=multi-user.target
diff --git a/etc/nvmex.xml b/etc/nvmex.xml
@@ -44,7 +44,7 @@
 					However, file_dac_{read|write} are not sufficient, so
 					we need to run as root instead of webservd for now. -->
 				<method_credential user='root' group='webservd'
-					privileges='basic,net_privaddr,file_dac_read,file_dac_write'/>
+					privileges='basic,net_privaddr,file_dac_read,file_dac_write,{zone}:/var/log/nvmex.log'/>
 			</method_context>
 		</exec_method>