bitflicker64 commented on code in PR #3360:
URL: https://github.com/apache/hugegraph/pull/3360#discussion_r4298177816
##########
hugegraph-server/hugegraph-dist/src/assembly/static/bin/util.sh:
##########
@@ -16,6 +16,51 @@
# limitations under the License.
#
+function record_jvm_startup_diagnostics() {
+ JVM_STARTUP_TIME=$(date -u +'%Y-%m-%d %H:%M:%S.%N UTC')
+ JVM_STARTUP_LOG_OFFSET=$(stat -c %s ./logs/hugegraph-server.log
2>/dev/null || echo 0)
+}
+
+function print_jvm_thread_hint() {
+ local kind
+ kind=$(awk '
+ /pthread_create.*\(EPERM\)|pthread_create.*Operation not permitted/ {
denied = 1 }
+ /[Tt]hread.*Operation not permitted/ { denied = 1 }
+ /Cannot create worker GC thread/ { resources = 1 }
+ END { if (denied) print "denied"; else if (resources) print
"resources" }
+ ')
+ case "$kind" in
+ denied)
+ echo 'ERROR: JVM thread creation was denied (EPERM). Check the
Docker host seccomp profile and security policy.' >&2
+ echo 'To diagnose seccomp restrictions, retry with --security-opt
seccomp=unconfined; use a compatible host/runtime profile for normal
operation.' >&2
+ ;;
+ resources)
+ echo 'ERROR: JVM could not create a GC worker thread. Possible
causes include seccomp denial, insufficient memory, or process/thread limits.'
>&2
+ echo 'Look for pthread_create failed (EPERM) above in the
container log; if present, check the host seccomp profile and security policy.'
>&2
Review Comment:
Minor: With `STDOUT_MODE=false` this hint sends users to the wrong place,
and the EPERM-specific hint can never fire from the entrypoint.
`hugegraph-server.sh:374` appends the JVM's stdout and stderr to
`logs/hugegraph-server-stdout.log` when `STDOUT_MODE` is not `true`. HotSpot's
`pthread_create failed (EPERM)` warning then lands in that file, not in the
container log that line 39 points to. The log scan below reads only
`logs/hugegraph-server.log`, which holds log4j output and launcher errors and
never receives HotSpot's stdout. It also runs only after the crash-file loop,
which returns on the generic `Cannot create worker GC thread` header first.
I ran `record_jvm_startup_diagnostics`, wrote the real HotSpot EPERM warning
to `logs/hugegraph-server-stdout.log` and the generic header to a new
`logs/hs_err_pid42_<host>_<time>.log`, then called
`diagnose_jvm_startup_failure` (Linux, this head's `util.sh`). It printed the
generic hint with "Look for pthread_create failed (EPERM) above in the
container log". With the crash file removed it printed nothing.
Requested change: record the size of `logs/hugegraph-server-stdout.log` in
`record_jvm_startup_diagnostics` and scan its new bytes before the crash files,
so the `denied` branch is reached when the warning is in that file. If you'd
rather not, make line 39 name `logs/hugegraph-server-stdout.log` for the
`STDOUT_MODE=false` case. Either way, add a fixture for that mode.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
