Linux Cgroup v2 Resource Limits: Auditing CPU, Memory, and I/O Controls

Understanding Cgroup v2

Control groups (cgroups) are a Linux kernel mechanism for organizing processes and enforcing resource limits. Cgroup v2 provides a unified hierarchy that simplifies resource management for containers, services, and user sessions.

Checking Cgroup Version

stat -fc %T /sys/fs/cgroup/
cat /sys/fs/cgroup/cgroup.controllers
mount | grep cgroup

System Slices

systemctl list-units --type=slice
systemd-cgls
cat /sys/fs/cgroup/system.slice/memory.current

Memory Limits

systemctl show nginx -p MemoryMax,MemoryCurrent
cat /sys/fs/cgroup/system.slice/nginx.service/memory.max
cat /sys/fs/cgroup/system.slice/nginx.service/memory.current

CPU Quotas

systemctl show nginx -p CPUQuotaPerSecUSec
cat /sys/fs/cgroup/system.slice/nginx.service/cpu.max
# Format: quota period (e.g., "50000 100000" = 50%)

I/O Controls

cat /sys/fs/cgroup/system.slice/nginx.service/io.max
cat /sys/fs/cgroup/system.slice/nginx.service/io.stat

Automated Auditing with dargslan-cgroup-audit

pip install dargslan-cgroup-audit
dargslan-cgroup-audit
dargslan-cgroup-audit --memory
dargslan-cgroup-audit --cpu
dargslan-cgroup-audit --slices