Ensure Appropriate System Resource Limits Are Configured

中级别 1自动化tdsql

说明

Operating system resource limits (ulimits) should be properly configured for TDSQL processes, particularly the number of open file descriptors, maximum processes, and memory locking. Passes when /etc/security/limits.conf or limits.d sets hard nofile and nproc limits of at least 65535 for the tdsql user (the benchmark baseline). For systemd-managed components also confirm LimitNOFILE/LimitNPROC in the unit.

检查方式

审计方法: Shell 命令

shell

out=$(cat /etc/security/limits.conf /etc/security/limits.d/*.conf 2>/dev/null) || exit 1; printf '%s\n' "$out" | awk '$1 == "tdsql" && $2 == "hard" && $3 == "nofile" && ($4 == "unlimited" || $4 + 0 >= 65535) {f++} $1 == "tdsql" && $2 == "hard" && $3 == "nproc" && ($4 == "unlimited" || $4 + 0 >= 65535) {p++} END {print (f && p) ? "compliant" : "noncompliant"}'

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

Add to /etc/security/limits.conf: tdsql soft nofile 65535; tdsql hard nofile 65535; tdsql soft nproc 65535; tdsql hard nproc 65535; tdsql soft memlock unlimited; tdsql hard memlock unlimited; then restart the components.

属性

操作系统: 任意
标签: tdsqlos
参考: CIS Tencent TDSQL 10.3.22 Benchmark v1.0.0 - 1.9 Ensure Appropriate System Resource Limits Are Configured

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target tdsql