Seload script to run PAMSC seosd in real-time priority mode

Products

• CA Privileged Identity Management Endpoint (PIM)

Issue/Introduction

In order to have pamsc running in real-time priority mode. from Technical document https://broadcomcms-software.wolkenservicedesk.com/external/article?articleNumber=103209

PIM 14.X/PAM SC 14.X, you only need to make sure that native cgroup management binaries are installed (e.g., libcgroup-tools package on SLES) in the endpoint being configured with cgroups, as the steps that follow are already being put in place at installation time.

If for some reason this is not working, then you can add the below script

Environment

PAMSC 14.1 sp1

Cause

it is a MUST to have seosd working in real-time priority mode, sometimes it can be that in PAMSC seosd startup correctly set at installation time.

Resolution

Attached below the script as seload-script to distinguish it from seload.  It has to be put as seload into PIM's bin subdirectory.

First you should check from ls -l /opt/CA/PAMSC/bin/seload* on the Linux system in question.

The script is the following :

 

#!/bin/bash 
# -------------------------------------------------------------------------
# CA Privileged Access Manager Server Control v14.10-60
# Copyright (c) 2018 CA. All rights reserved.  
#    
#    
# VeRsIoN: 14.10-60 (85) Compiled On:Script
# -------------------------------------------------------------------------
# A script for starting PAMSC on Linux systems with or without cgroups.
# The seload binary is now referenced as seload-bin.
# -------------------------------------------------------------------------

SEOSDIR="/opt/CA/PAMSC" # AuTo_InSeRt_CoDe

# The name of hierarchy to associate PAMSC processes with
HIERARCHY=myrt

# If a hierarchy for PAMSC is preconfigured by cgconfig service at boot,
# the PERMANENT_HIERARCHY variable below can be set to yes.
PERMANENT_HIERARCHY=no

# Suggested real-time scheduling values for our hierarchy.  
# Please check https://www.kernel.org for details.
RT_RUNTIME_US=1000
RT_PERIOD_US=10000

if [ ! -x $SEOSDIR/bin/seload-bin ]; then
  SEOSDIR=`grep "^[ \t]*SEOSPATH *=" /etc/seos.ini 2>/dev/null | awk -F= '{print $2}' | awk '{print $1}'`
fi

if [ ! -x $SEOSDIR/bin/seload-bin ]; then
  echo "Cannot locate seload-bin binary.  Please check /etc/seos.ini"
  exit 1
fi

rm -f $SEOSDIR/lock/.cgexec_start 2>/dev/null

if [ ! -x /usr/bin/cgexec ]; then
  $SEOSDIR/bin/seload-bin
else
  if [ "$PERMANENT_HIERARCHY" != "yes" ]; then
     /usr/bin/cgcreate -g cpu:/$HIERARCHY
     /usr/bin/cgset -r cpu.rt_runtime_us=$RT_RUNTIME_US $HIERARCHY
     /usr/bin/cgset -r cpu.rt_period_us=$RT_PERIOD_US $HIERARCHY
  fi
  /usr/bin/cgexec -g cpu:/$HIERARCHY  $SEOSDIR/bin/seload-bin
  [ $? -eq 0 ] && touch $SEOSDIR/lock/.cgexec_start
fi
 

you should have the followoing layout/content in the PIM installation and make sure they have /usr/bin/cgexec binary on the system (on RHEL it should be in libcgroup-tools rpm)

/tmp> find /opt/CA/PAMSC/bin  -name 'seload*'
/opt/CA/PAMSC/bin/seload-bin                    <---  that is the renamed seload binary
/opt/CA/PAMSC/bin/seload                        <---  that is the above script

 

if everything is properly in place, you should have the following results upon PIM startup:

/tmp> ps -e -o pid,ppid,pri,rtprio,args | grep seos
9407     1 138     98 /opt/CA/PAMSC/bin/seosd
9426     1   1      - /opt/CA/PAMSC/bin/seoswd AGENT
9611  4233  19      - grep --color=auto seos

 

Please put it in order is used to start seos.

After you run it, please check that seosd is started correctly by running

ps -e -o pid,ppid,pri,rtprio,args | grep seosd

and be sure the output you get is the above one, if not, open a case in support