pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedStatistics collector port / unix dom. socket?
6+ messages / 3 participants
[nested] [flat]
* Statistics collector port / unix dom. socket?
@ 2010-05-04 12:56 Peter Sabaini <peter.sabaini@ait.ac.at>
2010-05-04 15:39 ` Re: Statistics collector port / unix dom. socket? Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 6+ messages in thread
From: Peter Sabaini @ 2010-05-04 12:56 UTC (permalink / raw)
To: pgsql-admin
Hello,
it seems Postgres tries to send a UDP packet to a random high port to
communicate with the statistics collector daemon. We have rather strict
packet filter rules in place, and I'd like to make the system use a
fixed port for this, or even better a Unix domain socket. Is this
possible (setting a compile time or run time parameter)?
Thanks,
peter.
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Statistics collector port / unix dom. socket?
2010-05-04 12:56 Statistics collector port / unix dom. socket? Peter Sabaini <peter.sabaini@ait.ac.at>
@ 2010-05-04 15:39 ` Tom Lane <tgl@sss.pgh.pa.us>
2010-05-04 19:41 ` Re: Statistics collector port / unix dom. socket? Peter Sabaini <peter.sabaini@ait.ac.at>
0 siblings, 1 reply; 6+ messages in thread
From: Tom Lane @ 2010-05-04 15:39 UTC (permalink / raw)
To: Peter Sabaini <peter.sabaini@ait.ac.at>; +Cc: pgsql-admin
Peter Sabaini <peter.sabaini@ait.ac.at> writes:
> it seems Postgres tries to send a UDP packet to a random high port to
> communicate with the statistics collector daemon. We have rather strict
> packet filter rules in place, and I'd like to make the system use a
> fixed port for this, or even better a Unix domain socket. Is this
> possible (setting a compile time or run time parameter)?
No, the stats collector just uses whatever port bind() chooses for it.
I'd suggest backing off your ideas about how much filtering is
appropriate for local connections.
regards, tom lane
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Statistics collector port / unix dom. socket?
2010-05-04 12:56 Statistics collector port / unix dom. socket? Peter Sabaini <peter.sabaini@ait.ac.at>
2010-05-04 15:39 ` Re: Statistics collector port / unix dom. socket? Tom Lane <tgl@sss.pgh.pa.us>
@ 2010-05-04 19:41 ` Peter Sabaini <peter.sabaini@ait.ac.at>
2010-05-04 20:04 ` Re: Statistics collector port / unix dom. socket? Scott Marlowe <scott.marlowe@gmail.com>
2010-05-04 20:09 ` Re: Statistics collector port / unix dom. socket? Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 2 replies; 6+ messages in thread
From: Peter Sabaini @ 2010-05-04 19:41 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: pgsql-admin
On Tue, 2010-05-04 at 11:39 -0400, Tom Lane wrote:
> Peter Sabaini <peter.sabaini@ait.ac.at> writes:
> > it seems Postgres tries to send a UDP packet to a random high port to
> > communicate with the statistics collector daemon. We have rather strict
> > packet filter rules in place, and I'd like to make the system use a
> > fixed port for this, or even better a Unix domain socket. Is this
> > possible (setting a compile time or run time parameter)?
>
> No, the stats collector just uses whatever port bind() chooses for it.
A pity.
> I'd suggest backing off your ideas about how much filtering is
> appropriate for local connections.
Since we're running multiple database instances with different projects
on one machine I'd like to isolate them as best I can.
Thanks anyway...
peter.
>
> regards, tom lane
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Statistics collector port / unix dom. socket?
2010-05-04 12:56 Statistics collector port / unix dom. socket? Peter Sabaini <peter.sabaini@ait.ac.at>
2010-05-04 15:39 ` Re: Statistics collector port / unix dom. socket? Tom Lane <tgl@sss.pgh.pa.us>
2010-05-04 19:41 ` Re: Statistics collector port / unix dom. socket? Peter Sabaini <peter.sabaini@ait.ac.at>
@ 2010-05-04 20:04 ` Scott Marlowe <scott.marlowe@gmail.com>
2010-05-05 07:33 ` Re: Statistics collector port / unix dom. socket? Peter Sabaini <peter.sabaini@ait.ac.at>
1 sibling, 1 reply; 6+ messages in thread
From: Scott Marlowe @ 2010-05-04 20:04 UTC (permalink / raw)
To: Peter Sabaini <peter.sabaini@ait.ac.at>; +Cc: Tom Lane <tgl@sss.pgh.pa.us>; pgsql-admin
On Tue, May 4, 2010 at 1:41 PM, Peter Sabaini <peter.sabaini@ait.ac.at> wrote:
> On Tue, 2010-05-04 at 11:39 -0400, Tom Lane wrote:
>> Peter Sabaini <peter.sabaini@ait.ac.at> writes:
>> > it seems Postgres tries to send a UDP packet to a random high port to
>> > communicate with the statistics collector daemon. We have rather strict
>> > packet filter rules in place, and I'd like to make the system use a
>> > fixed port for this, or even better a Unix domain socket. Is this
>> > possible (setting a compile time or run time parameter)?
>>
>> No, the stats collector just uses whatever port bind() chooses for it.
>
> A pity.
>
>> I'd suggest backing off your ideas about how much filtering is
>> appropriate for local connections.
>
> Since we're running multiple database instances with different projects
> on one machine I'd like to isolate them as best I can.
Maybe running them in individual VMs would do that.
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Statistics collector port / unix dom. socket?
2010-05-04 12:56 Statistics collector port / unix dom. socket? Peter Sabaini <peter.sabaini@ait.ac.at>
2010-05-04 15:39 ` Re: Statistics collector port / unix dom. socket? Tom Lane <tgl@sss.pgh.pa.us>
2010-05-04 19:41 ` Re: Statistics collector port / unix dom. socket? Peter Sabaini <peter.sabaini@ait.ac.at>
2010-05-04 20:04 ` Re: Statistics collector port / unix dom. socket? Scott Marlowe <scott.marlowe@gmail.com>
@ 2010-05-05 07:33 ` Peter Sabaini <peter.sabaini@ait.ac.at>
0 siblings, 0 replies; 6+ messages in thread
From: Peter Sabaini @ 2010-05-05 07:33 UTC (permalink / raw)
To: Scott Marlowe <scott.marlowe@gmail.com>; +Cc: pgsql-admin
On Tue, 2010-05-04 at 14:04 -0600, Scott Marlowe wrote:
> On Tue, May 4, 2010 at 1:41 PM, Peter Sabaini <peter.sabaini@ait.ac.at> wrote:
> > On Tue, 2010-05-04 at 11:39 -0400, Tom Lane wrote:
> >> Peter Sabaini <peter.sabaini@ait.ac.at> writes:
> >> > it seems Postgres tries to send a UDP packet to a random high port to
> >> > communicate with the statistics collector daemon. We have rather strict
> >> > packet filter rules in place, and I'd like to make the system use a
> >> > fixed port for this, or even better a Unix domain socket. Is this
> >> > possible (setting a compile time or run time parameter)?
> >>
> >> No, the stats collector just uses whatever port bind() chooses for it.
> >
> > A pity.
> >
> >> I'd suggest backing off your ideas about how much filtering is
> >> appropriate for local connections.
> >
> > Since we're running multiple database instances with different projects
> > on one machine I'd like to isolate them as best I can.
>
> Maybe running them in individual VMs would do that.
We run them in containers (kind of like a chroot++). Since we're running
a lot of small projects on that machine, full virtualization (VMware,
Xen etc) would be unfeasible.
--
PETER SABAINI
Safety & Security Department
Information Management & eHealth
AIT Austrian Institute of Technology GmbH
Reininghausstraße 13/1 | 8020 Graz | Austria
T +43(0) 316 586570-55 | M +43(0) 664 8251123 | F +43(0) 316 586570-12
peter.sabaini@ait.ac.at | http://www.ait.ac.at | http://www.ait.ac.at/eHealth
FN: 115980 i HG Wien | UID: ATU14703506
Kennen Sie die www.eHealth2010.at ?
This email and any attachments thereto, is intended only for use by the
addressee(s) named herein and may contain legally privileged and/or
confidential information. If you are not the intended recipient, please
notify the sender by return e-mail or by telephone and delete this
message from your system and any printout thereof. Any unauthorized use,
reproduction, or dissemination of this message is strictly prohibited.
Please note that e-mails are susceptible to change. AIT Austrian
Institute of Technology GmbH shall not be liable for the improper or
incomplete transmission of the information contained in this
communication, nor shall it be liable for any delay in its receipt.
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: Statistics collector port / unix dom. socket?
2010-05-04 12:56 Statistics collector port / unix dom. socket? Peter Sabaini <peter.sabaini@ait.ac.at>
2010-05-04 15:39 ` Re: Statistics collector port / unix dom. socket? Tom Lane <tgl@sss.pgh.pa.us>
2010-05-04 19:41 ` Re: Statistics collector port / unix dom. socket? Peter Sabaini <peter.sabaini@ait.ac.at>
@ 2010-05-04 20:09 ` Tom Lane <tgl@sss.pgh.pa.us>
1 sibling, 0 replies; 6+ messages in thread
From: Tom Lane @ 2010-05-04 20:09 UTC (permalink / raw)
To: Peter Sabaini <peter.sabaini@ait.ac.at>; +Cc: pgsql-admin
Peter Sabaini <peter.sabaini@ait.ac.at> writes:
> On Tue, 2010-05-04 at 11:39 -0400, Tom Lane wrote:
>> I'd suggest backing off your ideas about how much filtering is
>> appropriate for local connections.
> Since we're running multiple database instances with different projects
> on one machine I'd like to isolate them as best I can.
Since the stats collector uses pre-bound UDP sockets, it should not be
possible for any interference to occur. If anything other than other
processes in the same PG herd is able to send a message on that socket,
it would be a kernel bug.
regards, tom lane
^ permalink raw reply [nested|flat] 6+ messages in thread
end of thread, other threads:[~2010-05-05 07:33 UTC | newest]
Thread overview: 6+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2010-05-04 12:56 Statistics collector port / unix dom. socket? Peter Sabaini <peter.sabaini@ait.ac.at>
2010-05-04 15:39 ` Tom Lane <tgl@sss.pgh.pa.us>
2010-05-04 19:41 ` Peter Sabaini <peter.sabaini@ait.ac.at>
2010-05-04 20:04 ` Scott Marlowe <scott.marlowe@gmail.com>
2010-05-05 07:33 ` Peter Sabaini <peter.sabaini@ait.ac.at>
2010-05-04 20:09 ` Tom Lane <tgl@sss.pgh.pa.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox