Raspbian上snapd狂吃CPU问题

2020-07-22 作者： Fisherworks

To get rid of snapd on Raspbian/RaspberryPi OS Buster, since it eats lots of cpu power, especially on the old hardware, like a Pi 2B.

一台年迈的Pi 2B，运行着时时更新的Raspbian Buster，兢兢业业给娃做文件服务器，不亦乐乎。

一天apt dist-upgrade之后，就发现system load频繁升高，系统空载就能吃掉大致一个核的性能。top后画风大致是这样的。

➜  ~ top
top - 22:26:04 up 2 days, 13:44,  3 users,  load average: 0.96, 0.99, 0.93
Tasks: 143 total,   1 running, 142 sleeping,   0 stopped,   0 zombie
%Cpu(s):  8.4 us,  2.7 sy,  0.0 ni, 82.4 id,  6.3 wa,  0.0 hi,  0.2 si,  0.0 st
MiB Mem :    926.1 total,    222.2 free,    171.1 used,    532.7 buff/cache
MiB Swap:    100.0 total,    100.0 free,      0.0 used.    693.0 avail Mem

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND
  345 root      20   0  968804  21248  13064 S  37.3   2.2   1065:41 snapd
   84 root      20   0       0      0      0 S   1.0   0.0  28:27.25 jbd2/mmcblk0p2-
15049 pi        20   0   10440   3096   2540 R   1.0   0.3   0:00.09 top
  346 root      20   0    2968   2060   1564 S   0.7   0.2   2:17.19 dhcpcd
17101 root       0 -20       0      0      0 I   0.7   0.0   2:49.94 kworker/0:1H-mmc_complete
   10 root      20   0       0      0      0 I   0.3   0.0   7:00.05 rcu_sched
   18 root       0 -20       0      0      0 I   0.3   0.0   4:21.89 kworker/1:0H-kblockd
   83 root       0 -20       0      0      0 I   0.3   0.0   4:24.37 kworker/2:1H-kblockd
  412 root      20   0   31976   9496   8068 S   0.3   1.0   0:29.19 nmbd

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

➜ ~ top

top - 22:26:04 up 2 days, 13:44, 3 users, load average: 0.96, 0.99, 0.93

Tasks: 143 total, 1 running, 142 sleeping, 0 stopped, 0 zombie

%Cpu(s): 8.4 us, 2.7 sy, 0.0 ni, 82.4 id, 6.3 wa, 0.0 hi, 0.2 si, 0.0 st

MiB Mem : 926.1 total, 222.2 free, 171.1 used, 532.7 buff/cache

MiB Swap: 100.0 total, 100.0 free, 0.0 used. 693.0 avail Mem

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND

345 root 20 0 968804 21248 13064 S 37.3 2.2 1065:41 snapd

84 root 20 0 0 0 0 S 1.0 0.0 28:27.25 jbd2/mmcblk0p2-

15049 pi 20 0 10440 3096 2540 R 1.0 0.3 0:00.09 top

346 root 20 0 2968 2060 1564 S 0.7 0.2 2:17.19 dhcpcd

17101 root 0 -20 0 0 0 I 0.7 0.0 2:49.94 kworker/0:1H-mmc_complete

10 root 20 0 0 0 0 I 0.3 0.0 7:00.05 rcu_sched

18 root 0 -20 0 0 0 I 0.3 0.0 4:21.89 kworker/1:0H-kblockd

83 root 0 -20 0 0 0 I 0.3 0.0 4:24.37 kworker/2:1H-kblockd

412 root 20 0 31976 9496 8068 S 0.3 1.0 0:29.19 nmbd

于是很想了解这货在干嘛，消耗这么多脑力，思考人生么？

➜  ~ sudo lsof -p 345
lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs
      Output information may be incomplete.
COMMAND PID USER   FD      TYPE     DEVICE SIZE/OFF   NODE NAME
snapd   345 root  cwd       DIR      179,2     4096      2 /
snapd   345 root  rtd       DIR      179,2     4096      2 /
snapd   345 root  txt       REG        7,0 13421332   7147 /snap/core/9291/usr/lib/snapd/snapd
snapd   345 root  mem       REG      179,2  1296004   2022 /lib/arm-linux-gnueabihf/libc-2.28.so
snapd   345 root  mem       REG      179,2   130416   2085 /lib/arm-linux-gnueabihf/libpthread-2.28.so
snapd   345 root  mem       REG      179,2    17708  10917 /usr/lib/arm-linux-gnueabihf/libarmmem-v7l.so
snapd   345 root  mem       REG      179,2   138604   1945 /lib/arm-linux-gnueabihf/ld-2.28.so
snapd   345 root    0r      CHR        1,3      0t0   1028 /dev/null
snapd   345 root    1u     unix 0xf31a5a4c      0t0  14576 type=STREAM
snapd   345 root    2u     unix 0xf31a5a4c      0t0  14576 type=STREAM
snapd   345 root    3u     IPv4     152109      0t0    TCP 192.168.50.127:48604->api.snapcraft.io:https (ESTABLISHED)
snapd   345 root    4u     IPv4     233503      0t0    TCP 192.168.50.127:40786->api.snapcraft.io:https (ESTABLISHED)
snapd   345 root    6u  a_inode       0,11        0   5804 [eventpoll]
snapd   345 root    7u     unix 0x5b752603      0t0  14350 /run/snapd.socket type=STREAM
snapd   345 root    8u     unix 0xfebd686d      0t0  14353 /run/snapd-snap.socket type=STREAM
snapd   345 root    9u      REG      179,2        0 386387 /var/lib/snapd/snaps/core_9668.snap.partial
snapd   345 root   12u  netlink                 0t0  18728 KOBJECT_UEVENT
snapd   345 root   13r     FIFO       0,10      0t0  18729 pipe
snapd   345 root   14w     FIFO       0,10      0t0  18729 pipe

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

➜ ~ sudo lsof -p 345

lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs

Output information may be incomplete.

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME

snapd 345 root cwd DIR 179,2 4096 2 /

snapd 345 root rtd DIR 179,2 4096 2 /

snapd 345 root txt REG 7,0 13421332 7147 /snap/core/9291/usr/lib/snapd/snapd

snapd 345 root mem REG 179,2 1296004 2022 /lib/arm-linux-gnueabihf/libc-2.28.so

snapd 345 root mem REG 179,2 130416 2085 /lib/arm-linux-gnueabihf/libpthread-2.28.so

snapd 345 root mem REG 179,2 17708 10917 /usr/lib/arm-linux-gnueabihf/libarmmem-v7l.so

snapd 345 root mem REG 179,2 138604 1945 /lib/arm-linux-gnueabihf/ld-2.28.so

snapd 345 root 0r CHR 1,3 0t0 1028 /dev/null

snapd 345 root 1u unix 0xf31a5a4c 0t0 14576 type=STREAM

snapd 345 root 2u unix 0xf31a5a4c 0t0 14576 type=STREAM

snapd 345 root 3u IPv4 152109 0t0 TCP 192.168.50.127:48604->api.snapcraft.io:https (ESTABLISHED)

snapd 345 root 4u IPv4 233503 0t0 TCP 192.168.50.127:40786->api.snapcraft.io:https (ESTABLISHED)

snapd 345 root 6u a_inode 0,11 0 5804 [eventpoll]

snapd 345 root 7u unix 0x5b752603 0t0 14350 /run/snapd.socket type=STREAM

snapd 345 root 8u unix 0xfebd686d 0t0 14353 /run/snapd-snap.socket type=STREAM

snapd 345 root 9u REG 179,2 0 386387 /var/lib/snapd/snaps/core_9668.snap.partial

snapd 345 root 12u netlink 0t0 18728 KOBJECT_UEVENT

snapd 345 root 13r FIFO 0,10 0t0 18729 pipe

snapd 345 root 14w FIFO 0,10 0t0 18729 pipe

看起来是想回家拉点什么私货回来（api.snapcraft.io），但还是搞不懂，走io就走io，连续几天24小时一直吃那么多cpu是什么鬼？

完整阅读本篇»

CentOS7免费SSL证书及自动展期

2020-06-14 作者： Fisherworks

This post shows you how to obtain a wildcard SSL certificate for free (which values at least $50) from Let’s Encrypt on CentOS 7.x Linux, and get it setup to renew by itself with an automated script.

至于什么是SSL证书，有什么用，这里不赘述了。大致上，一个泛域名（通配符）DV证书，价值怎么也在CNY 2000/年开外，注意是按年缴费；企业型（OV）证书则更贵，年费肯定不下万。因此别嫌命令行操作不好搞，有免费午餐已然相当给力，还要啥自行车。

按规矩，周知一下，证书发行方是Let’s Encrypt。之所以能送免（bai）费（piao）证书，据说主要是全自动。证书生成、发放、展期等操作，都经shell脚本完全自动化 —— 无人工就成本低，蛮好理解；至于抢了那几家拦路收费的生意，咱也捧个人场，起码希望他们能一直坚持做下去。

证书自动获取

来一台阿里云上的CentOS7，以非root（但具备sudo权限）用户连接，先下载certbot-auto脚本，并授以执行权限。

[py27@fisher-test ~]$ wget https://dl.eff.org/certbot-auto 
--2020-06-11 22:57:34--  https://dl.eff.org/certbot-auto
正在解析主机 dl.eff.org (dl.eff.org)... 151.101.228.201, 2a04:4e42:1a::201 
正在连接 dl.eff.org ... 已连接。 
已发出HTTP 请求，正在等待回应... 200 OK
长度：79897 (78K) [application/octet-stream]
正在保存至: “certbot-auto”
 
100%[===============================>] 79,897      5.73KB/s 用时13s
 
2020-06-11 22:57:50 (6.03 KB/s) - 已保存 “certbot-auto” [79897/79897])

1

2

3

4

5

6

7

8

9

10

11

[py27@fisher-test ~]$ wget https://dl.eff.org/certbot-auto

--2020-06-11 22:57:34-- https://dl.eff.org/certbot-auto

正在解析主机 dl.eff.org (dl.eff.org)... 151.101.228.201, 2a04:4e42:1a::201

正在连接 dl.eff.org ... 已连接。

已发出HTTP 请求，正在等待回应... 200 OK

长度：79897 (78K) [application/octet-stream]

正在保存至: “certbot-auto”

100%[===============================>] 79,897 5.73KB/s 用时13s

2020-06-11 22:57:50 (6.03 KB/s) - 已保存 “certbot-auto” [79897/79897])

然后以手工完成“挑战”（challenge）的方式，获取泛域名（通配符）DV证书，其中挑战选择DNS，也即按脚本要求，手工在域名解析中增加TXT记录 —— 以此证明此域名归属于申请者。

[py27@fisher-test ~]$ ./certbot-auto certonly  -d *.fisher.cn --manual --preferred-challenges dns --server https://acme-v02.api.letsencrypt.org/directory
Requesting to rerun ./certbot-auto with root privileges...
./certbot-auto has insecure permissions!
To learn how to fix them, visit https://community.letsencrypt.org/t/certbot-auto-deployment-best-practices/91979/
Saving debug log to /var/log/letsencrypt/letsencrypt.log（这里存放获取证书全过程日志供参考）
Plugins selected: Authenticator manual, Installer None
Obtaining a new certificate
Performing the following challenges:
dns-01 challenge for fisher.cn
 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: The IP of this machine will be publicly logged as having requested this
certificate. If you're running certbot in manual mode on a machine that is not
your server, please ensure you're okay with that.
 
Are you OK with your IP being logged?（作为申请数字证书的要求，是否可以记录本机IP）
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name
_acme-challenge.fisher.cn with the following value:（在域名中增加TXT解析，以完成“挑战”）
 
MomldPnAKL4I8bL8FiwmqvJJdE7E97RH-ARf7PZgw88
 
Before continuing, verify the record is deployed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue（此处暂停，登你的DNS，设置解析；搞定后此处回车）【注：过后可删除】
Waiting for verification...
Cleaning up challenges
 
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:（证书获取成功，存放位置如下）
   /etc/letsencrypt/live/fisher.cn/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/fisher.cn/privkey.pem
   Your cert will expire on 2020-09-11. To obtain a new or tweaked（证书过期时间，及更新方法）
   version of this certificate in the future, simply run certbot-auto
   again. To non-interactively renew *all* of your certificates, run
   "certbot-auto renew"
- If you like Certbot, please consider supporting our work by:
 
   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

[py27@fisher-test ~]$ ./certbot-auto certonly -d *.fisher.cn --manual --preferred-challenges dns --server https://acme-v02.api.letsencrypt.org/directory

Requesting to rerun ./certbot-auto with root privileges...

./certbot-auto has insecure permissions!

To learn how to fix them, visit https://community.letsencrypt.org/t/certbot-auto-deployment-best-practices/91979/

Saving debug log to /var/log/letsencrypt/letsencrypt.log（这里存放获取证书全过程日志供参考）

Plugins selected: Authenticator manual, Installer None

Obtaining a new certificate

Performing the following challenges:

dns-01 challenge for fisher.cn

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

NOTE: The IP of this machine will be publicly logged as having requested this

certificate. If you're running certbot in manual mode on a machine that is not

your server, please ensure you're okay with that.

Are you OK with your IP being logged?（作为申请数字证书的要求，是否可以记录本机IP）

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

(Y)es/(N)o: Y

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Please deploy a DNS TXT record under the name

_acme-challenge.fisher.cn with the following value:（在域名中增加TXT解析，以完成“挑战”）

MomldPnAKL4I8bL8FiwmqvJJdE7E97RH-ARf7PZgw88

Before continuing, verify the record is deployed.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Press Enter to Continue（此处暂停，登你的DNS，设置解析；搞定后此处回车）【注：过后可删除】

Waiting for verification...

Cleaning up challenges

IMPORTANT NOTES:

- Congratulations! Your certificate and chain have been saved at:（证书获取成功，存放位置如下）

/etc/letsencrypt/live/fisher.cn/fullchain.pem

Your key file has been saved at:

/etc/letsencrypt/live/fisher.cn/privkey.pem

Your cert will expire on 2020-09-11. To obtain a new or tweaked（证书过期时间，及更新方法）

version of this certificate in the future, simply run certbot-auto

again. To non-interactively renew *all* of your certificates, run

"certbot-auto renew"

- If you like Certbot, please consider supporting our work by:

Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate

Donating to EFF: https://eff.org/donate-le

那么证书如何将http通信升级为https，不同的后端有不同的代码实现方式。但就目前主流做法，大家倾向于让https通信脱离开发范畴，直接配置在httpd中，比如nginx config（或者apache之类均可）：

完整阅读本篇»

两机rsync定时单向只增同步

2020-05-27 作者： Fisherworks

事出有因

老房子装修没布网线，远在北卧192.168.1.128（wifi连接）是娃的网课机，需要播放音视频及office文档；该机wifi连接不算可靠（一堵大量钢筋砖混承重，一堵普通轻体），好的时候24Mbps，偶发连接不稳定的时候会断开；而路由器已经更新为口碑产品Netgear R6700
另有树莓派192.168.1.127（有线LAN，可靠连接）作为7×24文件服务器，用于从ddns接收外来课件，并对1.128提供文件共享服务

问题澄清

课件播放过程中，偶发wifi信号问题导致卡顿

问题思路

由于wifi中断为偶发，大部分情况下连接OK
采取让1.128机器定时（每1小时）去1.127机器同步课件的思路
前者存储大（HDD），后者小（TF），设计为单向同步；后者新增，前者同步，后者删除，前者保留

具体实现

#!/usr/bin/bash

echo `date`

FILE_SERVER=192.168.1.127
ping -c 3 -w 5 $FILE_SERVER
# ping不通则不进行同步（说明1.127未连接）
if [[ $? != 0 ]];then
    echo " target is offline! "
    exit 1
fi

pidof rsync
# 如果正在同步，则不开启新的同步
if [[ $? == 0 ]];then
    echo " rsync is still working! "
    exit 2
fi

echo "server ok, start transmission... "
rsync -uavzP --exclude=".*" pi@$FILE_SERVER:/share/documents '/home/py27/documents/learnings'
exit 0

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

#!/usr/bin/bash

echo `date`

FILE_SERVER=192.168.1.127

ping -c 3 -w 5 $FILE_SERVER

# ping不通则不进行同步（说明1.127未连接）

if [[ $? != 0 ]];then

echo " target is offline! "

exit 1

fi

pidof rsync

# 如果正在同步，则不开启新的同步

if [[ $? == 0 ]];then

echo " rsync is still working! "

exit 2

fi

echo "server ok, start transmission... "

rsync -uavzP --exclude=".*" pi@$FILE_SERVER:/share/documents '/home/py27/documents/learnings'

exit 0

测试以上脚本工作ok后，将其加入crontab，每小时定时执行

py27@py27-vince:~$ crontab -l 
0 */1 * * * /home/py27/scripts/rsync_learnings.sh > /tmp/rsync_learnings.log  2>&1

1 2	py27@py27-vince:~$ crontab -l 0 /1 * * /home/py27/scripts/rsync_learnings.sh > /tmp/rsync_learnings.log 2>&1

后续计划

观察课件同步效果，有问题检查log，总之能用技术解决的问题，就别给人找事干
目前wifi网卡为Intel AC9260 M.2，两根8dBi天线；有空可以考虑升级到带延长线的磁性吸盘12dBi天线，增强wifi稳定性

完整阅读本篇»

Linux信息亭 | Ubuntu Kiosk

2019-08-08 作者： Fisherworks

This article is written for those who need a Linux based kiosk with both touch input (virtual keyboard) and remote desktop (VNC) capability that provides a web application to serve pages and user interactions for customers.

↑ English video tutorial / 英文版视频教程

简而言之，既然任务是做一台单用途信息屏，依然不喜Windows的复杂和玄学（外加版权问题），小目标就是尽量用Linux达到。从用户基数比较大的发行版里挑，UI比较良心的就是Ubuntu了，而Ubuntu里比较可靠的就是一直以来的LTS版本了，然后LTS里最新的就是18.04 LTS —— 得嘞，就是它了。

鉴于Linux权倾朝野，无人不知无人不晓，部署Ubuntu的过程就此略去不提，填入非root用户名叫kiosk。装完后登进去，先整体更新系统。

完整阅读本篇»

树莓派HDMI强制输出

2019-06-19 作者： Fisherworks

因为前几天用Raspbian自带安装VLC播放1080p MP4严重卡顿，调研了一下；发现默认安装VLC是不带硬件解码的，也即没有发挥BCM2XXX ARM的GPU硬解码能力。
那么最简洁的解决方案是什么：命令行下omxplayer加上GUI外壳TBOplayer，试了一下果然很流畅而且占用cpu个位数，解H264编码的MP4和MKV文件都很流畅（且测试用的是pi2而非pi3）。

但这里边还有个小问题，树莓派如果上电时不接HDMI，物理口上是没输出的；这是个普遍问题，相信对于一个嵌入式设备，很多人都有类似需求（比如关屏不关盒），那么何解呢？

sudo vi /boot/config.txt

# uncomment if hdmi display is not detected and composite is being output
hdmi_force_hotplug=1

# uncomment to force a specific HDMI mode (this will force VGA)
hdmi_group=1
hdmi_mode=16

1

2

3

4

5

6

# uncomment if hdmi display is not detected and composite is being output

hdmi_force_hotplug=1

# uncomment to force a specific HDMI mode (this will force VGA)

hdmi_group=1

hdmi_mode=16

完整阅读本篇»

基于Proxmox 5.3的HA集群搭建试验

2019-04-05 作者： Fisherworks

Proxmox VE 5.3 based HA cluster setup experiment has been done on very basic hardware.

Intel Core i5-7400 4C4T
DDR4 24GB (1 x 8GB, 1 x 16GB)
SSD 960GB with ZFS RAID0 (2 x Sandisk SSD PLUS 480GB)

Special thanks to the best “nanny-level” tutorial (links listed below) by Mr. Weibing YU.

感谢提供保姆级教程的余伟兵先生，原始文章来源于其在51CTO及微信公众号的分享。

先来一个完成图，测起来一个字，爽！

完整阅读本篇»

Raspbian上snapd狂吃CPU问题

CentOS7免费SSL证书及自动展期

证书自动获取

两机rsync定时单向只增同步

事出有因

问题澄清

问题思路

具体实现

后续计划

Linux信息亭 | Ubuntu Kiosk

树莓派HDMI强制输出

基于Proxmox 5.3的HA集群搭建试验

关于Fisherworks

最近文章

功能

本站友链

实时天气

2024年五月
一	二	三	四	五	六	日
« 4月
		1	2	3	4	5
6	7	8	9	10	11	12
13	14	15	16	17	18	19
20	21	22	23	24	25	26
27	28	29	30	31