SP3 / shibd swap usage on RHEL9

Thu Nov 27 07:38:00 UTC 2025

Hi,
I'm new to Shibboleth, and am currently configuring a couple of service providers on a test VM running RHEL9.
After the shibd service is started, it starts consuming swap space. After 15h it's grabbed 2.4G of swap.
There are no requests going via the SP at the moment; the VM has spare memory.

Is this swap usage normal/expected?
Are there ways to limit/minimise this usage?

I've been following these setup guides:

  *   https://www.ukfederation.org.uk/content/Documents/Setup3SP
  *   https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335547/LinuxInstall [we have SELinux enabled - could this be related?]

There are some messages relating to Apache running in prefork (https://shibboleth.net/pipermail/users/2014-September/017504.htmlrelating). I'm running Apache in MPM event mode, if that's still relevant.

Other than a deprecation warning about MetadataGenerator handler, the logs appear 'clean', although the service doesn't shutdown in a timely manner:
(from the messages log)
Nov 26 15:51:21 systemd[1]: Stopping Shibboleth Service Provider Daemon...
Nov 26 15:52:21 systemd[1]: shibd.service: State 'stop-sigterm' timed out. Killing.
Nov 26 15:52:21 systemd[1]: shibd.service: Killing process 455247 (shibd) with signal SIGKILL.
Nov 26 15:52:21 systemd[1]: shibd.service: Killing process 455253 (shibd) with signal SIGKILL.
Nov 26 15:52:21 systemd[1]: shibd.service: Main process exited, code=killed, status=9/KILL
Nov 26 15:52:21 systemd[1]: shibd.service: Failed with result 'timeout'.
Nov 26 15:52:21 systemd[1]: Stopped Shibboleth Service Provider Daemon.
Nov 26 15:52:21 systemd[1]: shibd.service: Consumed 1min 40.793s CPU time.
Nov 26 15:52:21 systemd[1]: Starting Shibboleth Service Provider Daemon...
Nov 26 15:52:29 systemd[1]: Started Shibboleth Service Provider Daemon.

>From the shibd.log:
2025-11-26 15:51:21 INFO Shibboleth.Listener : listener service shutting down
2025-11-26 15:51:21 INFO Shibboleth.Config : shibboleth 3.5.1 library shutting down
2025-11-26 15:52:22 INFO XMLTooling.Config : xmltooling 3.3.0 library initialization complete
2025-11-26 15:52:22 INFO OpenSAML.Config : opensaml 3.3.1 library initialization complete
2025-11-26 15:52:22 INFO Shibboleth.Config : shibboleth 3.5.1 library initialization complete
2025-11-26 15:52:22 INFO Shibboleth.Config : loaded XML resource (/etc/shibboleth/shibboleth2.xml)
2025-11-26 15:52:22 INFO Shibboleth.Config : Shibboleth SP Version 3.5.1
2025-11-26 15:52:22 INFO Shibboleth.Config : Library versions: log4shib 2.0.1, Xerces-C 3.3.0, XML-Security-C 3.0.0, XMLTooling-C 3.3.0, OpenSAML-C 3.3.1, Shibboleth 3.5.0
2025-11-26 15:52:22 INFO Shibboleth.Config : building ListenerService of type UnixListener...
2025-11-26 15:52:22 INFO Shibboleth.Listener : using socket address: shibd.sock
2025-11-26 15:52:22 INFO Shibboleth.Config : no StorageService plugin(s) installed, using (mem) in-memory instance
2025-11-26 15:52:22 INFO Shibboleth.Config : no ReplayCache specified, using arbitrary StorageService instance
2025-11-26 15:52:22 INFO Shibboleth.Config : no ArtifactMap specified, building in-memory ArtifactMap...
2025-11-26 15:52:22 INFO Shibboleth.Config : no SessionCache specified, using StorageService-backed instance
2025-11-26 15:52:22 INFO Shibboleth.SessionCache : bound to arbitrary StorageService
2025-11-26 15:52:22 INFO Shibboleth.SessionCache : StorageService for 'lite' use not set, using standard StorageService
2025-11-26 15:52:22 INFO Shibboleth.Config : building SecurityPolicyProvider of type XML...
2025-11-26 15:52:22 INFO XMLTooling.StorageService : cleanup thread started...running every 900 seconds
[
    ... loads/processes security-policy; protocols...
]
2025-11-26 15:52:22 INFO Shibboleth.Handler.DiscoveryFeed : feed files will be cached in /var/cache/shibboleth/
2025-11-26 15:52:22 INFO Shibboleth.Application : building MetadataProvider of type XML...
2025-11-26 15:52:22 INFO OpenSAML.MetadataProvider : building MetadataFilter of type RequireValidUntil
2025-11-26 15:52:22 INFO OpenSAML.MetadataProvider : building MetadataFilter of type Signature
2025-11-26 15:52:22 INFO XMLTooling.SecurityHelper : loading certificate(s) from file (/etc/shibboleth/ukfederation/ukfederation.pem)
2025-11-26 15:52:22 INFO XMLTooling.CredentialResolver.File : no private key resolved, usable for verification/trust only
2025-11-26 15:52:22 INFO OpenSAML.MetadataProvider.XML : remote resource (http://metadata.ukfederation.org.uk/ukfederation-metadata.xml) unchanged, adjusted reload interval to 14400 seconds
2025-11-26 15:52:22 INFO OpenSAML.MetadataProvider.XML : using local backup of remote resource
2025-11-26 15:52:26 INFO OpenSAML.MetadataProvider.XML : loaded XML resource (/etc/shibboleth/ukfederation/ukfederation-metadata.xml)
[
    ... loads/processes attribute-map, keys, certs for two SPs...
]
2025-11-26 15:52:29 INFO Shibboleth.Listener : listener service starting
2025-11-26 19:52:29 INFO OpenSAML.MetadataProvider.XML : reloading remote resource...
2025-11-26 19:52:34 INFO OpenSAML.MetadataProvider.XML : loaded XML resource (http://metadata.ukfederation.org.uk/ukfederation-metadata.xml)
2025-11-26 19:52:38 INFO OpenSAML.MetadataProvider : applying metadata filter (RequireValidUntil)
2025-11-26 19:52:38 INFO OpenSAML.MetadataProvider : applying metadata filter (Signature)
2025-11-26 19:54:13 INFO OpenSAML.MetadataProvider.XML : adjusted reload interval to 14400 seconds
2025-11-26 23:54:59 INFO OpenSAML.MetadataProvider.XML : reloading remote resource...
2025-11-26 23:55:01 INFO OpenSAML.MetadataProvider.XML : remote resource (http://metadata.ukfederation.org.uk/ukfederation-metadata.xml) unchanged, adjusted reload interval to 14400 seconds
2025-11-26 23:55:01 INFO OpenSAML.MetadataProvider.XML : remote resource (http://metadata.ukfederation.org.uk/ukfederation-metadata.xml) unchanged from cached version

The increase in swap usage doesn't seem to relate to the metadata reload. It was already ~500M before the first reload.
The ukfederation-metadata.xml file is 81M.

If there are additional details that I can provide, please let me know.

Cheers,
John

John Salter
https://orcid.org/0000-0002-8611-8266

White Rose Libraries Technical Officer
Library and Research Management team, IT
University of Leeds
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20251127/3cb12b2a/attachment.htm>