<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
font-size:11.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;
mso-fareast-language:EN-US;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:11.0pt;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1054623160;
mso-list-type:hybrid;
mso-list-template-ids:350155878 1804362100 134807555 134807557 134807553 134807555 134807557 134807553 134807555 134807557;}
@list l0:level1
{mso-level-start-at:2025;
mso-level-number-format:bullet;
mso-level-text:-;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Aptos",sans-serif;
mso-fareast-font-family:Aptos;
mso-bidi-font-family:"Times New Roman";}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi,<br>
I’m new to Shibboleth, and am currently configuring a couple of service providers on a test VM running RHEL9.<o:p></o:p></p>
<p class="MsoNormal">After the shibd service is started, it starts consuming swap space. After 15h it’s grabbed 2.4G of swap.<o:p></o:p></p>
<p class="MsoNormal">There are no requests going via the SP at the moment; the VM has spare memory.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Is this swap usage normal/expected?<o:p></o:p></p>
<p class="MsoNormal">Are there ways to limit/minimise this usage?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ve been following these setup guides:<o:p></o:p></p>
<ul style="margin-top:0cm" type="disc">
<li class="MsoListParagraph" style="margin-left:0cm;mso-list:l0 level1 lfo1"><a href="https://www.ukfederation.org.uk/content/Documents/Setup3SP">https://www.ukfederation.org.uk/content/Documents/Setup3SP</a><o:p></o:p></li><li class="MsoListParagraph" style="margin-left:0cm;mso-list:l0 level1 lfo1"><a href="https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335547/LinuxInstall">https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065335547/LinuxInstall</a> [we have
SELinux enabled – could this be related?]<o:p></o:p></li></ul>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">There are some messages relating to Apache running in prefork (<a href="https://shibboleth.net/pipermail/users/2014-September/017504.htmlrelating">https://shibboleth.net/pipermail/users/2014-September/017504.htmlrelating</a>). I’m running
Apache in MPM event mode, if that’s still relevant.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Other than a deprecation warning about MetadataGenerator handler, the logs appear ‘clean’, although the service doesn’t shutdown in a timely manner:<o:p></o:p></p>
<p class="MsoNormal">(from the messages log)<o:p></o:p></p>
<p class="MsoNormal">Nov 26 15:51:21 systemd[1]: Stopping Shibboleth Service Provider Daemon...<o:p></o:p></p>
<p class="MsoNormal">Nov 26 15:52:21 systemd[1]: shibd.service: State 'stop-sigterm' timed out. Killing.<o:p></o:p></p>
<p class="MsoNormal">Nov 26 15:52:21 systemd[1]: shibd.service: Killing process 455247 (shibd) with signal SIGKILL.<o:p></o:p></p>
<p class="MsoNormal">Nov 26 15:52:21 systemd[1]: shibd.service: Killing process 455253 (shibd) with signal SIGKILL.<o:p></o:p></p>
<p class="MsoNormal">Nov 26 15:52:21 systemd[1]: shibd.service: Main process exited, code=killed, status=9/KILL<o:p></o:p></p>
<p class="MsoNormal">Nov 26 15:52:21 systemd[1]: shibd.service: Failed with result 'timeout'.<o:p></o:p></p>
<p class="MsoNormal">Nov 26 15:52:21 systemd[1]: Stopped Shibboleth Service Provider Daemon.<o:p></o:p></p>
<p class="MsoNormal">Nov 26 15:52:21 systemd[1]: shibd.service: Consumed 1min 40.793s CPU time.<o:p></o:p></p>
<p class="MsoNormal">Nov 26 15:52:21 systemd[1]: Starting Shibboleth Service Provider Daemon...<o:p></o:p></p>
<p class="MsoNormal">Nov 26 15:52:29 systemd[1]: Started Shibboleth Service Provider Daemon.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">From the shibd.log:<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:51:21 INFO Shibboleth.Listener : listener service shutting down<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:51:21 INFO Shibboleth.Config : shibboleth 3.5.1 library shutting down<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:22 INFO XMLTooling.Config : xmltooling 3.3.0 library initialization complete<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:22 INFO OpenSAML.Config : opensaml 3.3.1 library initialization complete<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:22 INFO Shibboleth.Config : shibboleth 3.5.1 library initialization complete<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:22 INFO Shibboleth.Config : loaded XML resource (/etc/shibboleth/shibboleth2.xml)<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:22 INFO Shibboleth.Config : Shibboleth SP Version 3.5.1<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:22 INFO Shibboleth.Config : Library versions: log4shib 2.0.1, Xerces-C 3.3.0, XML-Security-C 3.0.0, XMLTooling-C 3.3.0, OpenSAML-C 3.3.1, Shibboleth 3.5.0<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:22 INFO Shibboleth.Config : building ListenerService of type UnixListener...<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:22 INFO Shibboleth.Listener : using socket address: shibd.sock<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:22 INFO Shibboleth.Config : no StorageService plugin(s) installed, using (mem) in-memory instance<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:22 INFO Shibboleth.Config : no ReplayCache specified, using arbitrary StorageService instance<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:22 INFO Shibboleth.Config : no ArtifactMap specified, building in-memory ArtifactMap...<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:22 INFO Shibboleth.Config : no SessionCache specified, using StorageService-backed instance<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:22 INFO Shibboleth.SessionCache : bound to arbitrary StorageService<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:22 INFO Shibboleth.SessionCache : StorageService for 'lite' use not set, using standard StorageService<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:22 INFO Shibboleth.Config : building SecurityPolicyProvider of type XML...<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:22 INFO XMLTooling.StorageService : cleanup thread started...running every 900 seconds<o:p></o:p></p>
<p class="MsoNormal">[<o:p></o:p></p>
<p class="MsoNormal"> … loads/processes security-policy; protocols…<o:p></o:p></p>
<p class="MsoNormal">]<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:22 INFO Shibboleth.Handler.DiscoveryFeed : feed files will be cached in /var/cache/shibboleth/<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:22 INFO Shibboleth.Application : building MetadataProvider of type XML...<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:22 INFO OpenSAML.MetadataProvider : building MetadataFilter of type RequireValidUntil<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:22 INFO OpenSAML.MetadataProvider : building MetadataFilter of type Signature<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:22 INFO XMLTooling.SecurityHelper : loading certificate(s) from file (/etc/shibboleth/ukfederation/ukfederation.pem)<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:22 INFO XMLTooling.CredentialResolver.File : no private key resolved, usable for verification/trust only<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:22 INFO OpenSAML.MetadataProvider.XML : remote resource (http://metadata.ukfederation.org.uk/ukfederation-metadata.xml) unchanged, adjusted reload interval to 14400 seconds<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:22 INFO OpenSAML.MetadataProvider.XML : using local backup of remote resource<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:26 INFO OpenSAML.MetadataProvider.XML : loaded XML resource (/etc/shibboleth/ukfederation/ukfederation-metadata.xml)<o:p></o:p></p>
<p class="MsoNormal">[<o:p></o:p></p>
<p class="MsoNormal"> … loads/processes attribute-map, keys, certs for two SPs…<o:p></o:p></p>
<p class="MsoNormal">]<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 15:52:29 INFO Shibboleth.Listener : listener service starting<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 19:52:29 INFO OpenSAML.MetadataProvider.XML : reloading remote resource...<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 19:52:34 INFO OpenSAML.MetadataProvider.XML : loaded XML resource (http://metadata.ukfederation.org.uk/ukfederation-metadata.xml)<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 19:52:38 INFO OpenSAML.MetadataProvider : applying metadata filter (RequireValidUntil)<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 19:52:38 INFO OpenSAML.MetadataProvider : applying metadata filter (Signature)<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 19:54:13 INFO OpenSAML.MetadataProvider.XML : adjusted reload interval to 14400 seconds<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 23:54:59 INFO OpenSAML.MetadataProvider.XML : reloading remote resource...<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 23:55:01 INFO OpenSAML.MetadataProvider.XML : remote resource (http://metadata.ukfederation.org.uk/ukfederation-metadata.xml) unchanged, adjusted reload interval to 14400 seconds<o:p></o:p></p>
<p class="MsoNormal">2025-11-26 23:55:01 INFO OpenSAML.MetadataProvider.XML : remote resource (http://metadata.ukfederation.org.uk/ukfederation-metadata.xml) unchanged from cached version<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The increase in swap usage doesn’t seem to relate to the metadata reload. It was already ~500M before the first reload.<o:p></o:p></p>
<p class="MsoNormal">The ukfederation-metadata.xml file is 81M.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">If there are additional details that I can provide, please let me know.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Cheers,<o:p></o:p></p>
<p class="MsoNormal">John<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Calibri",sans-serif;color:#1F497D">John Salter</span><span style="font-family:"Calibri",sans-serif;color:#1F497D;mso-ligatures:none"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Calibri",sans-serif;color:#1F497D;mso-fareast-language:EN-GB"><a href="https://orcid.org/0000-0002-8611-8266"><span style="color:#0563C1">https://orcid.org/0000-0002-8611-8266</span></a></span><span style="font-size:9.5pt;font-family:"Calibri",sans-serif;color:#888888;mso-fareast-language:EN-GB"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.5pt;font-family:"Calibri",sans-serif;color:#888888;mso-fareast-language:EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-size:12.0pt;font-family:"Calibri",sans-serif;color:#888888;mso-fareast-language:EN-GB">White Rose Libraries Technical Officer<br>
Library and Research Management team, IT<br>
University of Leeds<o:p></o:p></span></p>
</div>
</body>
</html>