Proxmox LXC: mem_linux evaluates host PageTables against container MemTotal

[haja]

CMK version:
OS version:

Error message:

Output of “cmk --debug -vvn hostname”: (If it is a problem with checks or plugins)

CMK version: 2.5.0p15 Community
OS: Debian 13 LXC on Proxmox VE

Hi,

after installing the normal Checkmk agent inside several Proxmox LXC containers, their Memory services started reporting warnings or critical states for Page tables.

One example is a small TeamSpeak container with 512 MiB RAM:

Total virtual memory: 5.47% - 56.0 MiB of 1.00 GiB
Page tables: 38.90% - 199 MiB of 512 MiB RAM
(warn/crit at 8.00%/16.00%)

The Proxmox piggyback service for the same container reports only about 38 MiB of 512 MiB memory in use.

I compared /proc/meminfo inside the container and on the Proxmox host within a short time:

LXC:
MemTotal: 524288 kB
PageTables: 203408 kB
SecPageTables: 57948 kB
KernelStack: 33744 kB

Proxmox host:
MemTotal: 65567184 kB
PageTables: 202904 kB
SecPageTables: 58144 kB
KernelStack: 33584 kB

The PageTables, SecPageTables and KernelStack values are almost identical, while MemTotal is correctly limited to the container’s 512 MiB. Other monitored LXCs on the same host also report approximately 201–203 MiB of PageTables, despite having different RAM limits.

It therefore looks as if mem_linux is calculating a percentage using a host-wide PageTables value and the container-specific MemTotal. This creates false WARN/CRIT states, especially on small containers.

I also noticed that the 2.5.0p15 Linux agent detects LXC and filters Vmalloc and Committed from the mem section, but it still forwards PageTables.

Is this considered a bug, or is there another intended way to monitor memory inside Proxmox LXC containers?

Would it make sense for the agent to omit PageTables for LXC, or to use a container-specific cgroup value where available? Is a rule setting “Upper levels for Page tables” to “Do not impose levels” currently the recommended workaround?

I found this older discussion describing the same issue:

Memory check in LXC Containers reporting host values

**CMK version: 2.0.0.p19 ** **OS version: LXC: Ubuntu Server 20.04 / Host: Proxmox 7 (Debian 11) ** Hi, we’ve got some Proxmox servers (Debian), which are running lxc containers. The CMK memory checks of the lxc containers are sometimes going CRIT, because apparently the page table size or size of committed memory is too high. Example: CRIT - RAM used: 35.49 MB of 1 GB (3.5%), Page tables: 200.88 MB (19.6% of RAM, warn/crit at 8.0%/16.0%)**CRIT**, Committed: 104.69 GB (10468.6% of RAM + Swap…

Thanks!

[joerg.mohar]

Your analysis is correct. /proc/meminfo is not namespaced in the Linux kernel, and lxcfs only virtualizes MemTotal, MemFree, MemAvailable, Buffers, Cached and the Swap fields. PageTables, SecPageTables and KernelStack are passed through from the host unchanged, which is why you see nearly identical values across all your containers. The check itself is calculating correctly — it just gets a host-wide value against a container-sized MemTotal.

The agent already filters Committed and Largest VM Alloc for LXC for the same reason (Werk #11996), so your expectation is consistent, but PageTables is currently not covered.

Workaround: set Memory levels for Linux > Upper levels for page tables to “Do not impose levels”. Rather than doing this per host, bind the rule to a host label or tag that marks your LXC guests, so new containers are covered automatically.

If you would like the agent to filter these fields, ideas.checkmk.com is the right place to put it forward.

[haja]

Thanks for confirming the analysis