Optimizing sysctl settings

Software & Operating Systems Linux
1

Any comments on which settings you use and why? Use sysctl -a to see current settings. The Arch wiki has a number of suggested optimizations.

I like having all magic keys (kernel.sysrq = 1) and making use of lots of RAM without swapping (vm.swappiness = 1, vm.vfs_cache_pressure = 60). The Arch wiki has many more suggestions, especially for network settings.

Considering how easy it is to change settings, without even rebooting (just sudo sysctl --system), it’s tempting to experiment. For example, it’s easy to copy suggestions into /etc/sysctl.d/90-override.conf and therefore also have an easy way to undo any changes by uncommenting entries or deleting the override file.

2

I set swappiness to 1 on servers, that’s about it.

There’s generally no need to mess with all that stuff. Much like disabling services on Windows, it’s something people do to feel like they’re making important changes, but the end result is something they will never notice.

1 Like
3

There are a few sysctl configurations in DISA STIG OpenSCAP:

https://static.open-scap.org/ssg-guides/ssg-rhel7-guide-stig-rhel7-disa.html#xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_source_route

https://static.open-scap.org/ssg-guides/ssg-rhel7-guide-stig-rhel7-disa.html#xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route

https://static.open-scap.org/ssg-guides/ssg-rhel7-guide-stig-rhel7-disa.html#xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects

https://static.open-scap.org/ssg-guides/ssg-rhel7-guide-stig-rhel7-disa.html#xccdf_org.ssgproject.content_group_network_host_and_router_parameters

https://static.open-scap.org/ssg-guides/ssg-rhel7-guide-stig-rhel7-disa.html#xccdf_org.ssgproject.content_group_network_host_parameters

https://static.open-scap.org/ssg-guides/ssg-rhel7-guide-stig-rhel7-disa.html#xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space

Also some for optimizing a 10GbE NAS:

(listed under kernel parameters)

4

@Ruffalo That’s sensible advice for most people. Some though like to optimize their system, possibly until they break it. Then maybe even revert to defaults… though with the benefit of better understanding. At least reverting to sysctl defaults seems really easy.

@oO.o All of those settings except for net.ipv4.conf.default.accept_redirects = 0 were already at the recommended values (some probably due to the Arch wiki). I like the sentence in the last link:

This article is for experienced users, don’t mess up with default kernel parameters if you don’t know for what they serve, remember KISS always.

And yet… playing with fire is so tempting.

1 Like