Tag Info

Hot answers tagged

17

You can find the documentation in man 5 proc (or at kernel.org): This file contains the kernel virtual memory accounting mode. Values are: 0: heuristic overcommit (this is the default) 1: always overcommit, never check 2: always check, never overcommit In mode 0, calls of mmap(2) with MAP_NORESERVE are not checked, and the default check is very ...


12

The problem might be that you are getting too many interrupts on your network card. If Bandwidth is not the problem, frequency is the problem: Turn up send/receive buffers on the network card ethtool -g eth0 Will show you the current settings (256 or 512 entries). You can probably raise these to 1024, 2048 or 3172. More does probably not make sense. ...


11

Specific answer: Immediately speaking, you're calling sysctl::value, but value isn't declared in your sysctl class. See this example that uses a sysctl::conf declaration. Without the define value, there is no sysctl::value subclass for you to call. General answer and guidance: The Augeas construct (see also its type reference documentation) that is part ...


11

As far as I know there is no "undo" for sysctl -- You need to re-enter the default settings (typically /etc/sysctl.conf simply does not specify defaults, so re-reading it won't revert your changes unless there's an explicit setting). If you do not know your default settings a reboot will get them back, and you can then list them with sysctl -a (store this ...


11

Your problem actually lies here: Normal free:29372kB min:32768kB low:40960kB high:49152kB active_anon:0kB inactive_anon:0kB active_file:44kB inactive_file:128kB unevictable:44kB isolated(anon):0kB isolated(file):0kB present:131072kB managed:124196kB mlocked:0kB dirty:0kB writeback:0kB mapped:0kB shmem:0kB slab_reclaimable:3876kB ...


10

For all Linux systems which I used SHMALL is measured in pages and SHMMAX is measured in bytes. I think you may check your system using ipcs command, which always converts above parameters in KBytes while output, and compare it with sysctl values: [aseryozhin@centos ~]$ ipcs -l ------ Shared Memory Limits -------- max number of segments = 4096 ...


10

I'd recommend against options IPFIREWALL_DEFAULT_TO_ACCEPT. The default is to Default to Deny. The firewall comes up with just one rule deny ip from any to any and stays that way until a script configures exactly what traffic should get through. Follow-Up Note: RSA (one of the world's leading security technology companies) was hacked recently when ...


7

Security privileges security.bsd.see_other_uids=0 security.bsd.see_other_gids=0 security.bsd.conservative_signals=1 security.bsd.unprivileged_proc_debug=0 security.bsd.unprivileged_read_msgbuf=0 security.bsd.hardlink_check_uid=1 security.bsd.hardlink_check_gid=1 vfs.usermount=0 net.inet.tcp.log_in_vain=1 net.inet.udp.log_in_vain=1


7

From the default sysctl.conf, it provides "security" against script kiddies who manage to brute their way in on a non-root account. Doesn't hurt to have it enabled (in most cases, exceptions are non-privileged daemons needing to see the process list). # Uncomment this to prevent users from seeing information about processes that # are being run under ...


7

A smurf attack is where someone sends packets to a broadcast address, usually with a spoofed source, to trick you into sending a large number of replies. The clog your logs with error messages. Ignoring them keeps the logs uncluttered. It's not like you can fix the Internet anyway. A SYN flood attack is one where an attacker hits a server with a large ...


6

There are several bugreports about this on Red Hat Bugzilla, for example here, here and here. Just remove the lines or run sysctl -e -p instead of sysctl -p.


6

More buffer doesn't necessarily imply more speed. More buffer simply implies more buffer. Below a certain value you'll see overflow as applications can't necessarily service received data quickly enough. This is bad, but at the point where there is sufficient buffer for the app to service at a reasonable rate even in the event of the occasional traffic ...


6

i usually add followings to my /etc/sysctl.conf as well... net.inet.tcp.blackhole=2 net.inet.udp.blackhole=1 and both of security.bsd.see_other_uids=0 security.bsd.see_other_gids=0 while we're on tunning subject i'd also recommend to take a look here:NGINX + PHP-FPM + APC = Awesomeso, this tutorial on FreeBSD + that tutorial on NGINX = Really ...


5

It is possible you don't have the ipv6 kernel module loaded on the system you're referring to. If you execute sysctl -a|grep ipv6 you will get a list of all available sysctl's referring specifically to ipv6. If that list is empty, that would lead me to believe ipv6 is not loaded. If you do see the net.ipv6.conf.all.forwarding entry in that sysctl grep, ...


5

I found the answer. This server is a VPS and it is running in a OpenVZ container and I'm not allowed to modify any kernel parameter of that container.


5

Try: modprobe bridge lsmod | grep bridge You don't the those modules loaded into the kernel.


4

You have two main questions here: 1. Strictly IPv4 speaking, is port exhaustion actually possible? Yes. Take, for example, a load balancing router sending all connections to a NAT IP address. This is likely to happen when you have many SRC IPs connecting to the bottleneck of a single DST IP. This means that your webserver could have a bunch of ...


4

I believe /etc/sysctl.conf is still the right place (and man sysctl.conf agrees). Did you reboot? changes to /etc/sysctl.conf are not a real-time thing: They are only read/applied when the system enters multi-user mode during startup.


4

https://bugs.launchpad.net/ubuntu/+source/procps/+bug/50093 /etc/init.d/procps.sh comes too early in the boot process to apply a lot of sysctl's. As it runs before networking modules are loaded and filesystems are mounted, there are quite a lot of commonly-used sysctl's which are simply ignored on boot and produce errors to the console. All documentation ...


4

Have a look at Some sysctl's are ignored on boot. In short, the settings are applied early, before some kernel modules are loaded.


4

Check if there is a file in /etc/sysctl.d with your parameter. These files override the /etc/sysctl.conf file...


4

Following might not be the definitive answer but it will definitely put forth some ideas Try adding these to sysctl.conf ## tcp selective acknowledgements. net.ipv4.tcp_sack = 1 ##enable window scaling net.ipv4.tcp_window_scaling = 1 ## net.ipv4.tcp_no_metrics_save = 1 While selective tcp ack is good for optimal performance in the case of high ...


4

Setting tcp_orphan_retries to 0 is a special case, see tcp_timer.c 98 /* Calculate maximal number or retries on an orphaned socket. */ 99 static int tcp_orphan_retries(struct sock *sk, int alive) 100 { 101 int retries = sysctl_tcp_orphan_retries; /* May be zero. */ 102 103 /* We know from an ICMP that something is wrong. */ 104 ...


4

If you're looking for hardcore static performance, look into nginx. A web server that specializes specifically in serving static content. You will find that Apache can serve static content quite quickly too if you don't use complex features or .htaccess files, etc. Caching and connection handling are best left to the tunable features of the service daemon ...


4

This particular setting falls under the influence of the network namespace that docker runs in. As a general rule /proc does alter settings that are relevent systemwide, technically speaking however you are altering settings in /proc/net which returns results on a per network namespace basis. Note that /proc/net is actually a symlink to /proc/self/net as ...


3

EDIT: This answer totally misses the problem. See Matthew Ife's post about the crazy high setting on vm.min_free_kbytes The router and tor have been running for a while, correct? I suspect you are being hit by external (memory) fragmentation. If you look in your OOM logs you can see that there are many chunks of available memory, but if none of them are as ...


3

It's more like computer science question. Especially if you want to dig into hash tables and big-O notations. The answer is: If you are handling many TCP sessions on sever you really want to look up connection's tcp parameters in O(1) time instead of O(n). FreeBSD uses chaining to resolve hash table collisions. So if there is lots of connection there will ...


3

It doesn't mean "try forever", it means "don't try at all." This is the server trying to politely tell the client that the server is getting ready to close his socket, and if it would please do an orderly disconnect, or send some more data, that would be wonderful. It will try X times to get the client to respond, and after X, it reclaims the socket on the ...


3

You mention in your question that you are using a VPS. What kind of VPS? It sounds like you are in a OpenVZ VPS. If it is OpenVZ, it is sharing the kernel among many containers like yours and you cannot change the kernel configuration per container but directly on the host. I actually build a litlle OpenVZ centos container and I tried to apply the kernel ...


3

I think that sysctl parameter is for viewing only. You'll want to use the /sys/module/nf_conntrack/parameters/hashsize interface for runtime changes, and the hashsize module option to set it during initial module load. You'd want an entry in a /etc/modprobe.d/ file that looks something like this: options nf_conntrack hashsize=XXXXX



Only top voted, non community-wiki answers of a minimum length are eligible