Hot answers tagged

26

You can find the documentation in man 5 proc (or at kernel.org): This file contains the kernel virtual memory accounting mode. Values are: 0: heuristic overcommit (this is the default) 1: always overcommit, never check 2: always check, never overcommit In mode 0, calls of mmap(2) with MAP_NORESERVE are not checked, and the default check is very ...


16

The problem might be that you are getting too many interrupts on your network card. If Bandwidth is not the problem, frequency is the problem: Turn up send/receive buffers on the network card ethtool -g eth0 Will show you the current settings (256 or 512 entries). You can probably raise these to 1024, 2048 or 3172. More does probably not make sense. ...


12

Specific answer: Immediately speaking, you're calling sysctl::value, but value isn't declared in your sysctl class. See this example that uses a sysctl::conf declaration. Without the define value, there is no sysctl::value subclass for you to call. General answer and guidance: The Augeas construct (see also its type reference documentation) that is part ...


11

As far as I know there is no "undo" for sysctl -- You need to re-enter the default settings (typically /etc/sysctl.conf simply does not specify defaults, so re-reading it won't revert your changes unless there's an explicit setting). If you do not know your default settings a reboot will get them back, and you can then list them with sysctl -a (store this ...


11

Your problem actually lies here: Normal free:29372kB min:32768kB low:40960kB high:49152kB active_anon:0kB inactive_anon:0kB active_file:44kB inactive_file:128kB unevictable:44kB isolated(anon):0kB isolated(file):0kB present:131072kB managed:124196kB mlocked:0kB dirty:0kB writeback:0kB mapped:0kB shmem:0kB slab_reclaimable:3876kB ...


10

For all Linux systems which I used SHMALL is measured in pages and SHMMAX is measured in bytes. I think you may check your system using ipcs command, which always converts above parameters in KBytes while output, and compare it with sysctl values: [aseryozhin@centos ~]$ ipcs -l ------ Shared Memory Limits -------- max number of segments = 4096 ...


10

I'd recommend against options IPFIREWALL_DEFAULT_TO_ACCEPT. The default is to Default to Deny. The firewall comes up with just one rule deny ip from any to any and stays that way until a script configures exactly what traffic should get through. Follow-Up Note: RSA (one of the world's leading security technology companies) was hacked recently when ...


8

A smurf attack is where someone sends packets to a broadcast address, usually with a spoofed source, to trick you into sending a large number of replies. The clog your logs with error messages. Ignoring them keeps the logs uncluttered. It's not like you can fix the Internet anyway. A SYN flood attack is one where an attacker hits a server with a large number ...


7

i usually add followings to my /etc/sysctl.conf as well... net.inet.tcp.blackhole=2 net.inet.udp.blackhole=1 and both of security.bsd.see_other_uids=0 security.bsd.see_other_gids=0 while we're on tunning subject i'd also recommend to take a look here:NGINX + PHP-FPM + APC = Awesomeso, this tutorial on FreeBSD + that tutorial on NGINX = Really Awesome!...


7

From the default sysctl.conf, it provides "security" against script kiddies who manage to brute their way in on a non-root account. Doesn't hurt to have it enabled (in most cases, exceptions are non-privileged daemons needing to see the process list). # Uncomment this to prevent users from seeing information about processes that # are being run under ...


7

https://bugs.launchpad.net/ubuntu/+source/procps/+bug/50093 /etc/init.d/procps.sh comes too early in the boot process to apply a lot of sysctl's. As it runs before networking modules are loaded and filesystems are mounted, there are quite a lot of commonly-used sysctl's which are simply ignored on boot and produce errors to the console. All documentation ...


7

Security privileges security.bsd.see_other_uids=0 security.bsd.see_other_gids=0 security.bsd.conservative_signals=1 security.bsd.unprivileged_proc_debug=0 security.bsd.unprivileged_read_msgbuf=0 security.bsd.hardlink_check_uid=1 security.bsd.hardlink_check_gid=1 vfs.usermount=0 net.inet.tcp.log_in_vain=1 net.inet.udp.log_in_vain=1


7

I think that sysctl parameter is for viewing only. You'll want to use the /sys/module/nf_conntrack/parameters/hashsize interface for runtime changes, and the hashsize module option to set it during initial module load. You'd want an entry in a /etc/modprobe.d/ file that looks something like this: options nf_conntrack hashsize=XXXXX


6

The location is still /etc/sysctl.conf or more precisely /private/etc/sysctl.conf. I had to tweak some settings because I wanted to run Postgresql on my machine and it turned out that I had to modify all of the five settings in order to get it running. So I created the file and put in something like this: kern.sysv.shmmax=1610612736 kern.sysv.shmmin=1 kern....


6

More buffer doesn't necessarily imply more speed. More buffer simply implies more buffer. Below a certain value you'll see overflow as applications can't necessarily service received data quickly enough. This is bad, but at the point where there is sufficient buffer for the app to service at a reasonable rate even in the event of the occasional traffic ...


6

There are several bugreports about this on Red Hat Bugzilla, for example here, here and here. Just remove the lines or run sysctl -e -p instead of sysctl -p.


6

I found the answer. This server is a VPS and it is running in a OpenVZ container and I'm not allowed to modify any kernel parameter of that container.


6

This particular setting falls under the influence of the network namespace that docker runs in. As a general rule /proc does alter settings that are relevent systemwide, technically speaking however you are altering settings in /proc/net which returns results on a per network namespace basis. Note that /proc/net is actually a symlink to /proc/self/net as ...


5

Check if there is a file in /etc/sysctl.d with your parameter. These files override the /etc/sysctl.conf file...


5

It is possible you don't have the ipv6 kernel module loaded on the system you're referring to. If you execute sysctl -a|grep ipv6 you will get a list of all available sysctl's referring specifically to ipv6. If that list is empty, that would lead me to believe ipv6 is not loaded. If you do see the net.ipv6.conf.all.forwarding entry in that sysctl grep, ...


5

Setting tcp_orphan_retries to 0 is a special case, see tcp_timer.c 98 /* Calculate maximal number or retries on an orphaned socket. */ 99 static int tcp_orphan_retries(struct sock *sk, int alive) 100 { 101 int retries = sysctl_tcp_orphan_retries; /* May be zero. */ 102 103 /* We know from an ICMP that something is wrong. */ 104 ...


5

Try: modprobe bridge lsmod | grep bridge You don't the those modules loaded into the kernel.


4

Have a look at Some sysctl's are ignored on boot. In short, the settings are applied early, before some kernel modules are loaded.


4

If you're looking for hardcore static performance, look into nginx. A web server that specializes specifically in serving static content. You will find that Apache can serve static content quite quickly too if you don't use complex features or .htaccess files, etc. Caching and connection handling are best left to the tunable features of the service daemon ...


4

Following might not be the definitive answer but it will definitely put forth some ideas Try adding these to sysctl.conf ## tcp selective acknowledgements. net.ipv4.tcp_sack = 1 ##enable window scaling net.ipv4.tcp_window_scaling = 1 ## net.ipv4.tcp_no_metrics_save = 1 While selective tcp ack is good for optimal performance in the case of high ...


4

I believe /etc/sysctl.conf is still the right place (and man sysctl.conf agrees). Did you reboot? changes to /etc/sysctl.conf are not a real-time thing: They are only read/applied when the system enters multi-user mode during startup.


4

You have two main questions here: 1. Strictly IPv4 speaking, is port exhaustion actually possible? Yes. Take, for example, a load balancing router sending all connections to a NAT IP address. This is likely to happen when you have many SRC IPs connecting to the bottleneck of a single DST IP. This means that your webserver could have a bunch of ...


3

modprobe ip_conntrack lsmod |grep conn -- if you see entries it means modules have been loaded correctly sysctl -w -- to write the changes you made under /etc/sysctl.conf sysctl -p -- to view the changes and see if it was actually loaded. That is all you need


3

You might be missing a module (I think is nf_conntrack) You should check if you have it on other machines and try to load it (modprobe). If it solves your problem, do not forget to add it to /etc/modules, so it will be loaded at next reboot. Hope it helps.


3

it's because /proc/sys/net/nf_conntrack_max is rely on the module nf_conntrack. but by default system will not load this module when system start. but if you run iptables -t nat -L or iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT this module will load automatically and set to the max number that your system support (the max ...



Only top voted, non community-wiki answers of a minimum length are eligible