Tag Info

Hot answers tagged

12

You can find the documentation in man 5 proc: This file contains the kernel virtual memory accounting mode. Values are: 0: heuristic overcommit (this is the default) 1: always overcommit, never check 2: always check, never overcommit In mode 0, calls of mmap(2) with MAP_NORESERVE are not checked, and the default check is very weak, leading to ...


11

Specific answer: Immediately speaking, you're calling sysctl::value, but value isn't declared in your sysctl class. See this example that uses a sysctl::conf declaration. Without the define value, there is no sysctl::value subclass for you to call. General answer and guidance: The Augeas construct (see also its type reference documentation) that is part ...


10

For all Linux systems which I used SHMALL is measured in pages and SHMMAX is measured in bytes. I think you may check your system using ipcs command, which always converts above parameters in KBytes while output, and compare it with sysctl values: [aseryozhin@centos ~]$ ipcs -l ------ Shared Memory Limits -------- max number of segments = 4096 ...


10

As far as I know there is no "undo" for sysctl -- You need to re-enter the default settings (typically /etc/sysctl.conf simply does not specify defaults, so re-reading it won't revert your changes unless there's an explicit setting). If you do not know your default settings a reboot will get them back, and you can then list them with sysctl -a (store this ...


9

The problem might be that you are getting too many interrupts on your network card. If Bandwidth is not the problem, frequency is the problem: Turn up send/receive buffers on the network card ethtool -g eth0 Will show you the current settings (256 or 512 entries). You can propably raise these to 1024, 2048 or 3172. More does propably not make sense. ...


9

I'd recommend against options IPFIREWALL_DEFAULT_TO_ACCEPT. The default is to Default to Deny. The firewall comes up with just one rule deny ip from any to any and stays that way until a script configures exactly what traffic should get through. Follow-Up Note: RSA (one of the world's leading security technology companies) was hacked recently when ...


7

A smurf attack is where someone sends packets to a broadcast address, usually with a spoofed source, to trick you into sending a large number of replies. The clog your logs with error messages. Ignoring them keeps the logs uncluttered. It's not like you can fix the Internet anyway. A SYN flood attack is one where an attacker hits a server with a large ...


6

Security privileges security.bsd.see_other_uids=0 security.bsd.see_other_gids=0 security.bsd.conservative_signals=1 security.bsd.unprivileged_proc_debug=0 security.bsd.unprivileged_read_msgbuf=0 security.bsd.hardlink_check_uid=1 security.bsd.hardlink_check_gid=1 vfs.usermount=0 net.inet.tcp.log_in_vain=1 net.inet.udp.log_in_vain=1


6

From the default sysctl.conf, it provides "security" against script kiddies who manage to brute their way in on a non-root account. Doesn't hurt to have it enabled (in most cases, exceptions are non-privileged daemons needing to see the process list). # Uncomment this to prevent users from seeing information about processes that # are being run under ...


5

It is possible you don't have the ipv6 kernel module loaded on the system you're referring to. If you execute sysctl -a|grep ipv6 you will get a list of all available sysctl's referring specifically to ipv6. If that list is empty, that would lead me to believe ipv6 is not loaded. If you do see the net.ipv6.conf.all.forwarding entry in that sysctl grep, ...


5

i usually add followings to my /etc/sysctl.conf as well... net.inet.tcp.blackhole=2 net.inet.udp.blackhole=1 and both of security.bsd.see_other_uids=0 security.bsd.see_other_gids=0 while we're on tunning subject i'd also recommend to take a look here:NGINX + PHP-FPM + APC = Awesomeso, this tutorial on FreeBSD + that tutorial on NGINX = Really ...


5

More buffer doesn't necessarily imply more speed. More buffer simply implies more buffer. Below a certain value you'll see overflow as applications can't necessarily service received data quickly enough. This is bad, but at the point where there is sufficient buffer for the app to service at a reasonable rate even in the event of the occasional traffic ...


4

Have a look at Some sysctl's are ignored on boot. In short, the settings are applied early, before some kernel modules are loaded.


4

If you're looking for hardcore static performance, look into nginx. A web server that specializes specifically in serving static content. You will find that Apache can serve static content quite quickly too if you don't use complex features or .htaccess files, etc. Caching and connection handling are best left to the tunable features of the service daemon ...


4

Setting tcp_orphan_retries to 0 is a special case, see tcp_timer.c 98 /* Calculate maximal number or retries on an orphaned socket. */ 99 static int tcp_orphan_retries(struct sock *sk, int alive) 100 { 101 int retries = sysctl_tcp_orphan_retries; /* May be zero. */ 102 103 /* We know from an ICMP that something is wrong. */ 104 ...


4

Following might not be the definitive answer but it will definitely put forth some ideas Try adding these to sysctl.conf ## tcp selective acknowledgements. net.ipv4.tcp_sack = 1 ##enable window scaling net.ipv4.tcp_window_scaling = 1 ## net.ipv4.tcp_no_metrics_save = 1 While selective tcp ack is good for optimal performance in the case of high ...


4

I believe /etc/sysctl.conf is still the right place (and man sysctl.conf agrees). Did you reboot? changes to /etc/sysctl.conf are not a real-time thing: They are only read/applied when the system enters multi-user mode during startup.


4

There are several bugreports about this on Red Hat Bugzilla, for example here, here and here. Just remove the lines or run sysctl -e -p instead of sysctl -p.


4

You have two main questions here: 1. Strictly IPv4 speaking, is port exhaustion actually possible? Yes. Take, for example, a load balancing router sending all connections to a NAT IP address. This is likely to happen when you have many SRC IPs connecting to the bottleneck of a single DST IP. This means that your webserver could have a bunch of ...


4

This particular setting falls under the influence of the network namespace that docker runs in. As a general rule /proc does alter settings that are relevent systemwide, technically speaking however you are altering settings in /proc/net which returns results on a per network namespace basis. Note that /proc/net is actually a symlink to /proc/self/net as ...


3

Check if there is a file in /etc/sysctl.d with your parameter. These files override the /etc/sysctl.conf file...


3

https://bugs.launchpad.net/ubuntu/+source/procps/+bug/50093 /etc/init.d/procps.sh comes too early in the boot process to apply a lot of sysctl's. As it runs before networking modules are loaded and filesystems are mounted, there are quite a lot of commonly-used sysctl's which are simply ignored on boot and produce errors to the console. All documentation ...


3

It doesn't mean "try forever", it means "don't try at all." This is the server trying to politely tell the client that the server is getting ready to close his socket, and if it would please do an orderly disconnect, or send some more data, that would be wonderful. It will try X times to get the client to respond, and after X, it reclaims the socket on the ...


3

It's more like computer science question. Especially if you want to dig into hash tables and big-O notations. The answer is: If you are handling many TCP sessions on sever you really want to look up connection's tcp parameters in O(1) time instead of O(n). FreeBSD uses chaining to resolve hash table collisions. So if there is lots of connection there will ...


3

Try: modprobe bridge lsmod | grep bridge You don't the those modules loaded into the kernel.


3

You mention in your question that you are using a VPS. What kind of VPS? It sounds like you are in a OpenVZ VPS. If it is OpenVZ, it is sharing the kernel among many containers like yours and you cannot change the kernel configuration per container but directly on the host. I actually build a litlle OpenVZ centos container and I tried to apply the kernel ...


3

I think that sysctl parameter is for viewing only. You'll want to use the /sys/module/nf_conntrack/parameters/hashsize interface for runtime changes, and the hashsize module option to set it during initial module load. You'd want an entry in a /etc/modprobe.d/ file that looks something like this: options nf_conntrack hashsize=XXXXX


3

OpenVZ is container-based, and as such, uses a shared kernel. Containers can only change a very small, restricted set of sysctls (which ones, unfortunately, aren't even documented). If you need to do this, you need to be using something other than OpenVZ.


3

I believe you created an orphan socket by killing the connection on the .137 server. So, the kernel parameter in use would be tcp_orphan_retries - which has a generic linux default of 7. You can get a description of both the condition you created and the results here: http://www.linuxinsight.com/proc_sys_net_ipv4_tcp_orphan_retries.html


3

I found the answer. This server is a VPS and it is running in a OpenVZ container and I'm not allowed to modify any kernel parameter of that container.



Only top voted, non community-wiki answers of a minimum length are eligible