Kernel_tuning

Chapter 55: Kernel Tuning with sysctl

Comprehensive Linux Kernel Parameter Optimization

---

55.1 sysctl Overview

What is sysctl?

sysctl is a tool for modifying kernel parameters at runtime in Linux. It allows system administrators to tune kernel behavior without recompiling the kernel or rebooting the system.

┌────────────────────────────────────────────────────────────────────────┐
│                    SYSCTL ARCHITECTURE                                 │
├────────────────────────────────────────────────────────────────────────┤
│                                                                        │
│  User Space                                                            │
│     │                                                                   │
│     ▼ sysctl command                                                  │
│  ┌────────────────────────────────────────────────────────────────┐    │
│  │                    /proc/sys/                                  │    │
│  │  ┌────────────┐  ┌────────────┐  ┌────────────┐  ┌─────────┐ │    │
│  │  │    vm     │  │    net    │  │   kernel   │  │   fs    │ │    │
│  │  │ memory   │  │ networking │  │  process   │  │ filesystem│ │    │
│  │  │  params  │  │   params   │  │   params   │  │  params  │ │    │
│  │  └────────────┘  └────────────┘  └────────────┘  └─────────┘ │    │
│  └────────────────────────────────────────────────────────────────┘    │
│     │                                                                   │
│     ▼ Kernel                                                          │
│  ┌────────────────────────────────────────────────────────────────┐    │
│  │                    LINUX KERNEL                                  │    │
│  │  - Memory Management                                           │    │
│  │  - Network Stack                                               │    │
│  │  - Process Scheduler                                           │    │
│  │  - Filesystem Layer                                            │    │
│  │  - Security Modules                                            │    │
│  └────────────────────────────────────────────────────────────────┘    │
│                                                                        │
└────────────────────────────────────────────────────────────────────────┘

Parameter Categories

Category	Path	Description
vm	/proc/sys/vm	Virtual memory, page cache, swap
net	/proc/sys/net	Network stack, IP, TCP, firewall
kernel	/proc/sys/kernel	Core kernel settings
fs	/proc/sys/fs	Filesystem, inotify, file handles
dev	/proc/sys/dev	Device-specific settings
sunrpc	/proc/sys/sunrpc	NFS, RPC settings
debug	/proc/sys/debug	Debugging settings

---

55.2 Basic sysctl Operations

Viewing Parameters

# View all kernel parameters
sysctl -a

# View all parameters matching pattern
sysctl -a | grep net.ipv4

# View specific parameter
sysctl net.ipv4.ip_forward

# View with descriptions (if available)
sysctl --describe net.ipv4.ip_forward

# Read from /proc directly
cat /proc/sys/net/ipv4/ip_forward

# View all with defaults
sysctl --system --all

# List configuration files
sysctl --system

Modifying Parameters

# Temporary change (lost on reboot)
sudo sysctl -w net.ipv4.ip_forward=1

# Multiple parameters at once
sudo sysctl -w net.ipv4.conf.all.rp_filter=1 net.ipv4.conf.default.rp_filter=1

# Apply changes from file
sudo sysctl -p

# Apply from specific file
sudo sysctl -p /etc/sysctl.d/99-custom.conf

# Apply default config files
sudo sysctl --system

# Show what would be applied (dry run)
sudo sysctl --system --dry-run

# Create new config file
sudo tee /etc/sysctl.d/99-custom.conf << 'EOF'
# Custom kernel parameters
net.ipv4.tcp_syncookies = 1
vm.swappiness = 10
EOF

Configuration Files

┌────────────────────────────────────────────────────────────────────────┐
│                    SYSCTL CONFIGURATION FILES                          │
├────────────────────────────────────────────────────────────────────────┤
│                                                                        │
│  Configuration load order (later overrides earlier):                   │
│                                                                        │
│  1. /run/sysctl.d/*.conf                                              │
│  2. /etc/sysctl.d/*.conf                                              │
│  3. /etc/sysctl.conf (legacy, still supported)                        │
│                                                                        │
│  Naming convention: 00-*.conf, 01-*.conf, ... 99-*.conf             │
│                                                                        │
│  Format:                                                               │
│  ┌────────────────────────────────────────────────────────────┐       │
│  │ # Comment                                                      │       │
│  │ net.ipv4.tcp_syncookies = 1    # Enable SYN cookies          │       │
│  │ net.ipv4.conf.default.rp_filter = 1                         │       │
│  └────────────────────────────────────────────────────────────┘       │
│                                                                        │
│  NOT allowed in sysctl.conf:                                          │
│  - Shell variables                                                    │
│  - Command substitution                                               │
│  - Complex expressions                                                │
│                                                                        │
└────────────────────────────────────────────────────────────────────────┘

---

55.3 Network Tuning

IPv4 Network Parameters

/etc/sysctl.d/10-network.conf

# IP Forwarding (for router/gateway)
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1

# Reverse Path Filtering (spoofing protection)
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Ignore ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

# Ignore ICMP ping
net.ipv4.icmp_echo_ignore_all = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Ignore bogus ICMP errors
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Log suspicious packets
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# Disable source packet routing
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Disable accept source route
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0

TCP Parameters

/etc/sysctl.d/20-tcp.conf

# SYN Flood Protection
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_syn_retries = 2
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_max_syn_backlog = 4096

# TCP Timestamps (improves security and performance)
net.ipv4.tcp_timestamps = 1

# TCP SACK (Selective Acknowledgment)
net.ipv4.tcp_sack = 1
net.ipv4.tcp_fack = 1

# TCP Window Scaling
net.ipv4.tcp_window_scaling = 1

# TCP Keepalive
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_keepalive_intvl = 60
net.ipv4.tcp_keepalive_probes = 5

# TCP Buffer Sizes (for high-bandwidth connections)
net.ipv4.tcp_rmem = 4096 87380 6291456
net.ipv4.tcp_wmem = 4096 65536 4194304
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.rmem_default = 262144
net.core.wmem_default = 262144
net.core.netdev_max_backlog = 5000

# TCP Memory
net.core.optmem_max = 25165824

# TCP Congestion Control
net.ipv4.tcp_congestion_control = cubic
net.ipv4.tcp_fastopen = 3

# TCP Metrics Cache
net.ipv4.tcp_fastopen_key = generate

# TCP MTU Probing
net.ipv4.tcp_mtu_probing = 1

IPv6 Parameters

/etc/sysctl.d/25-ipv6.conf

# Disable IPv6 if not needed
net.ipv6.conf.all.disable_ipv6 = 0
net.ipv6.conf.default.disable_ipv6 = 0

# IPv6 Security
net.ipv6.conf.all.accept_ra = 0
net.ipv6.conf.default.accept_ra = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# IPv6 traffic within IPv4 tunnels (6in4, 6to4)
net.ipv6.conf.all.forwarding = 1

Network Bridge Parameters

# For KVM/libvirt VMs
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-arptables = 1

# Disable bridge netfilter if not needed
# net.bridge.bridge-nf-call-iptables = 0

---

55.4 Memory Tuning

Virtual Memory Parameters

/etc/sysctl.d/30-memory.conf

# Swappiness (lower = less swapping)
vm.swappiness = 10

# For databases, lower further
# vm.swappiness = 3

# Page Cache Pressure (higher = reclaim more cache)
vm.vfs_cache_pressure = 50

# For file servers, keep more cache
# vm.vfs_cache_pressure = 100

# Dirty Page Ratios
vm.dirty_ratio = 15
vm.dirty_background_ratio = 5

# For heavy write workloads
# vm.dirty_ratio = 40
# vm.dirty_background_ratio = 10

# When to write dirty pages
vm.dirty_expire_centisecs = 3000
vm.dirty_writeback_centisecs = 500

# Memory Overcommit
vm.overcommit_memory = 0
vm.overcommit_ratio = 50

# For databases
# vm.overcommit_memory = 2
# vm.overcommit_ratio = 80

# Min free memory
vm.min_free_kbytes = 65536

# OOM handling
vm.oom_dump_tasks = 1
vm.oom_kill_allocating_task = 0

Huge Pages

/etc/sysctl.d/31-hugepages.conf

# Number of 2MB huge pages
vm.nr_hugepages = 128

# For large databases (Oracle, PostgreSQL)
# vm.nr_hugepages = 512

# Huge page pool size (transparent)
vm.nr_overcommit_hugepages = 64

# Enable transparent huge pages
vm.nr_hugepages_mempolicy = 128

Memory Overcommit Modes

┌────────────────────────────────────────────────────────────────────────┐
│                    VM.OVERCOMMIT_MEMORY MODES                          │
├────────────────────────────────────────────────────────────────────────┤
│                                                                        │
│  Value: 0 (Heuristic)                                                  │
│  ┌──────────────────────────────────────────────────────────────────┐ │
│  │ Kernel uses heuristic to determine if there's enough memory.   │ │
│  │ May deny some memory allocations in some cases.               │ │
│  │ Default mode, suitable for most workloads.                    │ │
│  └──────────────────────────────────────────────────────────────────┘ │
│                                                                        │
│  Value: 1 (Always)                                                     │
│  ┌──────────────────────────────────────────────────────────────────┐ │
│  │ Always allow memory allocations (no limits).                  │ │
│  │ Useful for some scientific computing, embedded systems.        │ │
│  │ WARNING: Can lead to OOM killer invocation.                    │ │
│  └──────────────────────────────────────────────────────────────────┘ │
│                                                                        │
│  Value: 2 (Never)                                                      │
│  ┌──────────────────────────────────────────────────────────────────┐ │
│  │ Never overcommit. Total virtual memory is limited to:          │ │
│  │   Swap + RAM * overcommit_ratio / 100                         │ │
│  │ Use when you need guaranteed memory.                           │ │
│  │ Recommended for databases and predictable workloads.            │ │
│  └──────────────────────────────────────────────────────────────────┘ │
│                                                                        │
└────────────────────────────────────────────────────────────────────────┘

Swappiness Guide

Value	Behavior	Best For
0	Swap only when out of memory	Systems with enough RAM
10	Minimal swapping	Desktop with SSD
30	Default in some distros	General desktop
60	Aggressive swap	Systems with limited RAM
100	Maximum swapping	Not recommended

---

55.5 Filesystem Tuning

File Handles and Limits

/etc/sysctl.d/40-filesystem.conf

# Maximum file handles
fs.file-max = 65536
fs.file-nr = 8192 0 65536

# For high-connection servers
# fs.file-max = 2097152

# Inotify (file watching)
fs.inotify.max_user_watches = 524288
fs.inotify.max_user_instances = 1024
fs.inotify.max_queued_events = 16384

# For development (webpack, etc.)
# fs.inotify.max_user_watches = 524288
# fs.inotify.max_user_instances = 1024

# Pipe buffers
fs.pipe-max-size = 1048576
fs.pipe-user-pages-hard = 0
fs.pipe-user-pages-soft = 16384

Semaphores and IPC

/etc/sysctl.d/45-ipc.conf

# Semaphores (Oracle, SAP need higher)
kernel.sem = 250 32000 100 128

# For Oracle
# kernel.sem = 2560 32000 1000 256

# Message queues
kernel.msgmax = 65536
kernel.msgmnb = 65536
kernel.msgmni = 2048

# Shared memory
kernel.shmmax = 68719476736
kernel.shmall = 4294967296

# For databases
# kernel.shmmax = 274877906944
# kernel.shmall = 67108864

File System Limits

/etc/sysctl.d/46-fs-limits.conf

# Maximum number of processes
kernel.pid_max = 65536

# Maximum threads
kernel.threads-max = 65536

# Core dump settings
kernel.core_pattern = core
kernel.core_uses_pid = 1

# For production
# kernel.core_pattern = |/usr/share/systemd/coredump %e %p %u %g %t %c %h
# kernel.core_uses_pid = 1

---

55.6 Security Tuning

Kernel Hardening

/etc/sysctl.d/50-security.conf

# Restrict dmesg (hide kernel messages)
kernel.dmesg_restrict = 1

# Restrict kernel pointers in logs
kernel.kptr_restrict = 2

# Enable address space randomization
kernel.randomize_va_space = 2

# Disable sysrq
kernel.sysrq = 0

# Enable TCP SYN cookies (already in network section)
# net.ipv4.tcp_syncookies = 1

# Hide unprivileged processes
kernel.yama.ptrace_scope = 2

# Restrict kernel modules
kernel.modules_disabled = 0

# Protect hardlinks
fs.protected_hardlinks = 1
fs.protected_symlinks = 1

SELinux/Apparmor Interaction

/etc/sysctl.d/51-selinux.conf

# Note: These affect SELinux but shouldn't override it

# Allow SELinux to work properly
# Don't change unless you understand the implications

# If using AppArmor
# See /etc/apparmor.d/

Network Security Parameters

/etc/sysctl.d/52-net-security.conf

# TCP/IP hardening (also in network section)
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0

net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Log suspicious packets
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# Ignore ICMP ping
net.ipv4.icmp_echo_ignore_all = 0

# IPv6
net.ipv6.conf.all.accept_ra = 0
net.ipv6.conf.default.accept_ra = 0

---

55.7 Process and Scheduler Tuning

Process Limits

/etc/sysctl.d/60-process.conf

# Max processes
kernel.pid_max = 65536

# Max threads
kernel.threads-max = 65536

# Max locked memory (for huge pages, etc.)
# This is controlled via ulimit, not sysctl
# See /etc/security/limits.conf

# CPU scheduler
kernel.sched_child_runs_first = 0

# Scheduler tuning
kernel.sched_migration_cost_ns = 5000000
kernel.sched_autogroup_enabled = 0
kernel.sched_tunable_scaling = 1

# For low-latency applications
# kernel.sched_latency_ns = 10000000
# kernel.sched_min_granularity_ns = 1000000
# kernel.sched_wakeup_granularity_ns = 2000000

User Limits (via limits.conf, not sysctl)

/etc/security/limits.conf

# File descriptors
*    soft    nofile    65536
*    hard    nofile    65536
root soft    nofile    unlimited
root hard    nofile    unlimited

# Max processes
*    soft    nproc     65536
*    hard    nproc     65536

# Max locked memory
*    soft    memlock   unlimited
*    hard    memlock   unlimited

# Core dumps
*    soft    core      0
*    hard    core      0

# For specific user (nginx)
nginx soft nofile 100000
nginx hard nofile 100000

# For database user
postgres soft nofile 262144
postgres hard nofile 262144

---

55.8 Debug and Diagnostics

Debugging Parameters

/etc/sysctl.d/90-debug.conf

# Kernel debugging (use only for debugging)
# kernel.printk = 7 4 1 7
# kernel.debug = 1

# NMI watchdog (for hang detection)
kernel.nmi_watchdog = 1

# Softlockup detection
kernel.softlockup_panic = 0

#hung task detection
kernel.hung_task_warnings = 3
kernel.hung_task_timeout_secs = 120
kernel.hung_task_check_interval = 30

# Panic on oom
kernel.panic = 10
kernel.panic_on_oops = 1

# Dump state on crash
kernel.sysrq = 1

Performance Monitoring

# Check current values
sysctl -a | grep -E "(vm|net|fs)"

# Monitor dirty pages
sysctl vm.dirty_ratio vm.dirty_background_ratio vm.dirty_expire_centisecs

# Check network buffers
sysctl net.core.rmem_max net.core.wmem_max

# Check file limits
sysctl fs.file-max fs.inotify.max_user_watches

# See applied configuration
sysctl --system

---

55.9 Workload-Specific Configurations

Database Server (PostgreSQL/MySQL)

/etc/sysctl.d/99-database.conf

# Memory
vm.swappiness = 10
vm.overcommit_memory = 2
vm.overcommit_ratio = 80
vm.dirty_ratio = 40
vm.dirty_background_ratio = 10
vm.dirty_expire_centisecs = 5000
vm.dirty_writeback_centisecs = 1000

# Huge pages for database buffers
vm.nr_hugepages = 256

# Shared memory
kernel.shmmax = 68719476736
kernel.shmall = 4294967296

# Semaphores
kernel.sem = 2560 32000 1000 256

# File handles
fs.file-max = 2097152
fs.inotify.max_user_watches = 524288

# Network
net.core.somaxconn = 4096
net.ipv4.tcp_max_syn_backlog = 8192
net.ipv4.tcp_fin_timeout = 30

# Process limits
kernel.pid_max = 65536
kernel.threads-max = 65536

Web Server (Apache/Nginx)

/etc/sysctl.d/99-webserver.conf

# Network
net.core.somaxconn = 65535
net.core.netdev_max_backlog = 65535
net.ipv4.tcp_max_syn_backlog = 65535
net.ipv4.tcp_fin_timeout = 15
net.ipv4.tcp_keepalive_time = 300
net.ipv4.tcp_keepalive_intvl = 15
net.ipv4.tcp_keepalive_probes = 5

# File handles
fs.file-max = 2097152

# Connection tracking
net.netfilter.nf_conntrack_max = 1048576
net.nf_conntrack_max = 1048576
net.netfilter.nf_conntrack_tcp_timeout_established = 7200

# Memory
vm.swappiness = 60
vm.dirty_ratio = 60
vm.dirty_background_ratio = 10

Container Host

/etc/sysctl.d/99-container.conf

# Network
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-arptables = 1
net.ipv4.ip_forward = 1
net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.default.forwarding = 1

# Connection tracking
net.netfilter.nf_conntrack_max = 1048576
net.netfilter.nf_conntrack_tcp_timeout_established = 3600
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 30
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 15
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 30

# File handles
fs.file-max = 2097152
fs.inotify.max_user_watches = 524288
fs.inotify.max_user_instances = 1024

# Memory
vm.max_map_count = 262144
vm.overcommit_memory = 1

High-Performance Computing (HPC)

/etc/sysctl.d/99-hpc.conf

# Memory - no overcommit for predictable behavior
vm.overcommit_memory = 2
vm.overcommit_ratio = 50

# Huge pages
vm.nr_hugepages = 1024

# Network - low latency
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216
net.ipv4.tcp_fastopen = 3
net.core.netdev_max_backlog = 50000
net.core.optmem_max = 25165824

# CPU scheduler
kernel.sched_autogroup_enabled = 0
kernel.sched_migration_cost_ns = 5000000

---

55.10 Applying and Verifying Changes

Applying Changes

# Apply all configuration files
sudo sysctl --system

# Apply specific file
sudo sysctl -p /etc/sysctl.d/99-custom.conf

# Apply default locations
sudo sysctl -p /etc/sysctl.conf

# Check which files were loaded
sysctl --system 2>&1 | grep -E "(Reading|Applying)"

# Make changes persistent across reboots
# (already saved in /etc/sysctl.d/)

Verifying Changes

# Check specific parameter
sysctl net.ipv4.tcp_syncookies

# Verify network stack
sysctl net.* | head -20

# Verify memory settings
sysctl vm.* | grep -E "(swappiness|overcommit|dirty)"

# Check applied config
sysctl -a | less

# See runtime values in /proc
cat /proc/sys/net/ipv4/tcp_syncookies

# Compare current vs defaults
# Reboot and check or use snapshots

Troubleshooting

# Check for errors
dmesg | grep -i "sysctl"
journalctl -k | grep -i "sysctl"

# Common errors:
# "error: "Key is read-only" - Parameter cannot be changed
# "error: "Invalid argument" - Wrong value type
# "error: "Operation not permitted" - Need root

# Check if parameter exists
sysctl net.ipv4.tcp_invalid_ratelimit 2>&1

# Check parameter type
cat /proc/sys/net/ipv4/tcp_syncookies
# 0 or 1 for boolean, range for others

---

55.11 Interview Questions

Q1: What is sysctl and how does it work?

Answer: sysctl is a Linux utility for viewing and modifying kernel parameters at runtime. It works by:

1. Reading/writing to /proc/sys/ virtual filesystem
2. Parameters are organized hierarchically (vm., net., kernel., fs.)
3. Changes can be temporary (via command line) or persistent (via config files)
4. Config files in /etc/sysctl.d/ are processed in order
5. Parameters take effect immediately without reboot

Q2: What is the difference between /etc/sysctl.conf and /etc/sysctl.d/?

Answer:

• /etc/sysctl.conf - Legacy single configuration file, still supported
• /etc/sysctl.d/ - Modern directory with numbered config files (00-99-*.conf)

The .d/ directory approach allows:

• Better organization and modularity
• Easier upgrades (changes in separate files)
• Clearer load order (numerical prefix)
• Package management integration

Files are processed in alphabetical order, with later files overriding earlier ones.

Q3: What is the purpose of vm.swappiness?

Answer: vm.swappiness controls the kernel’s tendency to swap memory pages to disk:

• Range: 0-100 (higher = more aggressive swapping)
• 0 = Disable swapping except when out of memory
• 100 = Aggressive swapping even with available RAM

For most systems:

• Default is 60
• Desktop with SSD: 10-30
• Server with plenty of RAM: 10 or lower
• Database servers: 3-10

Lower values keep more data in RAM, improving performance for frequently accessed data.

Q4: How do you enable IP forwarding in Linux?

Answer:

# Temporary (lost on reboot)
sudo sysctl -w net.ipv4.ip_forward=1

# For IPv6
sudo sysctl -w net.ipv6.conf.all.forwarding=1

# Persistent (add to /etc/sysctl.d/99-network.conf)
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1

# Apply
sudo sysctl -p

Q5: What is the difference between vm.overcommit_memory values?

Answer:

• 0 (Heuristic): Default. Kernel uses heuristics to decide, may deny some allocations
• 1 (Always): Always allow all allocations, can lead to OOM killer
• 2 (Never): Never overcommit. Total virtual memory = Swap + (RAM × overcommit_ratio/100)

For databases and predictable workloads, use mode 2 with appropriate ratio.

Q6: How do sysctl parameters affect network performance?

Answer: Key network parameters for performance:

• net.core.* - Socket and interface buffers
• net.ipv4.tcp_* - TCP behavior (window scaling, SACK, keepalive)
• net.ipv4.tcp_rmem/tcp_wmem - Per-socket buffer sizes
• net.core.netdev_max_backlog - Interface queue length

Proper tuning can significantly improve:

• Connection handling capacity
• Latency under load
• Throughput for bulk transfers
• Connection establishment speed

Q7: What are huge pages and why are they used?

Answer: Huge pages are memory pages larger than the default 4KB (typically 2MB or 1GB). Benefits:

• Reduced TLB (Translation Lookaside Buffer) misses
• Lower memory overhead for large workloads
• Better performance for databases (shared buffers)
• Reduced kernel page table overhead

Configuration:

# Reserve huge pages
vm.nr_hugepages = 256

# Check
cat /proc/meminfo | grep Huge

Applications must explicitly request huge pages.

Q8: How do you troubleshoot sysctl parameter issues?

Answer:

1. Check if parameter exists: sysctl param_name
2. Verify current value: cat /proc/sys/...
3. Check for errors in logs: dmesg | grep -i sysctl
4. Verify configuration files are being read: sysctl --system
5. Ensure correct value type (boolean, integer, string)
6. Check for read-only parameters
7. Verify permissions (need root)
8. Look for conflicts between config files

---

Quick Reference

Common Commands

# View all
sysctl -a

# View specific
sysctl net.ipv4.tcp_syncookies

# Set temporary
sudo sysctl -w param=value

# Apply config
sudo sysctl -p /etc/sysctl.d/file.conf

# Apply all
sudo sysctl --system

# Read from /proc
cat /proc/sys/net/ipv4/ip_forward

Key Parameters

Parameter	Default	Common Value	Description
net.ipv4.tcp_syncookies	1	1	SYN flood protection
vm.swappiness	60	10-30	Swap tendency
vm.overcommit_memory	0	0/2	Memory allocation policy
fs.file-max	Based on RAM	65536+	Max file handles
net.core.somaxconn	128	4096	Max socket connections
net.ipv4.ip_forward	0	1	IP forwarding
kernel.pid_max	32768	65536	Max process IDs

Configuration Order

/run/sysctl.d/*.conf
/etc/sysctl.d/*.conf
/etc/sysctl.conf

---

Summary

In this chapter, you learned:

• ✅ sysctl architecture and operation
• ✅ Basic sysctl commands and operations
• ✅ Network tuning parameters (IPv4, IPv6, TCP)
• ✅ Memory tuning (swappiness, overcommit, huge pages)
• ✅ Filesystem tuning (file handles, inotify, IPC)
• ✅ Security hardening parameters
• ✅ Process and scheduler tuning
• ✅ Workload-specific configurations
• ✅ Applying and verifying changes
• ✅ Interview questions and answers

---

Next Chapter

Chapter 56: KVM/QEMU Virtualization

---

Last Updated: February 2026