Kernel tuning for dedicated linux server. /etc/sysctl.d/60-sysctl.conf

60-sysctl.conf

# Kernel sysctl configuration file for Linux
# https://www.kernel.org/doc/Documentation/sysctl/
#
# Original by Michiel Klaver <https://klaver.it/linux/sysctl.conf>
# Modify by Kawin Viriyaprasopsook <[email protected]>
#
# The following is suitable for dedicated web server, mail, file server, KVM server etc.
# place file in /etc/sysctl.d/60-sysctl.conf
# and run `sysctl --system`

# --------------------------------------------------------------------
# System options
# --------------------------------------------------------------------

# Controls IP packet forwarding (Default 0 but docker,vpn,router server must set to 1)
net.ipv4.ip_forward = 0
net.ipv6.conf.all.forwarding = 0

# Addresses of mmap base, heap, stack and VDSO page are randomized
kernel.randomize_va_space = 2

# Controls the System Request debugging functionality of the kernel
kernel.sysrq = 0

# Controls whether core dumps will append the PID to the core filename.
# Useful for debugging multi-threaded applications.
kernel.core_uses_pid = 1

# Allow for more PIDs
kernel.pid_max = 65535

# Changing Semaphore Limits
kernel.msgmni = 1024
kernel.sem = 250 256000 32 1024

# Controls the default maxmimum size of a mesage queue
kernel.msgmnb = 65535

# Controls the maximum size of a message, in bytes
kernel.msgmax = 65535

# Controls the maximum number of shared memory segments, in pages
kernel.shmall = 268435456

# Controls the maximum shared segment size, in bytes
kernel.shmmax = 268435456

# Keep at least 64MB of free RAM space available
vm.min_free_kbytes = 65535

# Controls source route verification
net.ipv4.conf.all.rp_filter = 2
net.ipv4.conf.default.rp_filter = 2

# Do not accept source routing
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Disable ICMP Redirect Acceptance
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.default.secure_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0

# Disable netfilter on bridges.
net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0

# Discourage Linux from swapping idle server processes to disk (default = 60)
vm.swappiness = 10
vm.dirty_ratio = 60
vm.dirty_background_ratio = 2

# RFC 1337 fix
net.ipv4.tcp_rfc1337 = 1

# Tweak how the flow of kernel messages is throttled.
#kernel.printk_ratelimit_burst = 10
#kernel.printk_ratelimit = 5

# --------------------------------------------------------------------
# The following allow the server to handle lots of connection requests
# --------------------------------------------------------------------

# See also http://www.nateware.com/linux-network-tuning-for-2013.html for
# an explanation about some of these parameters, and instructions for
# a few other tweaks outside this file.
# Protection from SYN flood attack.
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_syn_retries = 2
net.ipv4.tcp_synack_retries = 2

# Increase number of incoming connections that can queue up
# before dropping
net.core.somaxconn = 32768

# Handle SYN floods and large numbers of valid HTTPS connections
# https://shehab.tech/
net.ipv4.tcp_max_syn_backlog = 4096

# Increase the length of the network device input queue
net.core.netdev_max_backlog = 16384

# Increase system file descriptor limit so we will (probably)
# never run out under lots of concurrent requests.
# (Per-process limit is set in /etc/security/limits.conf)
fs.file-max = 209708

# Widen the port range used for outgoing connections
net.ipv4.ip_local_port_range = 1024 65535

# Increasing the amount of inotify watchers
fs.inotify.max_user_watches = 524288

# --------------------------------------------------------------------
# The following help the server efficiently pipe large amounts of data
# --------------------------------------------------------------------

# Disable source routing and redirects
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0

# Avoid falling back to slow start after a connection goes idle
# keeps our cwnd large with the keep alive connections (kernel > 3.6)
net.ipv4.tcp_slow_start_after_idle = 0

# Controls TCP Packetization-Layer Path MTU Discovery
net.ipv4.tcp_mtu_probing = 1

# Turn on the tcp_window_scaling
net.ipv4.tcp_window_scaling = 1

# Turn on the tcp_timestamps, accurate timestamp make TCP congestion control algorithms work better
net.ipv4.tcp_timestamps = 1

# Enable the TCP selective acks option for better throughput
net.ipv4.tcp_sack = 1

# Change Congestion Control
# Use BBR TCP congestion control and set tcp_notsent_lowat to 16384 to ensure HTTP/2 prioritization works optimally
# Do a 'modprobe tcp_bbr' first (kernel > 4.9)
# Fall-back to htcp if bbr is unavailable (older kernels)
net.ipv4.tcp_congestion_control = htcp
net.ipv4.tcp_congestion_control = bbr
# bbr + fq for edge compute
net.core.default_qdisc = fq
# if kernel >= 4.13
# bbr + fq_codel better for general purose
#net.core.default_qdisc = fq_codel
# bbr + cake better for WAN/Internet gateway
#net.core.default_qdisc = cake
net.ipv4.tcp_notsent_lowat = 16384

# Increase the maximum amount of option memory buffers
net.core.optmem_max = 65535

# Increase Linux autotuning TCP buffer limits
# Set max to 16MB (16777216) for 1GE
# 32M (33554432) or 64M (67108864) for 10GE
# 128M (134217728) or 256M (268435456) for 40GE
# Don't set tcp_mem itself! Let the kernel scale it based on RAM.

# Increase the read-buffer space allocatable
net.ipv4.tcp_rmem = 8192 87380 33554432
net.ipv4.udp_rmem_min = 16384
net.core.rmem_default = 262144
net.core.rmem_max = 67108864

# Increase the write-buffer-space allocatable
net.ipv4.tcp_wmem = 8192 65536 33554432
net.ipv4.udp_wmem_min = 16384
net.core.wmem_default = 262144
net.core.wmem_max = 67108864

# If your servers talk UDP, also up these limits
net.ipv4.udp_rmem_min = 16384
net.ipv4.udp_wmem_min = 16384

# --------------------------------------------------------------------
# The following allow the server to handle lots of connection churn
# --------------------------------------------------------------------

# Increase the tcp-time-wait buckets pool size to prevent simple DOS attacks
net.ipv4.tcp_max_tw_buckets = 1440000

# Timeout broken connections faster (amount of time to wait for FIN)
net.ipv4.tcp_fin_timeout = 7

# Try to reuse time-wait connections, but don't recycle them (recycle can break clients behind NAT)
net.ipv4.tcp_tw_recycle = 0
net.ipv4.tcp_tw_reuse = 1

# Decrease the time default value for connections to keep alive
# Disconnect dead TCP connections after 600+(60*10) seconds
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_keepalive_probes = 60
net.ipv4.tcp_keepalive_intvl = 10

# This will enusre that immediatly subsequent connections use the new values
net.ipv4.route.flush = 1
net.ipv6.route.flush = 1