LFCS 139 🐧 Kernel Tuning — sysctl - KandZ

⏱️ Estimated read: 10 min | |

The previous chapter covered resource limits with ulimit, which constrains what a process can consume. This chapter covers the kernel parameters that control how the operating system itself behaves under load. The sysctl command is the interface to the kernel’s tunable parameters. These parameters live in the /proc/sys virtual filesystem and control networking stacks, memory management, filesystem behavior, and security hardening. The LFCS exam tests the syntax of sysctl, the difference between transient changes and persistent configuration, and the mechanism that applies persistent settings at boot. The critical trap is that sysctl -w writes directly to /proc/sys and is lost on reboot. The persistent configuration requires a drop-in file under /etc/sysctl.d/, and the sysctl --system command applies all drop-ins in the correct order.

Key point: The sysctl command reads and writes kernel parameters. The -w flag writes a value (transient). The -a flag lists all parameters. The -p flag loads a specific file. The --system flag loads all drop-in files from the standard directories. The persistent configuration belongs in /etc/sysctl.d/ with a numeric prefix (e.g., 99-custom.conf) so that it overrides the vendor defaults. The /etc/sysctl.conf file is the legacy location and is still read, but the drop-in directory is the modern approach.

Why sysctl requires a specific mental model

The transient versus persistent problem. The sysctl -w net.ipv4.ip_forward=1 command enables IP forwarding immediately. The kernel parameter is changed, and the routing behavior is updated. But the change is written to the running kernel, not to disk. A reboot resets the parameter to the value in the persistent configuration. The /etc/sysctl.d/99-custom.conf file is the mechanism that survives the reboot. The sysctl --system command reads every file in the standard directories and applies the values in order, with later files overriding earlier ones .

The file precedence problem. The sysctl --system command reads files from multiple directories in a specific order: /etc/sysctl.conf, then /run/sysctl.d/*.conf, then /etc/sysctl.d/*.conf, then /usr/local/lib/sysctl.d/*.conf, then /usr/lib/sysctl.d/*.conf, and finally /lib/sysctl.d/*.conf . Within each directory, files are sorted lexicographically, so a file named 99-custom.conf overrides a file named 10-hardening.conf. The vendor’s files live in /usr/lib/sysctl.d/ and should never be edited directly. The administrator’s file belongs in /etc/sysctl.d/ with a high numeric prefix .

The key naming problem. The kernel parameter names use dots as separators: net.ipv4.ip_forward. The corresponding file in /proc/sys uses slashes: /proc/sys/net/ipv4/ip_forward. The sysctl command accepts either form in the configuration file. The net.ipv4.ip_forward=1 and net/ipv4/ip_forward=1 lines are equivalent . The dot form is the convention because it matches the sysctl command-line syntax.

The boot-time problem. The systemd-sysctl.service reads the drop-in files at boot and applies the values before most services start. A parameter that is required by a service (e.g., IP forwarding for a router) must be set in the persistent configuration, not in a script that runs after the service. The systemd-sysctl service is ordered before the network configuration, so the parameters are applied in time for the network stack to use them .

The trade-off. The sysctl command is immediate and reversible. The persistent configuration is delayed until the next boot or the next sysctl --system invocation. The exam tests both: the transient command for immediate testing, and the persistent file for the permanent change. A candidate who only uses sysctl -w and forgets the drop-in file fails the persistence test.

a. Reading and writing kernel parameters

The sysctl command without arguments lists the parameters that match the given prefix. The -a flag lists every parameter in the kernel.

# List all parameters
sysctl -a

# List a specific parameter
sysctl net.ipv4.ip_forward

# List a collection of parameters
sysctl net.ipv4.conf.all

# Write a value (transient)
sudo sysctl -w net.ipv4.ip_forward=1

# Write a value with the alternate syntax
sudo sysctl -w net/ipv4/ip_forward=1

The sysctl -a output is large. The grep filter narrows it to the relevant parameters. The sysctl net.ipv4.conf.all form lists every parameter under that prefix, which is useful for inspecting the current state of a network stack .

The -w flag writes the value. The change is applied to the running kernel immediately. The parameter is visible in /proc/sys and in the sysctl output. The change is lost on reboot unless the persistent configuration is updated.

b. Persistent configuration with drop-in files

The persistent configuration is a file in /etc/sysctl.d/. The file name should start with a high number to override the vendor defaults.

# Create a custom drop-in
sudo tee /etc/sysctl.d/99-custom.conf <<'EOF'
net.ipv4.ip_forward = 1
vm.swappiness = 10
net.core.somaxconn = 4096
EOF

# Apply all drop-in files
sudo sysctl --system

The 99-custom.conf file is read after the vendor files in /usr/lib/sysctl.d/, so the values override the defaults. The --system flag reads every file in the standard directories and applies the values. The output shows each file as it is processed and each parameter as it is set .

The sysctl -p command loads a specific file. The sysctl -p /etc/sysctl.d/99-custom.conf applies only that file. The --system flag is the correct command for applying the full configuration.

The -p flag with no argument reads /etc/sysctl.conf, which is the legacy location. The drop-in directory is the modern approach because it allows multiple packages to ship their own files without editing a shared file.

c. Common tunables and their purposes

The kernel parameters are organized by subsystem. The net.* parameters control the networking stack. The vm.* parameters control memory management. The fs.* parameters control filesystem behavior. The kernel.* parameters control global kernel behavior.

# Networking: IP forwarding (for routers)
net.ipv4.ip_forward = 1

# Networking: TCP syncookies (SYN flood protection)
net.ipv4.tcp_syncookies = 1

# Networking: maximum socket backlog
net.core.somaxconn = 4096

# Memory: swappiness (0-100, lower = less swapping)
vm.swappiness = 10

# Memory: overcommit policy
vm.overcommit_memory = 0

# Filesystem: maximum file descriptors
fs.file-max = 2097152

# Filesystem: inotify watches per user
fs.inotify.max_user_watches = 524288

The net.ipv4.ip_forward parameter is required for a system that acts as a router or a VPN gateway. The net.ipv4.tcp_syncookies parameter protects against SYN flood attacks. The net.core.somaxconn parameter sets the maximum number of pending connections for a listening socket, which is important for high-traffic web servers .

The vm.swappiness parameter controls how aggressively the kernel swaps out anonymous memory. A value of 10 makes the kernel prefer the filesystem cache over swapping, which is the common recommendation for servers . The fs.file-max parameter sets the system-wide maximum number of file descriptors, which is the upper bound for the per-process nofile limit .

Complete Example Session

# ============================================
# PART 1: READ A PARAMETER
# ============================================

sysctl net.ipv4.ip_forward
# Output: net.ipv4.ip_forward = 0

# ============================================
# PART 2: WRITE A PARAMETER (TRANSIENT)
# ============================================

sudo sysctl -w net.ipv4.ip_forward=1
# Output: net.ipv4.ip_forward = 1

# ============================================
# PART 3: VERIFY THE CHANGE
# ============================================

cat /proc/sys/net/ipv4/ip_forward
# Output: 1

# ============================================
# PART 4: CREATE A PERSISTENT DROP-IN
# ============================================

sudo tee /etc/sysctl.d/99-custom.conf <<'EOF'
net.ipv4.ip_forward = 1
vm.swappiness = 10
EOF

# ============================================
# PART 5: APPLY ALL DROP-INS
# ============================================

sudo sysctl --system
# Output: * Applying /etc/sysctl.d/99-custom.conf ...
#         net.ipv4.ip_forward = 1
#         vm.swappiness = 10

# ============================================
# PART 6: VERIFY THE PERSISTENT VALUE
# ============================================

sysctl vm.swappiness
# Output: vm.swappiness = 10

# ============================================
# PART 7: LIST NETWORK PARAMETERS
# ============================================

sysctl net.ipv4.conf.all
# Lists all parameters under the prefix.

# ============================================
# PART 8: CHECK THE DROP-IN ORDER
# ============================================

ls /etc/sysctl.d/
# 99-custom.conf

# ============================================
# PART 9: REMOVE THE DROP-IN
# ============================================

sudo rm /etc/sysctl.d/99-custom.conf
sudo sysctl --system
# The parameter returns to the default.

The nine parts trace the sysctl workflow: read, write transient, verify, create persistent, apply, verify persistent, list, check order, and remove.

Quick Reference

`sysctl` Options

Option	Purpose
`-a`	List all parameters
`-w key=value`	Write a value (transient)
`-p [file]`	Load a file (default `/etc/sysctl.conf`)
`--system`	Load all drop-in files
`key`	Read a specific parameter

Configuration Paths

Path	Purpose
`/etc/sysctl.conf`	Legacy global config
`/etc/sysctl.d/*.conf`	Administrator drop-ins
`/usr/lib/sysctl.d/*.conf`	Vendor drop-ins
`/run/sysctl.d/*.conf`	Runtime drop-ins

Common Tunables

Parameter	Purpose
`net.ipv4.ip_forward`	Enable IP forwarding
`net.ipv4.tcp_syncookies`	SYN flood protection
`net.core.somaxconn`	Max socket backlog
`vm.swappiness`	Swap aggressiveness
`fs.file-max`	Max file descriptors

Precedence

Order	Directory
1 (first)	`/etc/sysctl.conf`
2	`/run/sysctl.d/`
3	`/etc/sysctl.d/`
4	`/usr/local/lib/sysctl.d/`
5 (last)	`/usr/lib/sysctl.d/`

Best Practices

✅ Do This:

sudo sysctl -w net.ipv4.ip_forward=1
<!-- Test the change transiently -->                 # ✅

sudo tee /etc/sysctl.d/99-custom.conf
<!-- Persist in a drop-in file -->                   # ✅

sudo sysctl --system
<!-- Apply all drop-ins -->                          # ✅

❌ Don’t Do This:

# Edit /usr/lib/sysctl.d/ files
<!-- Vendor files are overwritten on upgrade -->     # ❌

# Rely on sysctl -w for persistence
<!-- Lost on reboot -->                              # ❌

# Edit /etc/sysctl.conf directly
<!-- Drop-in files are preferred -->                 # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Parameter lost after reboot	Used `-w` only	Create drop-in file
Drop-in not applied	No `--system`	Run `sysctl --system`
Overridden by vendor	Low numeric prefix	Use `99-` prefix
Parameter not found	Kernel module not loaded	Load the module first
Change breaks service	No testing	Test with `-w` first

Real-World Examples

1. Read a Parameter

sysctl net.ipv4.ip_forward

2. Write Transient

sudo sysctl -w net.ipv4.ip_forward=1

3. Create Drop-in

sudo tee /etc/sysctl.d/99-custom.conf

4. Apply All

sudo sysctl --system

5. List All

sysctl -a | grep swappiness

6. List a Prefix

sysctl net.ipv4.conf.all

7. Load a File

sudo sysctl -p /etc/sysctl.d/99-custom.conf

8. Enable IP Forwarding

net.ipv4.ip_forward = 1

9. Reduce Swappiness

vm.swappiness = 10

10. Increase Socket Backlog

net.core.somaxconn = 4096

Visual

Transient vs Persistent

┌──────────────────────────────────────────────┐
│  sysctl -w net.ipv4.ip_forward=1            │
│  → Immediate change                          │
│  → Lost on reboot                            │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  /etc/sysctl.d/99-custom.conf               │
│  → Applied at boot                           │
│  → Survives reboot                           │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  sysctl --system                             │
│  → Applies all drop-ins now                  │
└──────────────────────────────────────────────┘

Drop-in Precedence

┌──────────────────────────────────────────────┐
│  /etc/sysctl.conf        (first, lowest)     │
│  /run/sysctl.d/                            │
│  /etc/sysctl.d/          (admin)           │
│  /usr/local/lib/sysctl.d/                  │
│  /usr/lib/sysctl.d/      (vendor, highest)  │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Later files override earlier files.         │
│  Lexicographic order within each directory.  │
└──────────────────────────────────────────────┘

Summary

Item	Value
Kernel parameter interface	`sysctl`
Virtual filesystem	`/proc/sys`
Transient write	`sysctl -w key=value`
Read a key	`sysctl key`
List all	`sysctl -a`
Apply all drop-ins	`sysctl --system`
Administrator drop-in	`/etc/sysctl.d/99-custom.conf`
Vendor drop-in	`/usr/lib/sysctl.d/`
Boot service	`systemd-sysctl.service`

Key takeaways:

sysctl -w is transient. It changes the running kernel, but the change is lost on reboot. The persistent configuration requires a drop-in file under /etc/sysctl.d/ and the sysctl --system command to apply it .
The drop-in directory is the modern configuration mechanism. The /etc/sysctl.conf file is the legacy location. The drop-in files allow multiple packages to ship their own settings without editing a shared file. The administrator’s file should have a high numeric prefix to override the vendor defaults .
The precedence is last-wins. The sysctl --system command reads files in a specific order, and later files override earlier ones. The vendor files in /usr/lib/sysctl.d/ are read last, so a vendor file with a higher numeric prefix can override the administrator’s file if the names collide .
The net.* tunables control the networking stack. The net.ipv4.ip_forward enables routing. The net.ipv4.tcp_syncookies protects against SYN floods. The net.core.somaxconn sets the socket backlog .
The vm.* tunables control memory management. The vm.swappiness controls swap aggressiveness. The vm.overcommit_memory controls memory allocation policy. The fs.file-max sets the system-wide file descriptor limit .

Remember: sysctl is the kernel tuning interface. The -w flag is the transient change. The /etc/sysctl.d/ directory is the persistent configuration. The --system flag is the apply command. The net.*, vm.*, and fs.* prefixes are the subsystems. The exam tests the syntax and the persistence mechanism.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!