configuration-templates

Subversion Repositories:
Compare Path: Rev
With Path: Rev
?path1? @ 117  →  ?path2? @ 118
/sysctl/10-kmesg.conf
@@ -0,0 +1,2 @@
# Uncomment the following to stop low-level messages on console
kernel.printk = 3 4 1 3
/sysctl/10-reboot.conf
@@ -0,0 +1,3 @@
# Auto-reboot linux 30 seconds after a kernel panic
kernel.panic = 30
kernel.panic_on_oops = 30
/sysctl/10-security.conf
@@ -0,0 +1,10 @@
# The contents of /proc/<pid>/maps and smaps files are only visible to
# readers that are allowed to ptrace() the process
kernel.maps_protect = 1
 
# Enable ExecShield protection
kernel.exec-shield = 1
kernel.randomize_va_space = 2
 
# Hide exposed kernel pointers
kernel.kptr_restrict = 1
/sysctl/20-power.conf
@@ -0,0 +1,2 @@
# NMI hardware debugging.
kernel.nmi_watchdog = 0
/sysctl/30-swap.conf
@@ -0,0 +1,2 @@
vm.dirty_ratio = 10
vm.dirty_background_ratio = 5
/sysctl/50-jumbo.conf
@@ -0,0 +1 @@
net.ipv4.tcp_mtu_probing=1
/sysctl/50-net.conf
@@ -0,0 +1,60 @@
# Default: cubic
net.ipv4.tcp_congestion_control=htcp
 
# CoDel (Default: pfifo_fast)
# https://lwn.net/Articles/616241/
net.core.default_qdisc=fq_codel
 
# Default: 32768 60999
net.ipv4.ip_local_port_range=1025 65535
 
# TCP window scaling tries to avoid saturating the network adapter with
# incoming packets.
net.ipv4.tcp_window_scaling = 1
 
# If enabled, assume that no receipt of a window-scaling option means that
# the remote TCP is broken and treats the window as a signed quantity. If
# disabled, assume that the remote TCP is not broken even if we do not
# receive a window scaling option from it.
net.ipv4.tcp_workaround_signed_windows = 1
 
# RFC 1337, TIME-WAIT Assassination Hazards in TCP, a fix written in 1992
# for some theoretically-possible failure modes for TCP connections. To
# this day this RFC still has people confused if it negatively impacts
# performance or not or is supported by any decent router. Murphy's Law is
# that the only router that it would even have trouble with, is most likely
# your own.
net.ipv4.tcp_rfc1337 = 1
 
# TCP SACK and FACK refer to options found in RFC 2018 and are also
# documented back to Linux Kernel 2.6.17 with an experimental "TCP-Peach"
# set of functions. These are meant to get you your data without excessive
# losses.
net.ipv4.tcp_sack = 1
net.ipv4.tcp_fack = 1
 
# RFC 2923 IPv6 uses PMTU by default to avoid segmenting packets at the
# router level, but its optional for IPv4. PMTU is meant to inform routers
# of the best packet sizes to use between links, but its a common admin
# practice to block ICMP ports that allow pinging, thus breaking this
# mechanism. Linux tries to use it, and so do I: if you have problems, you
# have a problem router, and can change the "no" setting to 1. "MTU probing"
# is also a part of this: 1 means try, and 0 means don't.
net.ipv4.ip_no_pmtu_disc = 0
net.ipv4.tcp_mtu_probing = 1
 
# Don't ignore ICMP
net.ipv4.icmp_echo_ignore_all=0
net.ipv4.icmp_echo_ignore_broadcasts=0
 
# Netflix 2014 EC2 sysctl tweaks
# http://www.slideshare.net/AmazonWebServices/pfc306-performance-tuning-amazon-ec2-instances-aws-reinvent-2014
net.core.somaxconn=1000
net.core.netdev_max_backlog=5000
net.core.rmem_max=16777216
net.core.wmem_max=16777216
net.ipv4.tcp_wmem=4096 12582912 16777216
net.ipv4.tcp_rmem=4096 12582912 16777216
net.ipv4.tcp_max_syn_backlog=8096
net.ipv4.tcp_slow_start_after_idle=0
net.ipv4.tcp_tw_reuse=1
/sysctl/60-netflush.conf
@@ -0,0 +1,3 @@
# Subsequent connections use the new values
net.ipv4.route.flush = 1
net.ipv6.route.flush = 1