sysctl — runtime kernel tuning · Linux

The kernel exposes hundreds of tunable parameters through the /proc/sys/ filesystem. Reading and setting these parameters is how a sysadmin tunes the kernel at runtime — no recompile, no reboot, just a sysctl call.

Reading sysctl values

Read-only / Safesysctl— sysctl KEY returns the current value of one parameter. sysctl -a returns all of them — a long list grouped by subsystem (abi, debug, dev, fs, kernel, net, vm).

$ sysctl net.ipv4.ip_forward; sysctl -a | head -10

net.ipv4.ip_forward = 0
abi.vsyscall32 = 1
debug.exception-trace = 1
dev.hpet.max-user-freq = 64
dev.parport.default = 0x3bc
...

Illustrative output

The sysctl namespace mirrors the /proc/sys/ directory:

net.ipv4.ip_forward    =   /proc/sys/net/ipv4/ip_forward
vm.swappiness          =   /proc/sys/vm/swappiness
kernel.pid_max         =   /proc/sys/kernel/pid_max

Read-only / Safesysctl security-relevant— A subset of the production-relevant sysctl parameters. tcp_syncookies protects against SYN flood. rp_filter is reverse-path filtering (anti-spoofing). somaxconn is the listen() backlog maximum. swappiness tunes kernel preference for swap.

$ sysctl net.ipv4.tcp_syncookies net.ipv4.conf.all.rp_filter net.core.somaxconn vm.swappiness

net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.rp_filter = 1
net.core.somaxconn = 4096
vm.swappiness = 60

Illustrative output

Setting at runtime

Configuration changeset sysctl— sysctl -w KEY=VALUE sets the parameter at runtime. The change takes effect immediately and persists until the next reboot. To make the change persist across reboots, write it to /etc/sysctl.d/ — see the next section.

$ sudo sysctl -w net.ipv4.ip_forward=1

net.ipv4.ip_forward = 1

Illustrative output

Persisting changes

There are three places to put persistent sysctl values:

/etc/sysctl.conf — the legacy single-file configuration.
/etc/sysctl.d/*.conf — the modern modular configuration. Each file is read in lexical order.
Runtime drop-ins via systemd-sysctl for transient values.

Configuration changepersist sysctl— Write the sysctl values to /etc/sysctl.d/99-production.conf (or your naming convention). sysctl --system reads every file in /etc/sysctl.d/, /run/sysctl.d/, and /usr/lib/sysctl.d/ in order and applies them. Add the file to version control.

$ sudo tee /etc/sysctl.d/99-production.conf >/dev/null <<'EOF'
# Production sysctl overrides

# Network: enable IP forwarding (for router/gateway hosts)
net.ipv4.ip_forward = 1

# TCP: harden against SYN flood
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 4096

# Reverse-path filtering
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Kernel: allow more PIDs for high-forking services
kernel.pid_max = 4194304

# VM: tune swappiness for database hosts
vm.swappiness = 10
EOF
sudo sysctl --system

Production-relevant sysctl parameters

Subsystem	Parameter	Meaning	Production value
net.ipv4	ip_forward	IP forwarding	1 for routers/gateways, 0 otherwise
net.ipv4	tcp_syncookies	SYN flood protection	1 (enable)
net.ipv4	conf.all.rp_filter	Reverse-path filtering	1 (enable)
net.ipv4	conf.all.accept_source_route	Source-routed packets	0 (disable)
net.ipv4	conf.all.accept_redirects	Accept ICMP redirects	0 everywhere, routers included
net.ipv4	conf.all.secure_redirects	Accept redirects from default gateways only	0 — narrower than accepting all, still unauthenticated
net.ipv4	conf.all.send_redirects	Emit ICMP redirects	0 on hosts; 1 only on a router that is deliberately the redirect authority for its segment
net.ipv4	icmp_echo_ignore_broadcasts	Ignore pings to broadcast	1 (smurf protection)
net.ipv4	tcp_max_syn_backlog	SYN backlog	4096+ for high-traffic
net.core	somaxconn	listen() backlog	4096+ for high-traffic
kernel	pid_max	Maximum PID	4194304 for high-forking
kernel	threads-max	Maximum threads	pid_max × 4 typically
vm	swappiness	Swap preference	10-60 depending on workload
fs	file-max	Maximum open files	matches systemd LimitNOFILE
fs	nr_open	Maximum per-process open files	matches systemd LimitNOFILE

A router is the worst place to accept ICMP redirects, not the best

The intuition that “routers do routing, so routers should accept routing information” is backwards here. An ICMP redirect is unauthenticated: any host on the same segment can emit one and install a route in your kernel’s cache. On an ordinary host that is a man-in-the-middle primitive. On a forwarding host it is worse, because the poisoned route is applied to everyone’s traffic, not just the router’s own.

Accepting redirects is not how a router learns paths. That is the routing protocol’s job — OSPF, BGP, or a static configuration — all of which authenticate their peers. Set accept_redirects = 0 and secure_redirects = 0 on every host in the estate, including the routers.

send_redirects is the separate question of whether this host tells others about a better path. That is legitimate router behaviour and is the one knob that may be 1, on a router that is intentionally the redirect authority for its segment. It is 0 everywhere else.

Kernel hardening with sysctl carries the full hardening set these values belong to.

Read-only / Safesystemd-sysctl— systemd-sysctl is the systemd service that applies sysctl values at boot. Reading the journal shows which values were applied and whether any failed. systemd-sysctl --cat-config shows the merged configuration from all sources.

$ systemd-sysctl

Aug  9 12:00:01 host systemd-sysctl[1234]: Successfully applied sysctl: net.ipv4.ip_forward=1
Aug  9 12:00:01 host systemd-sysctl[1234]: Successfully applied sysctl: kernel.pid_max=4194304
...

Illustrative output

Investigating “sysctl did not persist”

Read-only / Safeverify sysctl— When a sysctl value does not seem to persist across a reboot, check: (1) was the value written to /etc/sysctl.d/ or only set at runtime? (2) was sysctl --system run after writing? (3) is the value overridden by another file (later files win)?

$ sudo sysctl net.ipv4.ip_forward; cat /proc/sys/net/ipv4/ip_forward; sudo sysctl --system 2>&1 | head

...

Illustrative output

Read the current value before changing: sysctl KEY
Set at runtime to test: sysctl -w KEY=VALUE
Persist in /etc/sysctl.d/ with a high-priority filename (90-, 99-)
**Apply with sysctl --system** and verify the value is now what you want
Add the file to version control (git, etckeeper, configuration management)
Document the rationale for non-default values; future operators need to know why

Reading sysctl values

Setting at runtime

Persisting changes

Production-relevant sysctl parameters

Investigating “sysctl did not persist”

Knowledge check