Linux Performance Tuning with sysctl Parameters

What Is sysctl?

sysctl is the interface for reading and modifying Linux kernel parameters at runtime. These parameters live in the /proc/sys/ virtual filesystem and control everything from TCP buffer sizes to virtual memory behavior to filesystem caching.

Tuning these parameters can significantly improve performance for specific workloads — web servers, databases, high-traffic proxies, and more. However, incorrect values can degrade performance or destabilize your system, so always benchmark before and after changes.

Reading and Setting Parameters

# Read a single parameter
sysctl net.ipv4.tcp_max_syn_backlog
# net.ipv4.tcp_max_syn_backlog = 128

# Read all parameters
sysctl -a

# Set a parameter temporarily (lost on reboot)
sudo sysctl -w net.ipv4.tcp_max_syn_backlog=4096

# Equivalent: write directly to /proc/sys
sudo sh -c 'echo 4096 > /proc/sys/net/ipv4/tcp_max_syn_backlog'

# Set a parameter permanently
echo "net.ipv4.tcp_max_syn_backlog = 4096" | sudo tee -a /etc/sysctl.d/99-custom.conf
sudo sysctl --system   # reload all config files

Configuration files are loaded from these directories in order:

• /etc/sysctl.d/*.conf
• /run/sysctl.d/*.conf
• /usr/lib/sysctl.d/*.conf
• /etc/sysctl.conf (legacy, use /etc/sysctl.d/ instead)

Network Tuning

TCP Connection Handling

For web servers and load balancers handling thousands of connections:

# /etc/sysctl.d/90-network.conf

# Increase the SYN backlog for high-traffic servers
net.ipv4.tcp_max_syn_backlog = 4096

# Increase the connection backlog
net.core.somaxconn = 4096

# Enable SYN cookies to mitigate SYN flood attacks
net.ipv4.tcp_syncookies = 1

# Reduce TIME_WAIT sockets (useful for proxies/load balancers)
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 15

# Increase the maximum number of tracked connections
net.netfilter.nf_conntrack_max = 262144

# Increase local port range for outbound connections
net.ipv4.ip_local_port_range = 1024 65535

TCP Buffer Sizes

For high-throughput applications (file transfers, streaming, databases):

# Increase TCP buffer sizes (min, default, max in bytes)
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216

# Increase the maximum socket buffer sizes
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.rmem_default = 262144
net.core.wmem_default = 262144

# Increase the network device backlog (for high-speed NICs)
net.core.netdev_max_backlog = 5000

# Enable TCP window scaling
net.ipv4.tcp_window_scaling = 1

TCP Keepalive

For long-lived connections (databases, WebSockets):

# Reduce keepalive time from default 7200s (2 hours)
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_keepalive_intvl = 60
net.ipv4.tcp_keepalive_probes = 5

TCP Congestion Control

# Check available congestion control algorithms
sysctl net.ipv4.tcp_available_congestion_control
# cubic reno bbr

# Use BBR for better throughput on long-distance connections
net.ipv4.tcp_congestion_control = bbr

# Enable BBR's required fair queueing
net.core.default_qdisc = fq

BBR (Bottleneck Bandwidth and RTT) is developed by Google and can significantly improve throughput on high-latency or lossy connections.

Memory Tuning

Virtual Memory

# /etc/sysctl.d/90-memory.conf

# Swappiness: 0-100, lower = prefer killing over swapping
# For database servers, keep low to avoid swapping hot data
vm.swappiness = 10

# For servers with lots of RAM that should never swap
vm.swappiness = 1

# Percentage of system memory that can be dirty (waiting to write to disk)
vm.dirty_ratio = 20
vm.dirty_background_ratio = 5

# Or use absolute byte values (better for large-memory systems)
vm.dirty_bytes = 536870912          # 512MB
vm.dirty_background_bytes = 67108864  # 64MB

# How aggressively to reclaim memory used for VFS caches
vm.vfs_cache_pressure = 50  # default 100, lower = keep caches longer

Overcommit Settings

# 0 = heuristic overcommit (default, usually fine)
# 1 = always overcommit (risky but used by some big-data workloads)
# 2 = never overcommit more than swap + (ratio% of physical RAM)
vm.overcommit_memory = 0

# If overcommit_memory = 2, this is the percentage of RAM to allow
vm.overcommit_ratio = 80

Transparent Huge Pages

# For databases (PostgreSQL, MongoDB), THP can cause latency spikes
# Disable via sysfs (not sysctl):
echo never > /sys/kernel/mm/transparent_hugepage/enabled
echo never > /sys/kernel/mm/transparent_hugepage/defrag

Filesystem Tuning

# /etc/sysctl.d/90-filesystem.conf

# Increase the maximum number of open files system-wide
fs.file-max = 2097152

# Increase inotify watches (for file watchers, IDEs, build tools)
fs.inotify.max_user_watches = 524288
fs.inotify.max_user_instances = 1024

# Increase the maximum number of memory map areas
vm.max_map_count = 262144  # Required by Elasticsearch

Don’t forget to also set per-user limits in /etc/security/limits.conf:

# /etc/security/limits.conf
*  soft  nofile  1048576
*  hard  nofile  1048576

Security-Related Parameters

Some sysctl parameters improve security:

# /etc/sysctl.d/90-security.conf

# Disable IP forwarding (unless this is a router)
net.ipv4.ip_forward = 0

# Ignore ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# Don't send ICMP redirects
net.ipv4.conf.all.send_redirects = 0

# Enable reverse path filtering (prevent IP spoofing)
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Ignore broadcast pings (prevent Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Restrict access to kernel logs
kernel.dmesg_restrict = 1

# Restrict access to kernel pointers
kernel.kptr_restrict = 2

# Harden BPF JIT
net.core.bpf_jit_harden = 2

Workload-Specific Profiles

High-Traffic Web Server (Nginx/HAProxy)

# /etc/sysctl.d/90-webserver.conf
net.core.somaxconn = 65535
net.ipv4.tcp_max_syn_backlog = 65535
net.ipv4.ip_local_port_range = 1024 65535
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 10
net.core.netdev_max_backlog = 10000
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
fs.file-max = 2097152

Database Server (PostgreSQL/MySQL)

# /etc/sysctl.d/90-database.conf
vm.swappiness = 1
vm.dirty_ratio = 15
vm.dirty_background_ratio = 3
vm.overcommit_memory = 2
vm.overcommit_ratio = 80
net.ipv4.tcp_keepalive_time = 300
net.ipv4.tcp_keepalive_intvl = 30
net.ipv4.tcp_keepalive_probes = 5

Verifying Your Changes

Always measure the impact of your changes:

# Reload all sysctl configuration
sudo sysctl --system

# Verify a specific parameter took effect
sysctl net.ipv4.tcp_max_syn_backlog

# Check current TCP connection states
ss -s

# Monitor network buffer usage
cat /proc/net/sockstat

# Check memory pressure
cat /proc/meminfo | grep -E 'Dirty|Writeback'
vmstat 1 5

# Benchmark network throughput
iperf3 -s       # on server
iperf3 -c host  # on client

Common Pitfalls

1. Changing parameters without benchmarking — Always measure before and after. What helps one workload may hurt another.
2. Forgetting persistence — Parameters set with sysctl -w are lost on reboot. Always write to /etc/sysctl.d/.
3. Copying configurations blindly — Parameters optimized for a 256GB database server will not be appropriate for a 2GB VPS.
4. Ignoring application-level tuning — Kernel tuning is the last step. First optimize your queries, connection pools, and application architecture.
5. Setting vm.swappiness = 0 — This does not disable swap entirely on modern kernels; it makes the OOM killer more aggressive. Use 1 instead.

Summary

sysctl is a powerful tool for tuning Linux kernel behavior for your specific workload. The most commonly tuned areas are network (TCP buffers, connection backlogs, congestion control), memory (swappiness, dirty page ratios, overcommit), and filesystem (file descriptors, inotify watches). Always make changes in /etc/sysctl.d/ for persistence, benchmark before and after, and remember that kernel tuning should complement — not replace — application-level optimization.