Boost Linux Server Performance: Essential Kernel & Sysctl Tweaks

Application systems run on an operating system, and the OS performance directly impacts application performance; this article covers key Linux performance configuration settings.

Permanently Disable SELinux

SELinux enhances security but can cause trouble; it is usually disabled.

# vim /etc/selinux/config
# change SELINUX=enforcing to SELINUX=disabled
# reboot

Set System Runlevel to 3

Running at runlevel 3 saves system resources.

# grep 3:initdefault /etc/inittab
# init 3

Increase Maximum File Descriptor Limits

# vim /etc/security/limits.conf

Edit the file to add:

* soft nofile 65536
* hard nofile 65536
* soft nproc 65536
* hard nproc 65536

Explanation:

* applies to all users.

nofile – maximum number of open files.

nproc – maximum number of processes.

Adjust Kernel Parameters in /etc/sysctl.conf

Configure network parameters to improve load capacity and address packet loss. # vim /etc/sysctl.conf Key settings:

net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_fin_timeout = 30
net.ipv4.tcp_keepalive_time = 1200
net.ipv4.ip_local_port_range = 1024 65000
net.ipv4.tcp_max_syn_backlog = 8192
net.nf_conntrack_max = 655360

tcp_syncookies enables SYN cookies to mitigate SYN‑queue overflow attacks.

tcp_tw_reuse allows TIME‑WAIT sockets to be reused for new connections.

tcp_tw_recycle enables fast recycling of TIME‑WAIT sockets.

tcp_fin_timeout sets the duration a socket stays in FIN‑WAIT‑2 after local close.

tcp_keepalive_time changes the keepalive interval from the default 2 hours to 20 minutes.

ip_local_port_range expands the outbound port range.

tcp_max_syn_backlog increases the SYN queue length.

nf_conntrack_max defines the maximum number of connection‑tracking entries.

Firewall Configuration

Add the following lines to the end of /etc/sysctl.conf (or sysctl.conf.first):

net.ipv4.tcp_tw_reuse=1
net.ipv4.tcp_tw_recycle=1
net.nf_conntrack_max = 25000000
net.netfilter.nf_conntrack_max = 25000000
net.netfilter.nf_conntrack_tcp_timeout_established = 180
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120

nf_conntrack_max determines the size of the connection‑tracking table; calculate based on RAM.

nf_conntrack_buckets sets the hash table size, typically one‑quarter of nf_conntrack_max.

nf_conntrack_tcp_timeout_established controls the timeout for ESTABLISHED connections (default 5 days, can be reduced to 1 hour).

nf_conntrack_tcp_timeout_time_wait controls the TIME‑WAIT timeout.

nf_conntrack_tcp_timeout_close_wait controls the CLOSE‑WAIT timeout.

nf_conntrack_tcp_timeout_fin_wait controls the FIN‑WAIT timeout.

Apply the changes:

# sysctl -p

Common Exceptions

Too many open files – occurs when the number of open file descriptors (including sockets) exceeds the system limit.

Solution: increase the maximum file descriptor limits as described above.

Connection timeout – often caused by excessive TIME_WAIT sockets due to improper connection closure.

Solution: fix the application code and verify kernel/network/firewall settings.

Common Commands

Check network socket states:

# netstat -n | awk '/^tcp/ {++state[$NF]} END {for(key in state) print key, "\t", state[key]}'

State descriptions:

CLOSED – no connection is active.

LISTEN – server waiting for incoming calls.

SYN_RECV – connection request received, awaiting acknowledgment.

SYN_SENT – client has initiated a connection.

ESTABLISHED – normal data transfer.

FIN_WAIT1 – local side has finished.

FIN_WAIT2 – remote side has acknowledged.

TIME_WAIT – waiting for all packets to die.

CLOSING – both sides attempting to close.

LAST_ACK – waiting for final acknowledgment.

Summary

Linux provides a rich set of kernel parameters; proper tuning can significantly boost server processing capability.