Linux Tuning/etc/sysctl.conf

Tcp_fin_timeout #连接的超时net. Ipv4.tcp_tw_reuse #连接是否重用net. Ipv4.tcp_tw_recycle #快速回收tcp_keepalive_time #保持的时间tcp_max_ Syn_backlog#syn Maximum Queue

Description: This optimization is suitable for apache,nginx,squid a variety of Web applications, special business may also need a slight adjustment.

[[Email protected] ~]# vi /etc/sysctl.conf#by sun in 20131001net.ipv4.tcp_ fin_timeout = 2 net.ipv4.tcp_tw_reuse = 1net.ipv4.tcp_tw_recycle =  1net.ipv4.tcp_syncookies = 1net.ipv4.tcp_keepalive_time =600net.ipv4.ip_local_port_range =  4000    65000net.ipv4.tcp_max_syn_backlog = 16384net.ipv4.tcp_max_tw_ buckets = 36000net.ipv4.route.gc_timeout = 100net.ipv4.tcp_syn_retries =  1net.ipv4.tcp_synack_retries = 1net.core.somaxconn = 16384net.core.netdev_max_backlog  = 16384net.ipv4.tcp_max_orphans = 16384# The parameter is the optimization of the iptables firewall, the firewall does not have a meeting hint, can be ignored. net.ipv4.ip_conntrack_max = 25000000net.ipv4.netfilter.ip_conntrack_max =  25000000net.ipv4.netfilter.ip_conntrack_tcp_timeout_established = 180net.ipv4.netfilter.ip_conntrack _tcp_timeout_time_wait = 120net.ipv4.netfilter.ip_conntrack_tcp_timeout_close_wait = 60net.ipv4.netfilter.ip_conntrack_tcp_timeout_fin_wait =  120[[email protected] ~]# sysctl –p     #使配置文件生效

tip: Because centos6.x the module name in the system is not ip_conntrack, but nf_conntrack, so in/etc/sysctl.conf optimization, we need to net.ipv4.netfilter.ip_conntrack_max this old parameter, Change it to Net.netfilter.nf_conntrack_max.

That is, the optimization of the firewall, on 5.8 is

Net.ipv4.ip_conntrack_max = 25000000net.ipv4.netfilter.ip_conntrack_max = 25000000net.ipv4.netfilter.ip_conntrack_ tcp_timeout_established = 180net.ipv4.netfilter.ip_conntrack_tcp_timeout_time_wait = 120net.ipv4.netfilter.ip_ conntrack_tcp_timeout_close_wait = 60net.ipv4.netfilter.ip_conntrack_tcp_timeout_fin_wait = 120

On the 6.4 is

net.nf_conntrack_max = 25000000net.netfilter.nf_conntrack_max = 25000000net.netfilter.nf_ conntrack_tcp_timeout_established = 180net.netfilter.nf_conntrack_tcp_timeout_time_wait =  120net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60net.netfilter.nf_conntrack_tcp_timeout_fin_ wait = 120 

In addition, there may be errors in this optimization process:

On version 1 and 5.8

error:  "Net.ipv4.ip_conntrack_max" is an unknown keyerror:  "Net.ipv4.netfilter.ip_ Conntrack_max "is an unknown keyerror: " Net.ipv4.netfilter.ip_conntrack_tcp_timeout_ Established "is an unknown keyerror: " net.ipv4.netfilter.ip_conntrack_tcp_timeout_time_wait "is an unknown keyerror: " net.ipv4.netfilter.ip_conntrack_tcp_timeout_close_wait "is  an unknown keyerror:  "Net.ipv4.netfilter.ip_conntrack_tcp_timeout_fin_wait" is an  Unknown key 

This error may be that your firewall does not open or automatically handle the loaded module Ip_conntrack not automatically loaded, the solution is two, one is to open the firewall, and the second is to automatically handle the loaded module Ip_conntrack

Modprobe Ip_conntrackecho "Modprobe ip_conntrack" >>/etc/rc.local

On version 2 and 6.4

error:  "Net.nf_conntrack_max" isan unknown keyerror:  "Net.netfilter.nf_conntrack_max" Isan  unknown keyerror:  "Net.netfilter.nf_conntrack_tcp_timeout_established" isan unknown  keyerror:  "net.netfilter.nf_conntrack_tcp_timeout_time_wait" isan unknown keyerror:  " Net.netfilter.nf_conntrack_tcp_timeout_close_wait "isan unknown keyerror: " net.netfilter.nf_ Conntrack_tcp_timeout_fin_wait "Isan unknown key 

This error may be that your firewall does not open or automatically handle the loaded module Ip_conntrack not automatically loaded, the solution is two, one is to open the firewall, and the second is to automatically handle the loaded module Ip_conntrack

Modprobe Nf_conntrackecho "Modprobe nf_conntrack" >>/etc/rc.local

On version 3 and 6.4

Error: "Net.bridge.bridge-nf-call-ip6tables" Isan unknown Keyerror: "Net.bridge.bridge-nf-call-iptables" Isan unknown Keyerror: "Net.bridge.bridge-nf-call-arptables" Isan unknown Key

This error is due to the automatic processing of modules that can be loaded Bridge No automatic loading, the solution is to automatically process the loaded module Ip_conntrack

Modprobe Bridgeecho "Modprobe Bridge" >>/etc/rc.local

To this, our Linux system after the installation of the basic optimization has been operating almost, summed up a total of 13 optimization points need to be known to us. I'll come up with a one-click Optimized shell script to communicate with everyone.

This article comes from " Not just Linux"blog, be sure to keep this source http://nolinux.blog.51cto.com/4824967/1318607

Linux Tuning/etc/sysctl.conf