Tuning the Linux configuration file

First, the principle of working principle of limits.conf

limits.conf file is actually Linux PAM (plug-in authentication module, pluggable authentication Modules) pam_limits.so configuration file, break through the system's default limits, to the system access to resources have a certain protection role. The difference between limits.conf and sysctl.conf is that limits.conf is for the user, and sysctl.conf is for the entire system parameter configuration.

Limits.conf is pam_limits.so the configuration file, and then /etc/pam.d/ the next application calls the pam_***.so module. For example, when the user accesses the server, the service program sends the request to the PAM module, and the PAM module selects a corresponding service file in the directory according to the service name /etc/pam.d , and then selects the specific PAM module for processing according to the contents of the service file.

File format

username| @groupname   Type  Resource  

1) username| @groupname

Set the user name that needs to be restricted, the group name is preceded by the @ and the user name differs. You can also use the wildcard character * to restrict all users

2) Type

Types are Soft,hard and-

• Soft refers to the setting value that the current system is in effect
• Hard indicates the maximum value that can be set in the system, the soft limit can not be higher than the hard limit
• -Indicates that both soft and hard values are set.

3) Resource: Indicates the resource to be restricted

• Core-limits the size of the kernel file
• Core file: When a program crashes, the stored image of the process is copied from the core files in the current working directory of the process. The core file is simply a memory image (plus debugging information), which is used primarily for debugging purposes. The core file is a binary file that requires a tool to parse the memory image when the program crashes, and the system default core file size is 0, so it is not created. You can use the Ulimit command to view and modify the size of the core file. #ulimit-c 0 #ulimit-C #ulimit-C Unlimited Note: If you want the modification to take effect permanently, you need to modify the configuration file, such as. Bash_profile,/etc/profile, or/etc/security/ Limits.conf
• Date-Maximum data size
• Fsize-Maximum file size
• Memlock-Maximum lock memory address space
• Nofile-Maximum number of open files
• For applications that need to make many socket connections and leave them open, it is best to set the number of file descriptors higher than the default values for the user by using Ulimit-n or by setting the Nofile parameter.
• RSS-Maximum Persistent setting size
• Stack-Maximum stack size
• CPU-Maximum CPU time in minutes
• Noproc-Maximum number of processes
• As-address space limitations
• Maxlogins-Maximum number of logons allowed by this user

Example

Limit admin users to log on to sshd for no more than 2 services

echo Session required pam_limits.so >>/etc/pam.d/sshd echo admin-maxlogins 2 >>/etc/security/limits.conf

• See if the application can be supported by Pam with LDD
• The same limits.conf to be used must be guaranteed to have the following/etc/pam.d/login: Session required Pam_limits.so

Set up

• For the time being, the Ulimit command
• Permanent, by adding a corresponding Ulimit statement to one of the files read by the login shell (for example, ~/.profile), a shell-specific user resource file, or by editing the/etc/security/limits.conf

Second, Ulimit

Ulimit is used to limit the resources that the shell startup process consumes, and supports the following types of restrictions: the size of the kernel file created, the size of the process data block, the size of the shell process creation file, the size of the memory lock, the size of the resident memory set, the number of open file descriptors, The maximum size of the allocation stack, the CPU time, the maximum number of threads for a single user, and the maximum virtual memory that the Shell process can use. At the same time, it supports the limitations of hard and soft resources

As a temporary limitation, ulimit can be used for shell sessions that are logged on by using its command, ending the limit at the end of the session and not affecting other shell sessions. For long-term fixed limits, the Ulimit command statement can also be added to a file read by the login shell, acting on a specific shell user

• Only for the current TTY (terminal valid), in order to take effect each time, you can put the Ulimit parameter to the corresponding user. Bash_profile inside
• The Ulimit command itself has a soft and hard setting, plus-H is hard, plus-S is a soft
• The default display is the soft limit, if you run the Ulimit command changes when not added, it is two parameters together to change the effect

The Ulimit command is used to restrict system user access to shell resources, which are explained in common parameters

Ulimit (option)-A: Displays the current resource limit settings;-c <core file cap;: Sets the maximum value of the core file in chunks;-D < data section size;: Maximum value of the Program Data section, in kb;-f < file size >:shell the largest file that can be created, in chunks;-H: Sets the hard limit for resources, which is the limit set by the administrator;-m < memory size: Specifies the upper limit of memory that can be used, in kb;-n < number of files > : Specifies the maximum number of files that can be opened at the same time;-p < buffer size;: Specifies the size of the pipe buffer, in 512 bytes;-s < stack size;: Specifies the upper limit of the stack, in kb;-s: Sets the elastic limit for the resource;-T <cpu time > : Specifies the upper limit of CPU usage time in seconds;-U < Program number: Number of programs that can be opened by the user;-v < virtual memory Size: Specifies the maximum amount of virtual memory that can be used, in kilobytes.

Linux is a file handle limit, and Linux default is not very high, generally 1024, production server is actually very easy to reach this number

System restricted files in/proc/sys/fs/file-max,/PROC/SYS/FS/FILE-NR

/proc/sys/FS/file-max

Determines the maximum number of file handles that the current kernel can open

The value of File-max denotes the maximum number of file handles that the Linux kernel would allocate. When you get a lot of the error messages about running out of the file handles, you might want to raise this limit.  The default value is 10% of RAM in kilobytes. To change it, just write the new number into the file

This means that File-max is generally calculated as 10% of the memory size (KB), which can be computed if the shell is used

Grep-r Memtotal/proc/meminfo | awk ' {printf ("%d", $2/10)} '

/proc/sys/fs/file-nr

Historically, the three values in FILE-NR denoted the number of allocated file handles, the number of allocated but UNU SED file handles, and the maximum number of file handles. Linux 2.6 Always reports 0 as the number of a free file handles--This is not a error, it just means that number O F allocated file handles exactly matches the number of used file handles.

When looking for file handle problems, there is a very useful program lsof. It is convenient to see that a process has opened those handles. You can also see what process is taking up a file/directory.

Lsof-n |awk ' {print $} ' |sort|uniq-c |sort-nr|more

You can see it by logging in again, using ulimit-a to view the confirmation

Set up

• For all user settings, in the/etc/security/limits.conf file, it can be the system users, groups CPU, the number of files, etc., through which can be limited to a user or all. But not beyond the limits of the system;
• (* indicates that all users, soft means can be exceeded, but only warning; hard means absolutely cannot exceed, unlimited is used to express unlimited) if you want to set all users, you can also put in the/etc/profile file, the following is the default parameters in the file: Ulimit- S-c 0 >/dev/null 2>&1

Modify Ulimit Maximum Limit

1) Modify with command

Query the number of file handles for the current terminal: Ulimit-n carriage return, general system default of 1024.

The number of modified file handles is 65535,ulimit-n 65535. The number of file handles for this system is 65535.

2) Add the Ulimit value to the/etc/profile file (for systems with root login)

To get a larger ulimit value each time the system restarts, add ulimit to the bottom of the/etc/profile file

echo Ulimit-n 65535 >>/etc/profilesource/etc/profileulimit-n

3) OK, a lot of friends think it's done, can suddenly find themselves again log in, Ulimit value or 1024, this is why?

The key reason is that you log on the user is what identity, is not the root user, because the server root user rights are very large, generally can not be used to log in, are through their own login permissions to log in, and through the sudo mode to switch to the root user to work. The order in which the SH script executes when the user logs in:

/etc/profile.d/file/etc/profile/etc/bashrc/home/.admin/.bashrc/home/.admin/.bash_profile

Because the Ulimit-n script command is loaded in the second part, the user log in because of the permission reason in the second step can not complete the ulimit modification, so ulimit value is the system default 1024

Workaround: Modify the Linux hardware and software limitations file

Echo ' * Soft nproc 11000* hard nproc 11000* soft nofile 655350* hard nofile 655350 ' >>/etc/security/limits.conf

4) After the above modification, in some systems, with the general user re-landing, still no modification, then need to check whether there are the following files, if not, then add the following:

echo Session required/lib/security/pam_limits.so >>/etc/pam.d/sshdservice sshd Reload

5) If it still does not work, then the following file needs to be modified

echo useprivilegeseparation no >>  /etc/ssh/sshd_config

What's the difference between Ulimit-n And/proc/sys/fs/file-max?

1, File-max is the kernel level, all the process sum cannot exceed this number

2, Ulimit is the process level of the other

[Email protected]:~$ ulimit-n1024[email protected]:~$ lsof | grep me | Wc-l8145#!/usr/bin/perl$count = 0; @filedescriptors; while ($count <=) {    $FILE = ${count};    Open $FILE, ">", "/tmp/example$count" or Die "\ n FDs: $count $!";    Push (@filedescriptors, $FILE);    $count + +;} fds:1021 Too many open files at./test.pl Line 8.//1021 because there were 3 open file descriptors before reaching the While loop (stdout, stdin and stderr)

Third, close the IPV6

So far we do not need IPv6, the system after installation is self-brought and opened, we need to close

Ifconfig | grep Inet6 |  | lsmod | grep ipv6

1, if appear inet6 addr ... The words, the description is installed

2. Display kernel-loaded IPv6 related modules

Disable with the following command

Sed-i ' s/^networking_ipv6=yes/networking_ipv6=no/'/etc/sysconfig/networkecho ' Alias net-pf-10 offalias ipv6 off ' > >/etc/modprobe.d/dist.confchkconfig ip6tables off

Iv. working principle of sysctl.conf

The sysctl command is used to dynamically modify the kernel's running parameters while the kernel is running, and the available kernel parameters are in the directory /proc/sys the. It contains advanced options for both the TCP/IP stack and the virtual memory system, which allows experienced administrators to improve compelling system performance. More than 500 system variables can be read with Sysctl

sysctl.conf settings

It's a sysctl.conf on the web. Optimized configuration sysctl.conf settings

#禁用包过滤功能net. Ipv4.ip_forward = 0# Enable source routing verification Function Net.ipv4.conf.default.rp_filter = # Disables all IP source routes net.ipv4.conf.default.accept _source_route = 0# Using the SYSRQ key is to understand the current operation of the system, for the sake of security set to 0 off KERNEL.SYSRQ = 0# control of the core file name is added pid as extension kernel.core_uses_pid = Turn on SYN cookies when a SYN wait queue overflows, enable Cookies to handle net.ipv4.tcp_syncookies = # size per message Queue (in bytes) Limit KERNEL.MSGMNB = 65536# Maximum Message Queuing limit for the entire system Kernel.msgmax = 65536# size of a single shared memory segment (in bytes) limit, calculation formula 64g*1024*1024*1024 (bytes) Kernel.shmmax = 68719476736# All Memory Size (units: page, 1 pages = 4Kb), Calculation Formula 16G*1024*1024*1024/4KB (page) Kernel.shmall = number of 4294967296#timewait, default is 180000net.ipv4.tcp_ Max_tw_buckets = 6000# Turn on selective answer Net.ipv4.tcp_sack = # support for larger TCP windows. If the TCP window is greater than 65535 (64K), you must set the value to 1net.ipv4.tcp_window_scaling = 1#tcp Read Buffernet.ipv4.tcp_rmem = 4096 131072 1048576# TCP Write Buffernet.ipv4.tcp_wmem = 4096 131072 1048576# for TCP socket reserved memory default value (in bytes) for send buffer Net.core.wmem_default = 8388608# The maximum amount of memory (in bytes) reserved for a TCP socket for sending buffers Net.core.wmem_max = 16777216# for TCP socket reserved memory default value (in bytes) for receive buffering Net.core.rmem_default = 8388608# is reserved for TCP sockets for the maximum amount of memory to receive bufferingValue (in bytes) Net.core.rmem_max = 16777216# The maximum number of packets that are allowed to be sent to a queue when each network interface receives a packet at a rate that is faster than the rate at which the kernel processes these packets Net.core.netdev_max_backlog = The backlog for the LISTEN function in the 262144#web application limits the net.core.somaxconn of our kernel parameters to 128, while the Ngx_listen_backlog default for Nginx defines 511. So it is necessary to adjust this value Net.core.somaxconn = The maximum number of TCP sockets in the 262144# system is not associated with any one of the user file handles. This limit is only to prevent a simple Dos attack, can not rely too much on it or artificially reduce the value, it should increase this value (if memory is increased) Net.ipv4.tcp_max_orphans = 3276800# Record the maximum number of connection requests that have not received the client acknowledgment information. For systems with 128M of memory, the default value is 1024, and the small memory system is 128net.ipv4.tcp_max_syn_backlog = 262144# timestamp prevents winding of the serial number. A 1Gbps link will definitely encounter a previously used serial number. Timestamps allow the kernel to accept this "exception" packet. You need to turn it off here. Net.ipv4.tcp_timestamps = 0# in order to open the connection to the end, the kernel needs to send a SYN and attach an ACK that responds to the previous syn. The second handshake in the so-called three-time handshake. This setting determines the number of Syn+ack packets sent before the kernel discards the connection net.ipv4.tcp_synack_retries = # number of SYN packets sent before the kernel abandons the connection net.ipv4.tcp_syn_retries = # Enable fast recovery of time_wait sockets in TCP connection Net.ipv4.tcp_tw_recycle = # turn on TCP connection multiplexing, allowing time_wait sockets to be reused for new TCP connections (primarily for time_ Wait connection) Net.ipv4.tcp_tw_reuse = 1#1st below this value, TCP has no memory pressure, 2nd enters the memory pressure phase, 3rdTCP refuses to allocate socket (unit: memory page) Net.ipv4.tcp_mem = 94500000 915000000 927000000# If the socket is closed by the local side, this parameter determines whether it remainsThe time in the Fin-wait-2 state. The peer can make an error and never shut down the connection, or even accidentally become a machine. The default value is 60 seconds. 2.2 The normal value of the kernel is 180 seconds, you can press this setting, but remember that even if your machine is a light-load Web server, there is a large number of dead sockets and memory overflow risk, fin-wait-2 is less dangerous than fin-wait-1, Because it can only eat up to 1.5K of memory, but they have a longer lifetime. Net.ipv4.tcp_fin_timeout = 15# indicates the frequency at which TCP sends KeepAlive messages (in seconds) when keepalive is employed net.ipv4.tcp_keepalive_time = 30# External connection port Range Net.ipv4.ip_local_port_range = 2048 65000# represents the maximum number of file handles Fs.file-max = 102400

This is the configuration I used in the actual production system Automation deployment

Net.ipv4.ip_forward = 0net.ipv4.conf.default.rp_filter = 1net.ipv4.conf.default.accept_source_route = 0KERNEL.SYSRQ = 0kernel.core_uses_pid = 1net.ipv4.tcp_syncookies = 1KERNEL.MSGMNB = 65536kernel.msgmax = 65536kernel.shmmax = 68719476736kernel.shmall = 4294967296net.ipv4.tcp_max_tw_buckets = 6000net.ipv4.tcp_sack = 1net.ipv4.tcp_window_ Scaling = 1net.ipv4.tcp_wmem = 8192 4336600 873200net.ipv4.tcp_rmem = 32768 4336600 873200net.core.wmem_default = 8388608n Et.core.rmem_default = 8388608net.core.rmem_max = 16777216net.core.wmem_max = 16777216net.core.netdev_max_backlog = 262144net.core.somaxconn = 262144net.ipv4.tcp_max_orphans = 3276800net.ipv4.tcp_max_syn_backlog = 262144net.ipv4.tcp _timestamps = 1net.ipv4.tcp_synack_retries = 1net.ipv4.tcp_syn_retries = 1net.ipv4.tcp_tw_recycle = 1net.ipv4.tcp_tw_ Reuse = 1net.ipv4.tcp_mem = 786432 1048576 1572864net.ipv4.tcp_fin_timeout = 30#net.ipv4.tcp_keepalive_time = 30net.ipv4 . Tcp_keepalive_time = 300net.ipv4.ip_local_port_range = 1024 65000

/sbin/sysctl-p finally remember that refresh takes effect immediately

Http://serverfault.com/questions/122679/how-do-ulimit-n-and-proc-sys-fs-file-max-differ

Tuning the Linux configuration file