forked from analytically/hadoop-ansible
-
Notifications
You must be signed in to change notification settings - Fork 0
/
sysctl.conf
80 lines (57 loc) · 2.28 KB
/
sysctl.conf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
# {{ ansible_managed }}
# Auto-reboot linux 10 seconds after a kernel panic
kernel.panic = 10
kernel.panic_on_oops = 10
kernel.unknown_nmi_panic = 10
kernel.panic_on_unrecovered_nmi = 10
kernel.panic_on_io_nmi = 10
# Controls whether core dumps will append the PID to the core filename, useful for debugging multi-threaded applications
kernel.core_uses_pid = 1
# Allow for more PIDs
kernel.pid_max = 4194303
# Turn off address space randomization - the servers are behind a firewall
kernel.randomize_va_space = 0
# ------ VM ------
# See http://en.wikipedia.org/wiki/Swappiness
vm.swappiness = {{ kernel_swappiness }}
# ------ VM ------
fs.file-max = 204708
fs.epoll.max_user_instances = 4096
# ------ NETWORK SECURITY ------
# Protect ICMP attacks
net.ipv4.icmp_echo_ignore_broadcasts = 1
# Turn on protection for bad icmp error messages
net.ipv4.icmp_ignore_bogus_error_responses = 1
# Turn on syncookies for SYN flood attack protection
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 4096
net.ipv4.tcp_synack_retries = 3
# Log suspicious packets, such as spoofed, source-routed, and redirect
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
# Disables these ipv4 features, not very legitimate uses
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
# ------ NETWORK PERFORMANCE ------
# don't cache ssthresh from previous connection
net.ipv4.tcp_no_metrics_save = 1
# Allow reusing sockets in TIME_WAIT state for new connections
net.ipv4.tcp_tw_reuse = 1
# Socket max connections waiting to get accepted; the listen() backlog.
# Default is 128.
net.core.somaxconn = 4096
# Enable receiver autotuning. Receiver autotuning is 'new'; sender autotuning has been around a long time.
# Default is disabled.
net.ipv4.tcp_moderate_rcvbuf = 1
# Reduce TCP retries.
# Default is 15.
net.ipv4.tcp_retries2 = 3
# Tune TCP keepalive.
net.ipv4.tcp_keepalive_time = 600
net.ipv4.tcp_keepalive_probes = 3
net.ipv4.tcp_keepalive_intvl = 30
# Decrease fin timeout. After telling the client we are closing, how long to wait for a FIN, ACK?
# Default is 60.
net.ipv4.tcp_fin_timeout = 10
# Enable TCP FAST_OPEN for client and server. Still rarely used by applications. See https://lwn.net/Articles/508865/. Default from kernel 3.13.
net.ipv4.tcp_fastopen = 3