操作系统中sysctl.conf.内存篇

admin

在使用维护操作系统的时候，我们经常会涉及到很多关于内核中现在内存，文件的配置，这里我们找了很多关于内存方面的限制：
如下：
vm.max_writeback_pages = 1024
vm.flush_mmap_pages = 1
vm.pagecache = 100
vm.min_slab_ratio = 5
vm.min_unmapped_ratio = 1
3 i; D8 r' ^) C; Bvm.zone_reclaim_mode = 0
vm.swap_token_timeout = 300     0
8 X+ A$ \% e7 K! ]% Yvm.legacy_va_layout = 0

vm.vfs_cache_pressure = 100#默认值：100
#参数意义：控制内核回收再利用用于缓存目录与inode对象的内存的趁势。默认值设为100表示内核以平等的速度去考虑pagecache和swapcache的回收再利用。
2 g" T+ H9 `$ k. W* w9 e3 R5 ^4 Q#减小它，会触发内核保持目录与inodes的缓存内存。增大它，会触发内核回收再利用目录与inodes的缓存内存。

vm.block_dump = 0
vm.laptop_mode = 0
vm.max_map_count = 65536
vm.percpu_pagelist_fraction = 0
vm.min_free_kbytes = 14075
( _# c  y; k* Zvm.drop_caches = 0#默认值 ：0
#设置这个参数的值会让内核清理内存中的caches、denties、inodes，从而释放更多的内存。
3 ]0 }; \2 B0 ]( g#有三个值可以设置，每设一个值都会引发内核释放不同的内容：
/ G! ~! p9 u9 `5 I1：释放pagecache   

/ t3 b: n$ a2 {+ r3 g2 T- L2：释放denties、inodes   
6 G* }- W$ s; _2 i
* [4 K4 D$ [. @& M0 Y: k3：释放pagecache、denties、inodes
' v: T+ d' i* |! Z
# a2 H  M  g& ~#由于这是一个非破坏性操作而且脏对象不会被释放，因此应当先执行”sync“后再设置这个参数。
: R, c3 u0 t3 \4 i6 e; E( W; h
  M$ r1 i% a9 v# }8 Pvm.lowmem_reserve_ratio = 256   256     32
vm.hugetlb_shm_group = 0
: o; @/ j* E( `4 z) d; k4 n5 g9 qvm.nr_hugepages = 0
" j3 W6 F7 @( B, rvm.swappiness = 60
vm.nr_pdflush_threads = 2

9 I! Q% o& [0 o  B9 rvm.dirty_expire_centisecs = 2999#默认值：2999
( g# d( ?' J- m. u#参数意义：用来指定内存中数据是多长时间才算脏(dirty)数据。指定的值是按100算做一秒计算。只有当超过这个值后，才会触发内核进程pdflush将dirty数据写到磁盘。
4 h6 d: M& t1 n& R% C* [+ n/ Y9 l; C
8 w! `' ^, @6 l$ h7 qvm.dirty_writeback_centisecs = 499#默认值：499
* N' u6 U, p* y4 P, V' q* i4 t" l#这个参数会触发pdflush回写进程定期唤醒并将old数据写到磁盘。每次的唤醒的间隔，是以数字100算做1秒。
#如果将这项值设为500就相当5秒唤醒pdflush进程。如果将这项值设为0就表示完全禁止定期回写数据。
3 u. [7 a5 e; R3 l
8 n& ^/ i6 f+ _: ?& Xvm.mmap_min_addr = 4096
  l! S% |# e0 R& W; h: ^/ @% ?
. t( A1 Z8 k2 x+ {. lvm.dirty_ratio = 40#默认值：40
6 O" d6 ~# V, ?% k" f2 O#参数意义：控制一个在产生磁盘写操作的进程开始写出脏数据到内存缓冲区。缓冲区的值大小是系统内存的百分比。增大会使用更多系统内存用于磁盘写缓冲，可以提高系统的写性能。
  v1 e, ~5 p! n9 ?' M0 ?#当需要持续、恒定的写入场合时，应该降低该数值。
; o4 t- i+ f) q( M1 W9 m: h' J% Z
vm.dirty_background_ratio = 10#默认值 ：10
4 C7 `$ [4 E6 p2 Y1 u#参数意义：控制pdflush后台回写进程开始写出脏数据到系统内存缓冲区。缓冲区的值大小是系统内存的百分比。增大会使用更多系统内存用于磁盘写缓冲，可以提高系统的写性能。
#当需要持续、恒定的写入场合时，应该降低该数值。

vm.page-cluster = 3 #默认值为：3
9 l' ]6 M, r; w: \8 b3 m5 Y#这个参数用来控制VM的虚拟内存的，读取大量的page，同时发生page错误时，linux VM子系统为了避免过多的磁盘寻址。
#读取大量的page依赖于系统的内存。内核 一次读取page的数量等于2的page-cluster值的次方即2^page-cluster。当设的值超过2的5次方即2^5，它不会被swap所检测到。
* h5 _' X* P( a#因为swap的数据page最大为2的5次方即32-page。
$ l( d2 z5 {$ @3 ]0 q
vm.overcommit_ratio = 50#默认值为：50
#这个参数值只有在vm.overcommit_memory=2的情况下，这个参数才会生效。

1 Q$ B  Z0 |) M% G0 evm.panic_on_oom = 0#默认值 ：0
#参数意义：当超出内存时，是否开启内核崩溃特性。当设为1时，表示当发生超出内存时，内核会panic
#当设为0时，表示当发生超出内存时，内核会kill掉一些空闲进程从而不让系统内核崩溃而继续运行，通常也称它为oom_killer
/ O4 B3 ~) I4 L+ |' M- W# a4 L#因此一般用它的默认值即可
+ k, M5 \! H/ f3 f5 v" _
' w% R6 s. a! C/ @9 Jvm.overcommit_memory = 0 #默认值为：0
* r! k9 A. H6 F8 q, q8 Q6 @#从内核文档里得知，该参数有三个值，分别是：
* D; H2 d0 c" C2 s4 W3 l#0：当用户空间请求更多的的内存时，内核尝试估算出剩余可用的内存。
/ _7 p5 }2 w9 u#1：当设这个参数值为1时，内核允许超量使用内存直到用完为止，主要用于科学计算
0 H8 j3 W+ s* W6 y8 z* D#2：当设这个参数值为2时，内核会使用一个决不过量使用内存的算法，即系统整个内存地址空间不能超过swap+50%的RAM值，50%参数的设定是在overcommit_ratio中设定。

另外还可能涉及到：
服务器的CPU和内存不断增长，原来是每次检测RTSP并发数太高导致，而且服务器本身配置太低，导致资源释放不了。现场当前的并发数是60，对其服务器配置来说，并发过高，将其改为10后再观察测试（

. N" u  k* B; }. I& G2 Z5 F6 z! j
free命令各个列含义：
! Q( M" ^, z/ Y! V/
2 ^+ T& [0 u. i* X7 r) f2 g3 Utotal
used
free
" l( R8 ~1 h' A# E. Wshared
$ D* T! d. I: l- \buffers
cached
Mem
总物理内存
1 B3 I7 `4 m, A" O当前使用的内存(包括slab+buffers+cached)
完全没有使用的内存
6 i8 U6 X$ o6 ~* `进程间共享的内存
7 P: V; i* ]8 f$ M. f" P缓存文件的元数据​ ​[1]​​
缓存文件的具体内容​ ​[1]​​
) [" ]. ], F5 Z. B) g-/+ buffers/cache
: s, T8 n/ _, M$ z- ^. q
当前使用的内存(不包括buffers+cached，但包括slab)
未使用和缓存的内存(free+buffers+cached)
1 D' k* P: J8 L( b- Z


5 @# a6 t* k. ]8 o  }+ oSwap
3 y9 P1 V. G$ H8 }4 j总的交换空间
已使用的交换空间
未使用的交换空间
然后top看了下，没有特别吃内存的程序。用ps大概统计下所有程序占用的总内存：
2 I2 V" D- i  c' {5 z# [/ ]
" l* {' ^" e, k' ?$ ps aux | awk '{mem += $6} END {print mem/1024/1024}'
0.595089
- K5 }' ]" R( P4 l/ D( W1.
/ n$ i2 y' K4 F; G2 V5 f2.
. k/ P( Y/ J7 U( x
结果显示所有进程占用的内存还不到1G，实际上，因为free, ps的统计方式的差别和Copy-on-write（http://wiki.osdev.org/Paging）和Shared libraries等内存优化机制的存在，这两者的统计结果通常是不一样的。但是一般情况下绝对不会相差十几个G，肯定是有什么隐藏的问题，Google了许久后发现，free没有专门统计另一项缓存: Slab。
9 J4 z/ R) V1 p/ u" ~

2、Slab简介和进一步调查
Slab Allocation是Linux 2.2之后引入的一个内存管理机制，专门用于缓存内核的数据对象，可以理解为一个内核专用的对象池，可以提高系统性能并减少内存碎片。(Linux 2.6.23之后，SLUB成为了默认的allocator。)
  g7 |# m; u4 _0 X& i" T4 V2 _1）查看Slab缓存
" J7 i" J' q9 b* n/ S$ cat /proc/meminfo
- g) |% z9 D) }) @7 i0 F+ w1.
; j& Z% n) Z  o# o% B; K其中，Slab相关的数据为
; v4 b. b' |5 \( }  L9 mSlab:             154212 kB
2 @1 ^$ i. |1 X; _+ aSReclaimable:      87980 kB
. q' U" ]$ [' ]0 c8 Y6 JSUnreclaim:        66232 kB
8 q6 P: q8 Y: k7 |1.
2.
3.
SReclaimable(Linux 2.6.19+)都是clean的缓存，随时可以释放。回到之前的内存问题，我查了下那台服务器上Slab占用的内存：
$ cat /proc/meminfo | grep Slab
2 R! L  c' j$ p  l* v3 A- ^Slab:         12777668 kB
1.
2.

12G的Slab缓存，有意思的是free把Slab缓存统计到了used memory中，这就是之前那个问题的症结所在了。
8 z- A. v# I* N# {. U4 c* H  ?" {9 J
4 o. d: t: Q, z  ]( v, h9 X3 o4 c
1 h1 D) I& F7 q
  k4 [1 _2 F" `4 b3 P0 ~8 f2）另外，还可以查看/proc/slabinfo(或使用slabtop命令)来查看Slab缓存的具体使用情况。结果发现，ext3_inode_cache和dentry_cache占用了绝大部分内存。考虑到这台服务器会频繁地用rsync同步大量的文件，这个结果也并不意外。

) n5 `5 T4 \5 Z4 @3、解决问题：
先说明一下，如果问题仅仅是Slab占用了太多的内存(SReclaimable)，那么通常不需要太操心，因为这根本不是个问题(如果是SUnreclaim太多且不断增长，那么很有可能是内核有bug)。但是，如果是因为Slab占用内存太多而引起了其他的问题，建议继续阅读。
3 \) s) S1 Q1 a. N1）手工清除Slab可回收缓存：
4 W& e; \. w3 `+ v) Y& necho 2 > /proc/sys/vm/drop_caches
! P2 ]6 \4 R4 b1.

6 v( E# ], y# J) M( E& x上面的命令会主动释放Slab中clean的缓存(包括inode和dentry的缓存)，然后再free -g一下，未使用的内存陡增了十几个G。。。
0 o0 a) r! b- u& {5 \
注：手动清除缓存可能会在一段时间内降低系统性能。原则上不推荐这么做，因为如果有需要，系统会自动释放出内存供其他程序使用。
6 ?/ A' V7 X+ v* E另外，手动清除Slab缓存是一个治标不治本的办法。因为问题不在Slab，而在于我们那个会引起Slab缓存飙涨的进程(我这里应该是rsync)。实际操作的时候发现，清除缓存一段时间后，Slab缓存很快又会“反弹”回去。如果需要治本，要么搞定问题进程，要么修改系统配置。
$ Z0 w* H+ s. m, E2 I+ m
2）调整系统vm配置
1 _$ s( Y0 n" e0 h0 `* [2 `vm.vfs_cache_pressure
系统在进行内存回收时，会先回收page cache, inode cache, dentry cache和swap cache。vfs_cache_pressure越大，每次回收时，inode cache和dentry cache所占比例越大。vfs_cache_pressure默认是100，值越大inode cache和dentry cache的回收速度会越快，越小则回收越慢，为0的时候完全不回收(OOM!)。
$ ]9 [9 ]3 j/ K. x( H
+ @; J2 R5 v1 Z+ M9 h, [vm.min_free_kbytes
系统的"保留内存"的大小，"保留内存"用于低内存状态下的"atomic memory allocation requests"(eg. kmalloc + GFP_ATOMIC)，该参数也被用于计算开始内存回收的阀值，默认在开机的时候根据当前的内存计算所得，越大则表示系统会越早开始内存回收。
注：min_free_kbytes过大可能会导致OOM，太小可能会导致系统出现死锁等问题。

vm.swappiness
该配置用于控制系统将内存swap out到交换空间的积极性，取值范围是[0, 100]。swappiness越大，系统的交换积极性越高，默认是60，如果为0则不会进行交换。

admin

sysctl.conf文件配置详解
) H" h4 U3 v: r临时生效
2 O  N; n6 U3 r, k' ?7 Z# g#修改后，马上生效，重启或者service network restart失效
- f( e- }: r7 `8 w; |sysctl -w fs.file-max=999999

永久生效
#vim /etc/sysctl.conf
fs.file-max=999999
! M' o& f2 _# d! u! i$ ?#保存后，执行sysctl -p 或者重启服务器生效
' d' S$ I) w7 Z9 x: b) \查看配置
sysctl -a #消失全部配置
- y4 Q, w. |, Q' ^sysctl fs.file-max #显示fs.file-max的值
: Z# b9 V! k5 x" o) w. h# sysctl -a | grep file #模糊查找
参考资料：Linux Tcp参数设置
' E7 F- Q8 Z$ _4 @1 @
kernel.sched_child_runs_first = 0
+ t2 z  b$ K( w& P/ J: u7 R
1 o- }9 w/ t4 C* N' g% {& I( J- |kernel.sched_min_granularity_ns = 3000000
8 U: U+ }) h. ^kernel.sched_latency_ns = 15000000
kernel.sched_wakeup_granularity_ns = 3000000
kernel.sched_tunable_scaling = 1
& o! H2 {3 Q2 \! t. j- k, c
kernel.sched_features = 3183
# Y, B) m3 A5 e+ w0 ]+ }! N' b8 wkernel.sched_migration_cost = 500000
/ u8 }* P# p$ k) ^kernel.sched_nr_migrate = 32
kernel.sched_time_avg = 1000
kernel.sched_shares_window = 10000000
kernel.timer_migration = 1
kernel.sched_rt_period_us = 1000000
$ |( ], C. B% V8 a; l' z3 Skernel.sched_rt_runtime_us = 950000
! p! l+ L  E' W3 H: `" @0 B7 akernel.sched_compat_yield = 0
* F) z+ m; h* H7 `; Dkernel.sched_rr_timeslice_ms = 100
kernel.sched_autogroup_enabled = 0
9 A' }* ]0 J# H: f) [7 vkernel.sched_cfs_bandwidth_slice_us = 5000
kernel.panic = 0
9 T$ E; Q; H- f1 mkernel.exec-shield = 1
kernel.core_uses_pid = 1
' r. g+ J' ~* s' v& @kernel.core_pattern = |/usr/libexec/abrt-hook-ccpp %s %c %p %u %g %t e
/ Q0 c) r# G2 `9 Lkernel.core_pipe_limit = 4
kernel.tainted = 0
7 Y$ _% N1 q+ G3 x. R' Ykernel.real-root-dev = 0
* x7 ]" Z: z- O" n! Zkernel.print-fatal-signals = 0
kernel.ctrl-alt-del = 0
kernel.ftrace_enabled = 1
0 L7 U& W, B" Z, \  Z3 \7 Okernel.stack_tracer_enabled = 0
: `; }& O' Z+ f, Q, ?kernel.ftrace_dump_on_oops = 0
' Q" y* ~5 }6 V6 T' v% Akernel.modprobe = /sbin/modprobe
kernel.modules_disabled = 0
" X. f& q. _: W; h$ ?' mkernel.kexec_load_disabled = 0
2 V9 y) ~) N8 |- x0 K- qkernel.hotplug =
kernel.acct = 4 2 30
2 g* ^' [) f* ~+ W6 o! G+ Xkernel.sysrq = 0
kernel.cad_pid = 1
7 X* {- S+ G8 {9 L3 g' h1 ekernel.threads-max = 60719
kernel.random.poolsize = 4096
2 d# s' o! I2 R* b% |kernel.random.entropy_avail = 455
kernel.random.read_wakeup_threshold = 64
$ C& z; l/ M. n+ ?! e9 a9 `kernel.random.write_wakeup_threshold = 128
kernel.random.boot_id = 7ed1dbbb-9671-4ee2-8d81-58c58ba824ac
kernel.random.uuid = d1f372bb-bca8-4338-9d48-b9855a4ec41a
1 u+ m: T6 T5 D5 x/ }kernel.usermodehelper.bset = 4294967295 4294967295
kernel.usermodehelper.inheritable = 4294967295 4294967295
kernel.overflowuid = 65534
kernel.overflowgid = 65534
kernel.pid_max = 131072
' X1 ?2 \% }! f, t- Kkernel.panic_on_oops = 1
kernel.printk = 4 4 1 7
kernel.printk_ratelimit = 5
kernel.printk_ratelimit_burst = 10
( g  `' D; R6 B( G( [8 |, m9 ~kernel.printk_delay = 0
kernel.dmesg_restrict = 0
kernel.kptr_restrict = 1
kernel.ngroups_max = 65536
kernel.watchdog = 1
; K% m, f( W; {9 Skernel.watchdog_thresh = 60
* n3 g" g5 t8 J8 P8 ~8 n4 g- Ikernel.softlockup_panic = 0
+ p/ Y$ x7 o1 ?0 R  i9 wkernel.nmi_watchdog = 1
kernel.unknown_nmi_panic = 0
kernel.panic_on_unrecovered_nmi = 0
7 Y- P) H# R0 tkernel.panic_on_io_nmi = 0
. }# G$ ~1 X1 jkernel.bootloader_type = 113
. ]/ u3 F; `7 v( r* b* j1 r7 Ekernel.bootloader_version = 1
* w# J" |# k* S0 x8 O5 Okernel.kstack_depth_to_print = 12
4 p9 h7 e0 g& A$ J+ G& Wkernel.io_delay_type = 0
kernel.randomize_va_space = 2
* i7 r' P# l) X9 ]8 U! Z& y% Dkernel.acpi_video_flags = 0
kernel.hung_task_panic = 0
  O- o2 k* v3 f' V6 H& kkernel.hung_task_check_count = 4194304
kernel.hung_task_timeout_secs = 120
kernel.hung_task_warnings = 10
kernel.compat-log = 1
- N4 U& P) F1 {0 W8 c. I; fkernel.max_lock_depth = 1024
kernel.poweroff_cmd = /sbin/poweroff
kernel.keys.maxkeys = 200
kernel.keys.maxbytes = 20000
2 C4 v# }. _4 ckernel.keys.root_maxkeys = 1000000
  z4 `3 ]* Y4 r1 O+ R) Ckernel.keys.root_maxbytes = 25000000
kernel.keys.gc_delay = 300
' g8 c; r) v# H  u: [kernel.slow-work.min-threads = 2
kernel.slow-work.max-threads = 128
kernel.slow-work.vslow-percentage = 50
kernel.perf_event_paranoid = 1
kernel.perf_event_mlock_kb = 516
( L' w; J4 L/ J3 |, {( S% akernel.perf_event_max_sample_rate = 100000
1 W, {9 k& U. Y* n9 f) v7 _/ ?: T; |kernel.blk_iopoll = 1
) \9 Q1 }/ P1 V! W1 Ekernel.sched_domain.cpu0.domain0.min_interval = 1
kernel.sched_domain.cpu0.domain0.max_interval = 4
kernel.sched_domain.cpu0.domain0.busy_idx = 2
: V. i( V) Q3 H: M, p/ Fkernel.sched_domain.cpu0.domain0.idle_idx = 1
) W) B) C; ^0 r: @9 t; n: }% qkernel.sched_domain.cpu0.domain0.newidle_idx = 0
kernel.sched_domain.cpu0.domain0.wake_idx = 0
# F; T+ M# s5 L- C# \- k+ b3 [kernel.sched_domain.cpu0.domain0.forkexec_idx = 0
. K0 {+ p* R% V2 f( B) Hkernel.sched_domain.cpu0.domain0.busy_factor = 64
" k. f6 b1 j5 V; Tkernel.sched_domain.cpu0.domain0.imbalance_pct = 125
1 \- g- `: T0 J, X0 o$ Gkernel.sched_domain.cpu0.domain0.cache_nice_tries = 1
kernel.sched_domain.cpu0.domain0.flags = 4143
* d1 H1 ?( W0 Mkernel.sched_domain.cpu0.domain0.name = CPU
+ ^' n+ q$ R( Xkernel.sched_domain.cpu1.domain0.min_interval = 1
kernel.sched_domain.cpu1.domain0.max_interval = 4
. @3 `# t  x; Mkernel.sched_domain.cpu1.domain0.busy_idx = 2
kernel.sched_domain.cpu1.domain0.idle_idx = 1
. o% K# h/ D% z0 [4 Vkernel.sched_domain.cpu1.domain0.newidle_idx = 0
kernel.sched_domain.cpu1.domain0.wake_idx = 0
kernel.sched_domain.cpu1.domain0.forkexec_idx = 0
  W5 W) d8 C- L& qkernel.sched_domain.cpu1.domain0.busy_factor = 64
kernel.sched_domain.cpu1.domain0.imbalance_pct = 125
4 c6 _/ |  k# G% A2 ckernel.sched_domain.cpu1.domain0.cache_nice_tries = 1
kernel.sched_domain.cpu1.domain0.flags = 4143
( O4 \$ \' {: }8 w2 d5 c- \kernel.sched_domain.cpu1.domain0.name = CPU
. `2 i% {7 [% d0 U- B3 X. lkernel.sched_domain.cpu2.domain0.min_interval = 1
kernel.sched_domain.cpu2.domain0.max_interval = 4
kernel.sched_domain.cpu2.domain0.busy_idx = 2
% U' }. X. J# p% n, c' _kernel.sched_domain.cpu2.domain0.idle_idx = 1
kernel.sched_domain.cpu2.domain0.newidle_idx = 0
5 N0 j% u2 ]  w' ykernel.sched_domain.cpu2.domain0.wake_idx = 0
kernel.sched_domain.cpu2.domain0.forkexec_idx = 0
+ W; F- u* ^+ m  f% mkernel.sched_domain.cpu2.domain0.busy_factor = 64
kernel.sched_domain.cpu2.domain0.imbalance_pct = 125
4 w  e. X7 n8 h0 Q' g# I5 pkernel.sched_domain.cpu2.domain0.cache_nice_tries = 1
kernel.sched_domain.cpu2.domain0.flags = 4143
3 ~) ~2 K, c% Y) j7 ykernel.sched_domain.cpu2.domain0.name = CPU
, |+ J7 }: |' ?kernel.sched_domain.cpu3.domain0.min_interval = 1
kernel.sched_domain.cpu3.domain0.max_interval = 4
6 P/ ?" S" L& hkernel.sched_domain.cpu3.domain0.busy_idx = 2
kernel.sched_domain.cpu3.domain0.idle_idx = 1
kernel.sched_domain.cpu3.domain0.newidle_idx = 0
kernel.sched_domain.cpu3.domain0.wake_idx = 0
0 S& e8 J6 y6 p$ i7 Q7 ^( Rkernel.sched_domain.cpu3.domain0.forkexec_idx = 0
kernel.sched_domain.cpu3.domain0.busy_factor = 64
kernel.sched_domain.cpu3.domain0.imbalance_pct = 125
% w. H- [- G' x. O" a% |) \: w% okernel.sched_domain.cpu3.domain0.cache_nice_tries = 1
  P" }0 x; Q$ b% _: f& f7 zkernel.sched_domain.cpu3.domain0.flags = 4143
. o3 ~, t" _4 A; b' I+ B" Dkernel.sched_domain.cpu3.domain0.name = CPU
kernel.vsyscall64 = 1
kernel.ostype = Linux
+ T8 @" K3 u6 l& \kernel.osrelease = 2.6.32-504.el6.x86_64
kernel.version = #1 SMP Wed Oct 15 04:27:16 UTC 2014
kernel.hostname = xapi.128.com
kernel.domainname = (none)
' H+ a* h3 U0 o" G% x) Ekernel.pty.max = 4096
kernel.pty.nr = 1
# A3 {+ o* r% m. j6 w: Lkernel.shmmax = 68719476736
/ Y- N8 ]* }1 Y3 D& Z8 pkernel.shmall = 4294967296
kernel.shmmni = 4096
+ p/ ^9 e+ ?; z1 ^% |kernel.shm_rmid_forced = 0
% K, m2 J/ d5 fkernel.msgmax = 65536
, c( j1 }+ K9 G, w: Bkernel.msgmni = 7627
kernel.msgmnb = 65536
kernel.sem = 250 32000 32 128
kernel.auto_msgmni = 1
vm.overcommit_memory = 0
, H8 d% W! F, bvm.panic_on_oom = 0
vm.oom_kill_allocating_task = 0
vm.extfrag_threshold = 500
! {% [) W: S) C; B3 t% x: D0 Pvm.oom_dump_tasks = 1
( u4 F! e& I  B/ d7 @vm.would_have_oomkilled = 0
7 q8 o) W, q9 Ovm.overcommit_ratio = 50
vm.overcommit_kbytes = 0
" j$ j7 q9 K- W& ]0 Nvm.page-cluster = 3
vm.dirty_background_ratio = 10
  ]; F0 H# G4 r" Dvm.dirty_background_bytes = 0
; b2 W7 e9 s; \7 R; dvm.dirty_ratio = 20
3 m+ b; L4 T' \$ vvm.dirty_bytes = 0
7 z# X9 w! ?5 ivm.dirty_writeback_centisecs = 500
vm.dirty_expire_centisecs = 3000
vm.nr_pdflush_threads = 0
( S* @' ?! i% ]vm.swappiness = 60
9 Z* n' Q. h& Pvm.nr_hugepages = 0
" {/ F  W' ~; L( n+ _8 d) L( Lvm.nr_hugepages_mempolicy = 0
vm.hugetlb_shm_group = 0
vm.hugepages_treat_as_movable = 0
vm.nr_overcommit_hugepages = 0
: Z; @/ \' C5 N* e4 A! ~4 uvm.lowmem_reserve_ratio = 256 256 32
8 u1 |' m( n7 \! R( Kvm.drop_caches = 0
, H; o7 e* \5 vvm.min_free_kbytes = 67584
vm.extra_free_kbytes = 0
vm.unmap_area_factor = 0
) ]; t  C% m, K% N: Cvm.meminfo_legacy_layout = 1
vm.percpu_pagelist_fraction = 0
vm.max_map_count = 65530
+ ~5 M# V8 Z# F; ^  _. yvm.laptop_mode = 0
vm.block_dump = 0
+ C. f5 T7 |! B/ b8 ovm.vfs_cache_pressure = 100
% M9 }2 Z+ b( ~8 o3 \# l8 F7 ~vm.legacy_va_layout = 0
* e+ |3 k" B+ H! c1 L; o( E% j3 t/ ?vm.zone_reclaim_mode = 0
vm.min_unmapped_ratio = 1
vm.min_slab_ratio = 5
" _' z; ?4 v/ B" Q: T- Pvm.stat_interval = 1
vm.mmap_min_addr = 4096
. A4 F! g3 ]# _( D8 ~. O- N/ vvm.numa_zonelist_order = default
vm.scan_unevictable_pages = 0
" m9 V/ M4 I1 [! b# {. X: cvm.memory_failure_early_kill = 0
. |7 i  l" @$ f. M- \" t- evm.memory_failure_recovery = 1
4 u$ D( _7 \  W' y4 ~fs.inode-nr = 14659 243
, }; P& K- w% u: N/ lfs.inode-state = 14659 243 0 0 0 0 0
* H8 u' G  ?% Ffs.file-nr = 1216 0 385492
/ K! A) {. d2 a5 i
0 ?' W# K) ^. i' }" T/ F, ?# a#【nginx】这个参数表示系统（所有）可以同时打开的最大句柄数，这个参数直接限制最大并发连接数，需根据实际情况配置。wd=811515
# file-max与ulimit的区别
; c3 f7 y, }3 c' Lfs.file-max = 385492
5 V0 d- r- e/ K* v) X2 S
fs.nr_open = 1048576
' t! }4 u) c+ m" B6 |fs.dentry-state = 15088 6375 45 0 0 0
3 H  ^; K  L! E. S! Vfs.overflowuid = 65534
9 ^4 z4 Z# o3 _; n; o7 [fs.overflowgid = 65534
( N' z0 s$ [! t; Y0 _fs.leases-enable = 1
fs.dir-notify-enable = 1
fs.lease-break-time = 45
& M5 {9 _8 N( e6 z1 d: r0 Z) nfs.aio-nr = 0
fs.aio-max-nr = 65536
- l$ q4 N. _, G% Gfs.inotify.max_user_instances = 128
! n4 R* V( N+ i% \5 Zfs.inotify.max_user_watches = 8192
  ]% ?5 g1 n& G6 d$ g0 c! Rfs.inotify.max_queued_events = 16384
fs.epoll.max_user_watches = 795852
; B  d5 g+ Q2 r, C: ^9 L4 Mfs.suid_dumpable = 0
3 @( i% ?! }8 ^# Rfs.binfmt_misc.status = enabled
fs.quota.lookups = 0
fs.quota.drops = 0
fs.quota.reads = 0
8 z7 W# A: O6 K  f( Dfs.quota.writes = 0
$ R0 k7 u* }7 J, Nfs.quota.cache_hits = 0
fs.quota.allocated_dquots = 0
. O: r( E: z$ ]; [7 Kfs.quota.free_dquots = 0
# u7 z* [9 o* g& w& o, ^, _0 Ffs.quota.syncs = 4
fs.quota.warnings = 1
fs.mqueue.queues_max = 256
+ N5 w# W, P9 K# R. qfs.mqueue.msg_max = 10
3 D  \; y  o( B; f* B, d) B( @fs.mqueue.msgsize_max = 8192
4 M! ~2 n' A$ s& S+ |fs.mqueue.msg_default = 10
" M, `0 U6 h; n. j/ j0 l4 n  T2 ofs.mqueue.msgsize_default = 8192
' K2 O6 E  h9 `% H3 o7 p# k. Vdebug.exception-trace = 1
debug.kprobes-optimization = 1
% Z- {8 O; e5 E$ Vdev.scsi.logging_level = 0
* o$ [0 a# m/ J( [7 _' kdev.raid.speed_limit_min = 1000
, P# d2 {- z# L7 d2 Kdev.raid.speed_limit_max = 200000
dev.hpet.max-user-freq = 64
dev.mac_hid.mouse_button_emulation = 0
5 ?2 r+ i- t& m" Sdev.mac_hid.mouse_button2_keycode = 97
dev.mac_hid.mouse_button3_keycode = 100
dev.cdrom.info = CD-ROM information, Id: cdrom.c 3.20 2003/12/17
dev.cdrom.info =
dev.cdrom.info = drive name: sr0
, B1 o, X8 D. c, L% z& n( _4 x: m4 fdev.cdrom.info = drive speed: 306
6 W( ^0 [4 F8 [2 g/ Pdev.cdrom.info = drive # of slots: 1
dev.cdrom.info = Can close tray: 1
dev.cdrom.info = Can open tray: 1
dev.cdrom.info = Can lock tray: 1
dev.cdrom.info = Can change speed: 1
dev.cdrom.info = Can select disk: 0
dev.cdrom.info = Can read multisession: 1
dev.cdrom.info = Can read MCN: 1
dev.cdrom.info = Reports media changed: 1
dev.cdrom.info = Can play audio: 1
dev.cdrom.info = Can write CD-R: 0
& e: w; [* M2 d, _; jdev.cdrom.info = Can write CD-RW: 0
dev.cdrom.info = Can read DVD: 1
3 d. ^+ _/ i) ], {( R/ P& K# Z$ zdev.cdrom.info = Can write DVD-R: 0
$ N9 }% y1 k& w* {dev.cdrom.info = Can write DVD-RAM: 0
5 m* ?9 S0 A' ^- M" M. s$ C& xdev.cdrom.info = Can read MRW: 1
dev.cdrom.info = Can write MRW: 1
3 Z8 L+ L; R6 @7 z' J1 E$ [dev.cdrom.info = Can write RAM: 1
dev.cdrom.info =
dev.cdrom.info =
* D& n$ _- q- \7 x: E, Edev.cdrom.autoclose = 1
dev.cdrom.autoeject = 0
dev.cdrom.debug = 0
dev.cdrom.lock = 1
7 W& V$ i7 C, M1 u2 a7 p; i0 Idev.cdrom.check_media = 0
net.netfilter.nf_log.0 = NONE
net.netfilter.nf_log.1 = NONE
net.netfilter.nf_log.2 = NONE
net.netfilter.nf_log.3 = NONE
net.netfilter.nf_log.4 = NONE
net.netfilter.nf_log.5 = NONE
net.netfilter.nf_log.6 = NONE
! R2 ^9 Q2 i8 S# _) Mnet.netfilter.nf_log.7 = NONE
$ U4 a2 W0 T* S2 B) _net.netfilter.nf_log.8 = NONE
net.netfilter.nf_log.9 = NONE
net.netfilter.nf_log.10 = NONE
. |% f& J: H6 S( Ynet.netfilter.nf_log.11 = NONE
net.netfilter.nf_log.12 = NONE
net.netfilter.nf_conntrack_generic_timeout = 600
net.netfilter.nf_conntrack_tcp_timeout_syn_sent = 120
net.netfilter.nf_conntrack_tcp_timeout_syn_recv = 60
net.netfilter.nf_conntrack_tcp_timeout_established = 432000
- N, g5 r: f! }4 w& I! Xnet.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60
+ p: H; i3 }7 y! onet.netfilter.nf_conntrack_tcp_timeout_last_ack = 30
. T% p* d& f3 y8 ]- C1 Nnet.netfilter.nf_conntrack_tcp_timeout_time_wait = 120
5 G6 a9 k2 ~. z& Qnet.netfilter.nf_conntrack_tcp_timeout_close = 10
( r  t1 `. ?( F+ K/ Fnet.netfilter.nf_conntrack_tcp_timeout_max_retrans = 300
net.netfilter.nf_conntrack_tcp_timeout_unacknowledged = 300
+ D8 B" B. v! A/ ^) k# xnet.netfilter.nf_conntrack_tcp_loose = 1
# `" x4 E% O/ t: C6 ~( Bnet.netfilter.nf_conntrack_tcp_be_liberal = 0
net.netfilter.nf_conntrack_tcp_max_retrans = 3
' B, c0 Q7 a% J/ @net.netfilter.nf_conntrack_udp_timeout = 30
net.netfilter.nf_conntrack_udp_timeout_stream = 180
net.netfilter.nf_conntrack_icmpv6_timeout = 30
1 I1 F' |, W& ~/ Wnet.netfilter.nf_conntrack_acct = 0
( G" F; N2 F! N$ E( Vnet.netfilter.nf_conntrack_events = 1
net.netfilter.nf_conntrack_events_retry_timeout = 15
/ E3 N) H/ V  W+ N% knet.netfilter.nf_conntrack_max = 65536
) x! }9 ~% F4 b% G4 M  znet.netfilter.nf_conntrack_count = 0
1 h" ?# E9 h: |8 D* s, Vnet.netfilter.nf_conntrack_buckets = 16384
net.netfilter.nf_conntrack_checksum = 1
net.netfilter.nf_conntrack_log_invalid = 0
& S1 J! A" J9 U0 e$ S6 s4 Tnet.netfilter.nf_conntrack_expect_max = 256
" b, N* u$ @/ ]- z% I% J" unet.core.somaxconn = 128
net.core.xfrm_aevent_etime = 10
/ z7 p, I! u+ R) h, F* qnet.core.xfrm_aevent_rseqth = 2
net.core.xfrm_larval_drop = 1
" t2 a4 S1 J' n" Anet.core.xfrm_acq_expires = 30

#【nginx】这个参数表示内核套接字发送缓存区的最大大小。
: _, @/ V# y5 f1 k* E6 U5 Y#【nginx】这个参数表示内核套接字接收缓存区的最大大小。
#【nginx】这个参数表示内核套接字发送缓存区默认的大小。
#【nginx】这个参数表示内核套接字接收缓存区默认的大小。
; V2 @' H* v1 Z+ c$ V, K( I& Y8 q( J#注意　滑动窗口的大小与套接字缓存区会在一定程度上影响并发连接的数目。每个TCP连接都会为维护TCP滑动窗口而消耗内存，这个窗口会根据服务器的处理速度收缩或扩张。
参数wmem_max的设置，需要平衡物理内存的总大小、Nginx并发处理的最大连接数量（由nginx.conf中的worker_processes和worker_connections参数决定）而确定。当然，如果仅仅为了提高并发量使服务器不出现Out Of Memory问题而去降低滑动窗口大小，那么并不合适，因为滑动窗口过小会影响大数据量的传输速度。rmem_default、wmem_default、rmem_max、wmem_max…
) i& n6 ~' }2 c# u5 U  t8 I#参考：可靠传输的实现
8 \# _) W% m. t! t7 Snet.core.wmem_max = 124928 //wd=124928
- N& ?  ]5 ]0 V7 b% ~net.core.rmem_max = 124928 //wd=124928
net.core.wmem_default = 124928 //wd=124928
5 m3 w+ H5 @! L+ `. {, C7 Y8 {net.core.rmem_default = 124928//wd=124928

' t4 M, R5 A0 m0 v$ jnet.core.dev_weight = 64

( V5 J5 B! }% r% ~#【nginx】当网卡接收数据包的速度大于内核处理的速度时，会有一个队列保存这些数据包。这个参数表示该队列的最大值。wd=32768
% t, W" U9 C" W8 c- H8 Cnet.core.netdev_max_backlog = 1000
+ a% b  v, s4 k: I) U, Dnet.core.message_cost = 5
& g% X, j2 |2 j7 v  u$ |! D' y* Znet.core.message_burst = 10
* |; n3 W1 N2 Q0 W! H7 inet.core.optmem_max = 20480
net.core.rps_sock_flow_entries = 0
$ c, v1 W  V5 U" p6 xnet.core.busy_poll = 0
9 y/ f/ Q* U1 a1 v8 a; i0 vnet.core.busy_read = 0
+ z8 \" r, @6 Y6 {$ Nnet.core.netdev_budget = 300
net.core.warnings = 1
1 u. t3 a9 J3 Unet.ipv4.route.gc_thresh = 131072
/ ~3 Q3 j3 L, c2 f: Qnet.ipv4.route.max_size = 2097152
0 |, s& t' U) q/ w$ q  Tnet.ipv4.route.gc_min_interval = 0
net.ipv4.route.gc_min_interval_ms = 500
net.ipv4.route.gc_timeout = 300
( j$ H; x; L; [4 f( W; s4 ?$ [net.ipv4.route.gc_interval = 60
net.ipv4.route.redirect_load = 20
$ z2 g, Z# N1 Q7 [  d/ P  U) M. xnet.ipv4.route.redirect_number = 9
0 Z* n: L( I) Ynet.ipv4.route.redirect_silence = 20480
net.ipv4.route.error_cost = 1000
( Z, g+ }4 C1 I& l1 F5 h" K: D3 Mnet.ipv4.route.error_burst = 5000
$ E. ]5 h$ \' Knet.ipv4.route.gc_elasticity = 8
net.ipv4.route.mtu_expires = 600
net.ipv4.route.min_pmtu = 552
net.ipv4.route.min_adv_mss = 256
net.ipv4.route.secret_interval = 600
net.ipv4.neigh.default.mcast_solicit = 3
net.ipv4.neigh.default.ucast_solicit = 3
net.ipv4.neigh.default.app_solicit = 0
net.ipv4.neigh.default.retrans_time = 99
net.ipv4.neigh.default.base_reachable_time = 30
# q& N8 P" T# f" ]net.ipv4.neigh.default.delay_first_probe_time = 5
9 J6 L: P# y) c' k, ?0 J" t8 `0 L% onet.ipv4.neigh.default.gc_stale_time = 60
net.ipv4.neigh.default.unres_qlen = 3
/ h9 _$ I& s3 ~8 |' ~net.ipv4.neigh.default.proxy_qlen = 64
/ ]$ d' o0 B* @3 o. L7 i0 Snet.ipv4.neigh.default.anycast_delay = 99
  _5 x: }( u* C* Unet.ipv4.neigh.default.proxy_delay = 79
5 L5 s# k2 j* g; D1 t8 r. i, Cnet.ipv4.neigh.default.locktime = 99
6 y8 o7 g! w3 ^, z/ R3 d7 snet.ipv4.neigh.default.retrans_time_ms = 1000
net.ipv4.neigh.default.base_reachable_time_ms = 30000
* ]) ~' v; h- Hnet.ipv4.neigh.default.gc_interval = 30
net.ipv4.neigh.default.gc_thresh1 = 128
' B2 Q1 N4 |1 A$ jnet.ipv4.neigh.default.gc_thresh2 = 512
0 P' |) {' _& H; n9 nnet.ipv4.neigh.default.gc_thresh3 = 1024
net.ipv4.neigh.lo.mcast_solicit = 3
! L7 ~+ \! }9 m. r- p8 p& I  \; lnet.ipv4.neigh.lo.ucast_solicit = 3
  Z' R( _& s3 p& H9 ~- Onet.ipv4.neigh.lo.app_solicit = 0
% S. y. \8 Q6 v7 O1 V1 Gnet.ipv4.neigh.lo.retrans_time = 99
net.ipv4.neigh.lo.base_reachable_time = 30
net.ipv4.neigh.lo.delay_first_probe_time = 5
9 q8 ^" m6 @" P; J2 Y  q- }) m* bnet.ipv4.neigh.lo.gc_stale_time = 60
' e' Y. l* x4 I% k" ]" j' lnet.ipv4.neigh.lo.unres_qlen = 3
net.ipv4.neigh.lo.proxy_qlen = 64
net.ipv4.neigh.lo.anycast_delay = 99
net.ipv4.neigh.lo.proxy_delay = 79
net.ipv4.neigh.lo.locktime = 99
net.ipv4.neigh.lo.retrans_time_ms = 1000
net.ipv4.neigh.lo.base_reachable_time_ms = 30000
" u3 W9 g, A0 m3 j) \net.ipv4.neigh.eth0.mcast_solicit = 3
' g: g4 o9 x1 K  ?9 W0 Q+ Rnet.ipv4.neigh.eth0.ucast_solicit = 3
net.ipv4.neigh.eth0.app_solicit = 0
/ D- \3 }& `8 t' Y4 s) ?; k7 Knet.ipv4.neigh.eth0.retrans_time = 99
% {) i) D' N6 V  B) Bnet.ipv4.neigh.eth0.base_reachable_time = 30
net.ipv4.neigh.eth0.delay_first_probe_time = 5
" ?8 W- g! S! |3 ~/ h9 @net.ipv4.neigh.eth0.gc_stale_time = 60
1 d. `) Z. A& g- j' u  Unet.ipv4.neigh.eth0.unres_qlen = 3
net.ipv4.neigh.eth0.proxy_qlen = 64
net.ipv4.neigh.eth0.anycast_delay = 99
1 _: S* m0 K% P" ^# i  |net.ipv4.neigh.eth0.proxy_delay = 79
net.ipv4.neigh.eth0.locktime = 99
4 c( D; m7 n7 B  C0 g/ M+ tnet.ipv4.neigh.eth0.retrans_time_ms = 1000
, P3 p0 a8 ^2 p  v( j- {net.ipv4.neigh.eth0.base_reachable_time_ms = 30000
$ G2 _$ \1 J2 ~' t" ?4 s) m& Cnet.ipv4.neigh.pan0.mcast_solicit = 3
2 V. z9 _; m! s: v5 e& c& c+ H- \% `net.ipv4.neigh.pan0.ucast_solicit = 3
net.ipv4.neigh.pan0.app_solicit = 0
: N6 I4 ~( D! X. O3 w  N$ [net.ipv4.neigh.pan0.retrans_time = 99
net.ipv4.neigh.pan0.base_reachable_time = 30
net.ipv4.neigh.pan0.delay_first_probe_time = 5
" }/ s2 {! W9 anet.ipv4.neigh.pan0.gc_stale_time = 60
net.ipv4.neigh.pan0.unres_qlen = 3
net.ipv4.neigh.pan0.proxy_qlen = 64
1 Q  Z7 H4 a+ L/ j: znet.ipv4.neigh.pan0.anycast_delay = 99
; p- ?0 S6 w4 T. m) b1 V4 R! O; vnet.ipv4.neigh.pan0.proxy_delay = 79
net.ipv4.neigh.pan0.locktime = 99
net.ipv4.neigh.pan0.retrans_time_ms = 1000
net.ipv4.neigh.pan0.base_reachable_time_ms = 30000
$ i6 P; E- |0 ?* ^% Znet.ipv4.tcp_timestamps = 1
net.ipv4.tcp_window_scaling = 1
- ]: F- ^1 T& M% ]6 e$ ynet.ipv4.tcp_sack = 1
3 O7 n/ Z) p) ^3 I2 T* [net.ipv4.tcp_retrans_collapse = 1
net.ipv4.ip_default_ttl = 64
  G4 A( U" A- _/ h$ T+ Anet.ipv4.ip_no_pmtu_disc = 0
net.ipv4.ip_nonlocal_bind = 0
net.ipv4.tcp_syn_retries = 5
net.ipv4.tcp_synack_retries = 5
, d) f( y+ g+ s7 W3 I) bnet.ipv4.tcp_max_orphans = 262144
( C& b1 w  j* H' x/ M

* q& U- F: c; a8 U1 k0 E- n
#【nginx】这个参数表示操作系统允许TIME_WAIT套接字数量的最大值，如果超过这个数字，TIME_WAIT套接字将立刻被清除并打印警告信息。该参数默认为180 000，过多的TIME_WAIT套接字会使Web服务器变慢。wd=10000
net.ipv4.tcp_max_tw_buckets = 262144

5 I- K' S# \  j3 D7 Y3 t: cnet.ipv4.ip_dynaddr = 0

3 Q& p/ }/ p5 y( {7 _0 B$ B#【nginx】这个参数表示当keepalive启用时，TCP发送keepalive消息的频度。默认是2小时，若将其设置得小一些，可以更快地清理无效的连接。单位：秒  默认值：2小时。wd=300
6 ^( a6 m8 i- \) Y0 E" ~8 }net.ipv4.tcp_keepalive_time = 7200

net.ipv4.tcp_keepalive_probes = 9
net.ipv4.tcp_keepalive_intvl = 75
  u/ o6 P5 V1 gnet.ipv4.tcp_retries1 = 3
net.ipv4.tcp_retries2 = 15

#【nginx】这个参数表示当服务器主动关闭连接时，socket保持在FIN-WAIT-2状态的最大时间，单位：秒  wd=30
& ?* G- g+ W8 F, U0 i# y# T3 `( y#参考：tcp参数详解之tcp_fin_timeout
/ m3 K" O1 c7 k0 |: n8 h" onet.ipv4.tcp_fin_timeout = 60
5 d2 e) p1 b4 L0 F. k
8 A+ m& E; x1 X; G#【nginx】参数与性能无关，用于解决TCP的SYN攻击。 wd= 1
net.ipv4.tcp_syncookies = 1
0 r2 j: o& C- M% C8 @
* x5 n5 \: B6 [net.ipv4.tcp_tw_recycle = 0
net.ipv4.tcp_abort_on_overflow = 0
net.ipv4.tcp_stdurg = 0
, }& U9 I( h8 z, i: e5 X  k6 unet.ipv4.tcp_rfc1337 = 0

; I9 I5 g; }- b#【nginx】这个参数表示TCP三次握手建立阶段接收SYN请求队列的最大长度，默认为1024，将其设置得大一些可以使出现Nginx繁忙来不及accept新连接的情况时，Linux不至于丢失客户端发起的连接请求，wd=2048
, ]  K  W8 c) v4 d# J' u& ~$ h4 {- Bnet.ipv4.tcp_max_syn_backlog = 2048

1 y' O: |' J5 S- ]

#【nginx】这个参数定义了在UDP和TCP连接中本地（不包括连接的远端）端口的取值范围。wd = 10240    65535
net.ipv4.ip_local_port_range = 32768 61000
' p  E0 D2 T9 L) U/ ~. R  i4 _, `% {4 I" E
; P5 f5 `; J; X8 h5 xnet.ipv4.ip_local_reserved_ports =
  Z$ n& P/ a" ?& p2 H: f$ Xnet.ipv4.igmp_max_memberships = 20
net.ipv4.igmp_max_msf = 10
( T3 x0 u$ p/ i" h8 @' R% G3 fnet.ipv4.inet_peer_threshold = 65664
8 @) V: h0 Y  P6 c' F2 Mnet.ipv4.inet_peer_minttl = 120
net.ipv4.inet_peer_maxttl = 600
  C5 s% q4 O; K* u  enet.ipv4.inet_peer_gc_mintime = 10
net.ipv4.inet_peer_gc_maxtime = 120
net.ipv4.tcp_orphan_retries = 0
3 z* ]% x5 v; |2 @7 dnet.ipv4.tcp_fack = 1
net.ipv4.tcp_reordering = 3
net.ipv4.tcp_ecn = 2
net.ipv4.tcp_dsack = 1
3 c$ \: r, C2 G4 f+ Qnet.ipv4.tcp_mem = 364224 485632 728448

3 d5 s) b1 u9 J' {3 H3 a% m$ @! `#【nginx】这个参数定义了TCP发送缓存（用于TCP发送滑动窗口）的最小值、默认值、最大值。wd=4096        87380   4194304
net.ipv4.tcp_wmem = 4096 16384 4194304

#【nginx】这个参数定义了TCP接收缓存（用于TCP接收滑动窗口）的最小值、默认值、最大值。wd=4096        87380   4194304
) A" H! _3 ], T9 knet.ipv4.tcp_rmem = 4096 87380 4194304
1 H# w4 K. i+ U% @/ \
net.ipv4.tcp_app_win = 31
net.ipv4.tcp_adv_win_scale = 2

5 Q+ k& x' ]2 w2 W#【nginx】tw是time wait的简称，表示允许将time-wait状态的socket重新用于新的tcp连接，这对于服务器来说很有意义，因为服务器上总会有大量的time-wait状态的连接。wd=1
net.ipv4.tcp_tw_reuse = 0

net.ipv4.tcp_frto = 2
net.ipv4.tcp_frto_response = 0
net.ipv4.tcp_low_latency = 0
net.ipv4.tcp_no_metrics_save = 0
net.ipv4.tcp_moderate_rcvbuf = 1
9 r& J- n+ h' M( L) L% ~net.ipv4.tcp_tso_win_divisor = 3
net.ipv4.tcp_congestion_control = cubic
net.ipv4.tcp_abc = 0
net.ipv4.tcp_mtu_probing = 0
+ J- o/ n) m! X& @3 cnet.ipv4.tcp_base_mss = 512
net.ipv4.tcp_workaround_signed_windows = 0
, e! `! M2 a. Unet.ipv4.tcp_challenge_ack_limit = 100
net.ipv4.tcp_limit_output_bytes = 131072
net.ipv4.tcp_dma_copybreak = 4096
net.ipv4.tcp_slow_start_after_idle = 1
net.ipv4.cipso_cache_enable = 1
1 v3 T+ o1 F' E5 x) U! s1 snet.ipv4.cipso_cache_bucket_size = 10
net.ipv4.cipso_rbm_optfmt = 0
net.ipv4.cipso_rbm_strictvalid = 1
% C) @0 Y9 n0 F8 Qnet.ipv4.tcp_available_congestion_control = cubic reno
9 u3 n7 @3 O5 V3 tnet.ipv4.tcp_allowed_congestion_control = cubic reno
net.ipv4.tcp_max_ssthresh = 0
( y, o  i1 w0 x0 o9 v& d7 r& W1 M2 xnet.ipv4.tcp_thin_linear_timeouts = 0
  u1 _0 z. v$ ^5 w! x0 vnet.ipv4.tcp_thin_dupack = 0
net.ipv4.tcp_min_tso_segs = 2
, V5 s6 X0 j+ ~, k) _2 ~net.ipv4.udp_mem = 364224 485632 728448
) Z8 r4 c2 x9 X: pnet.ipv4.udp_rmem_min = 4096
5 l& [2 q& Z3 Bnet.ipv4.udp_wmem_min = 4096
7 q1 ^: _1 o6 B6 D1 |net.ipv4.conf.all.forwarding = 0
7 Q0 f+ p3 Q: ?! p" u$ Fnet.ipv4.conf.all.mc_forwarding = 0
5 a2 `% R; v7 d: R: n0 b/ q$ Snet.ipv4.conf.all.accept_redirects = 1
7 h& g7 E9 k! `& l! V6 M! T& H* Mnet.ipv4.conf.all.secure_redirects = 1
1 |2 q7 i3 [. I! m- q0 |. `net.ipv4.conf.all.shared_media = 1
5 h" ?" p  [2 y3 L# dnet.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.all.send_redirects = 1
, P2 m: v# v, L" i  Y/ ^) znet.ipv4.conf.all.accept_source_route = 0
" k$ d4 f/ b8 P- n/ Ynet.ipv4.conf.all.src_valid_mark = 0
8 \) B- ?1 C5 z" Z! [net.ipv4.conf.all.proxy_arp = 0
net.ipv4.conf.all.medium_id = 0
9 |& d/ t; P# T: l( ^8 Unet.ipv4.conf.all.bootp_relay = 0
, O3 k4 ~$ K( B3 Q# }! |7 Tnet.ipv4.conf.all.log_martians = 0
4 h/ D6 s8 F8 C1 onet.ipv4.conf.all.tag = 0
' i& Y, Z- T; C* Y5 s; p3 Znet.ipv4.conf.all.arp_filter = 0
net.ipv4.conf.all.arp_announce = 0
net.ipv4.conf.all.arp_ignore = 0
2 A; E. @3 R. Y& @+ d" Z7 Z" Inet.ipv4.conf.all.arp_accept = 0
! N( s! R! Q) A- c* Jnet.ipv4.conf.all.arp_notify = 0
net.ipv4.conf.all.proxy_arp_pvlan = 0
net.ipv4.conf.all.disable_xfrm = 0
net.ipv4.conf.all.disable_policy = 0
5 A) i4 e" ^) O  Qnet.ipv4.conf.all.force_igmp_version = 0
net.ipv4.conf.all.promote_secondaries = 0
net.ipv4.conf.all.accept_local = 0
net.ipv4.conf.all.route_localnet = 0
" x8 Y$ b  Z) N# e: qnet.ipv4.conf.default.forwarding = 0
% T0 ?: O* R) qnet.ipv4.conf.default.mc_forwarding = 0
. P# o- g6 s: c3 w- {* m1 x4 hnet.ipv4.conf.default.accept_redirects = 1
  A" A! S! f; Fnet.ipv4.conf.default.secure_redirects = 1
net.ipv4.conf.default.shared_media = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.send_redirects = 1
net.ipv4.conf.default.accept_source_route = 0
" W$ O5 P5 S. [, W' \net.ipv4.conf.default.src_valid_mark = 0
net.ipv4.conf.default.proxy_arp = 0
8 `, d- }- Q: e% I% l) Lnet.ipv4.conf.default.medium_id = 0
% L7 |1 x4 x$ x9 B- f. ^; D2 m% Pnet.ipv4.conf.default.bootp_relay = 0
net.ipv4.conf.default.log_martians = 0
net.ipv4.conf.default.tag = 0
5 J0 v9 t) K9 }* @. G3 X* g) vnet.ipv4.conf.default.arp_filter = 0
net.ipv4.conf.default.arp_announce = 0
; {% ?$ m7 j7 C# Xnet.ipv4.conf.default.arp_ignore = 0
net.ipv4.conf.default.arp_accept = 0
net.ipv4.conf.default.arp_notify = 0
net.ipv4.conf.default.proxy_arp_pvlan = 0
net.ipv4.conf.default.disable_xfrm = 0
' a4 I8 l% s0 X4 P% s5 H! x( Gnet.ipv4.conf.default.disable_policy = 0
net.ipv4.conf.default.force_igmp_version = 0
; z; @  e# `% h3 `# Mnet.ipv4.conf.default.promote_secondaries = 0
- G( s( F" V0 l, ?$ wnet.ipv4.conf.default.accept_local = 0
; C, L  \- Q6 C3 C% r% j  [net.ipv4.conf.default.route_localnet = 0
$ m0 b5 a" A- ?; Z7 R, [net.ipv4.conf.lo.forwarding = 0
net.ipv4.conf.lo.mc_forwarding = 0
6 r2 s# |- A6 ?1 |. t: Enet.ipv4.conf.lo.accept_redirects = 1
8 \( o6 W' `4 M% K. F8 Ynet.ipv4.conf.lo.secure_redirects = 1
+ [9 n& _4 H' Y- \! M/ o4 J+ j/ e' rnet.ipv4.conf.lo.shared_media = 1
0 ^/ ?5 |+ n% ^: n+ Dnet.ipv4.conf.lo.rp_filter = 1
8 x" m: M- X3 z. ^net.ipv4.conf.lo.send_redirects = 1
net.ipv4.conf.lo.accept_source_route = 0
net.ipv4.conf.lo.src_valid_mark = 0
net.ipv4.conf.lo.proxy_arp = 0
5 }' ~5 @: l3 R3 Q6 i' ~% Rnet.ipv4.conf.lo.medium_id = 0
8 l- k2 F3 g1 M' C2 `- F2 b3 Cnet.ipv4.conf.lo.bootp_relay = 0
& E2 q* _: s$ w  ?5 h0 Jnet.ipv4.conf.lo.log_martians = 0
+ F0 A% N$ X# |' ?8 Nnet.ipv4.conf.lo.tag = 0
net.ipv4.conf.lo.arp_filter = 0
$ b: E9 z/ B% D- r, A# Unet.ipv4.conf.lo.arp_announce = 0
net.ipv4.conf.lo.arp_ignore = 0
net.ipv4.conf.lo.arp_accept = 0
net.ipv4.conf.lo.arp_notify = 0
net.ipv4.conf.lo.proxy_arp_pvlan = 0
net.ipv4.conf.lo.disable_xfrm = 1
2 j8 R8 J& e& Ynet.ipv4.conf.lo.disable_policy = 1
. E* _5 Y$ J1 E% G4 Dnet.ipv4.conf.lo.force_igmp_version = 0
net.ipv4.conf.lo.promote_secondaries = 0
net.ipv4.conf.lo.accept_local = 0
net.ipv4.conf.lo.route_localnet = 0
. z  I8 b& d* v! y4 W8 bnet.ipv4.conf.eth0.forwarding = 0
net.ipv4.conf.eth0.mc_forwarding = 0
+ s/ x8 y* O# q+ W# o* h$ rnet.ipv4.conf.eth0.accept_redirects = 1
net.ipv4.conf.eth0.secure_redirects = 1
net.ipv4.conf.eth0.shared_media = 1
net.ipv4.conf.eth0.rp_filter = 1
net.ipv4.conf.eth0.send_redirects = 1
" P- a; A' [1 D& T8 Knet.ipv4.conf.eth0.accept_source_route = 0
net.ipv4.conf.eth0.src_valid_mark = 0
1 h6 `. g2 j4 Z: p% g, v& vnet.ipv4.conf.eth0.proxy_arp = 0
net.ipv4.conf.eth0.medium_id = 0
net.ipv4.conf.eth0.bootp_relay = 0
net.ipv4.conf.eth0.log_martians = 0
% |( I! k7 L  Z7 jnet.ipv4.conf.eth0.tag = 0
net.ipv4.conf.eth0.arp_filter = 0
net.ipv4.conf.eth0.arp_announce = 0
net.ipv4.conf.eth0.arp_ignore = 0
5 A! L! b! s8 ?  F: l* w; pnet.ipv4.conf.eth0.arp_accept = 0
net.ipv4.conf.eth0.arp_notify = 0
net.ipv4.conf.eth0.proxy_arp_pvlan = 0
. q" b7 G1 y* R& P7 Pnet.ipv4.conf.eth0.disable_xfrm = 0
% _" M" ?0 z, w9 cnet.ipv4.conf.eth0.disable_policy = 0
2 b: T! n% }7 u! \net.ipv4.conf.eth0.force_igmp_version = 0
net.ipv4.conf.eth0.promote_secondaries = 0
net.ipv4.conf.eth0.accept_local = 0
* E. a0 K7 J1 Znet.ipv4.conf.eth0.route_localnet = 0
net.ipv4.conf.pan0.forwarding = 0
net.ipv4.conf.pan0.mc_forwarding = 0
3 L; q" f' S+ z& T# p: {net.ipv4.conf.pan0.accept_redirects = 1
3 z# f9 I! k4 G3 B& qnet.ipv4.conf.pan0.secure_redirects = 1
/ Q& E; c- r# I, s2 ?4 c! anet.ipv4.conf.pan0.shared_media = 1
0 H6 o1 ~6 ~# [- ~" a$ g- t( [net.ipv4.conf.pan0.rp_filter = 1
net.ipv4.conf.pan0.send_redirects = 1
net.ipv4.conf.pan0.accept_source_route = 0
net.ipv4.conf.pan0.src_valid_mark = 0
1 v" k) G; l4 K3 V" [8 o' ?net.ipv4.conf.pan0.proxy_arp = 0
net.ipv4.conf.pan0.medium_id = 0
net.ipv4.conf.pan0.bootp_relay = 0
net.ipv4.conf.pan0.log_martians = 0
net.ipv4.conf.pan0.tag = 0
net.ipv4.conf.pan0.arp_filter = 0
; F/ \( Q% q  l6 |) ?) ~6 x: knet.ipv4.conf.pan0.arp_announce = 0
6 h8 v8 W+ m3 r. o% K) Jnet.ipv4.conf.pan0.arp_ignore = 0
+ i4 f' _3 v. W, F4 tnet.ipv4.conf.pan0.arp_accept = 0
+ V% |6 q# R" r9 n- a9 N( `net.ipv4.conf.pan0.arp_notify = 0
9 v/ p$ F; d6 A% nnet.ipv4.conf.pan0.proxy_arp_pvlan = 0
0 u7 G! Z' H! O" b- @net.ipv4.conf.pan0.disable_xfrm = 0
! \5 R- \  O8 C' W. _1 unet.ipv4.conf.pan0.disable_policy = 0
net.ipv4.conf.pan0.force_igmp_version = 0
net.ipv4.conf.pan0.promote_secondaries = 0
net.ipv4.conf.pan0.accept_local = 0
- U4 ^2 P% E: d/ [: {net.ipv4.conf.pan0.route_localnet = 0

3 ]  P) T6 I; p) l% R#是否开启ip转发功能，设置为路由服务器，必需开启此项
3 _) b( i. a! S& _# tnet.ipv4.ip_forward = 0
  w# |: s% c% e6 G# Inet.ipv4.xfrm4_gc_thresh = 1048576
net.ipv4.ipfrag_high_thresh = 4194304
net.ipv4.ipfrag_low_thresh = 3145728
5 W: u% ]& t" m8 `! y# y& r) p& z2 b4 Enet.ipv4.ipfrag_time = 30
net.ipv4.icmp_echo_ignore_all = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
3 ]& |" `$ L' \net.ipv4.icmp_errors_use_inbound_ifaddr = 0
8 B. M5 a4 S7 U! Z: i0 u  v* knet.ipv4.icmp_ratelimit = 1000
3 K1 |& E& j% F" }: w4 g( ~6 S- inet.ipv4.icmp_ratemask = 6168
net.ipv4.rt_cache_rebuild_count = 4
8 p- E( M0 Y. @' S7 Knet.ipv4.ping_group_range = 1 0
  x1 w% Q4 I# X. ]net.ipv4.ipfrag_secret_interval = 600
net.ipv4.ipfrag_max_dist = 64
net.ipv6.neigh.default.mcast_solicit = 3
( {+ W( y) W  o7 t# ]- e( }net.ipv6.neigh.default.ucast_solicit = 3
net.ipv6.neigh.default.app_solicit = 0
net.ipv6.neigh.default.delay_first_probe_time = 5
5 j7 j3 Q: M. [# ^  dnet.ipv6.neigh.default.gc_stale_time = 60
net.ipv6.neigh.default.unres_qlen = 3
net.ipv6.neigh.default.proxy_qlen = 64
net.ipv6.neigh.default.anycast_delay = 99
net.ipv6.neigh.default.proxy_delay = 79
! l( ]; ?2 Q! K, G; v  W$ onet.ipv6.neigh.default.locktime = 0
7 Q4 ~# C  i' H4 Anet.ipv6.neigh.default.retrans_time_ms = 1000
net.ipv6.neigh.default.base_reachable_time_ms = 30000
) R+ d+ g3 F7 hnet.ipv6.neigh.default.gc_interval = 30
net.ipv6.neigh.default.gc_thresh1 = 128
net.ipv6.neigh.default.gc_thresh2 = 512
net.ipv6.neigh.default.gc_thresh3 = 1024
6 t: F: p" t; I) Knet.ipv6.neigh.lo.mcast_solicit = 3
net.ipv6.neigh.lo.ucast_solicit = 3
" A9 _2 |* Z, j1 F+ |9 |- l/ Znet.ipv6.neigh.lo.app_solicit = 0
net.ipv6.neigh.lo.delay_first_probe_time = 5
  N+ Z" f9 t* X* L% K8 _net.ipv6.neigh.lo.gc_stale_time = 60
net.ipv6.neigh.lo.unres_qlen = 3
net.ipv6.neigh.lo.proxy_qlen = 64
. N! y0 \* P8 N! {. L. unet.ipv6.neigh.lo.anycast_delay = 99
net.ipv6.neigh.lo.proxy_delay = 79
net.ipv6.neigh.lo.locktime = 0
8 S' G/ Z: l& V5 R8 M$ |: Rnet.ipv6.neigh.lo.retrans_time_ms = 1000
net.ipv6.neigh.lo.base_reachable_time_ms = 30000
net.ipv6.neigh.eth0.mcast_solicit = 3
net.ipv6.neigh.eth0.ucast_solicit = 3
; o) m" e6 v1 b7 p5 u) @% [net.ipv6.neigh.eth0.app_solicit = 0
6 }( f- T+ T% e/ }- Mnet.ipv6.neigh.eth0.delay_first_probe_time = 5
2 g  d) {2 d: J  @* B  inet.ipv6.neigh.eth0.gc_stale_time = 60
net.ipv6.neigh.eth0.unres_qlen = 3
0 z& W8 y4 _9 o0 w7 P- znet.ipv6.neigh.eth0.proxy_qlen = 64
net.ipv6.neigh.eth0.anycast_delay = 99
( I2 W- n* l7 \$ a! ?5 H5 E& Knet.ipv6.neigh.eth0.proxy_delay = 79
; T  X( ^* S$ Q6 f% j% e6 \; O9 ^net.ipv6.neigh.eth0.locktime = 0
net.ipv6.neigh.eth0.retrans_time_ms = 1000
net.ipv6.neigh.eth0.base_reachable_time_ms = 30000
net.ipv6.neigh.pan0.mcast_solicit = 3
; r/ G( V7 G7 @, lnet.ipv6.neigh.pan0.ucast_solicit = 3
2 Q' Z: l$ m; e+ y5 gnet.ipv6.neigh.pan0.app_solicit = 0
' R8 n0 \; L7 k( f0 B3 x/ Lnet.ipv6.neigh.pan0.delay_first_probe_time = 5
; r  q8 |$ A( V4 G' I! [- H; V" Tnet.ipv6.neigh.pan0.gc_stale_time = 60
net.ipv6.neigh.pan0.unres_qlen = 3
8 V/ t* F+ b6 a5 \6 a- }7 r( enet.ipv6.neigh.pan0.proxy_qlen = 64
  t1 }- Z# v  w. Hnet.ipv6.neigh.pan0.anycast_delay = 99
net.ipv6.neigh.pan0.proxy_delay = 79
net.ipv6.neigh.pan0.locktime = 0
net.ipv6.neigh.pan0.retrans_time_ms = 1000
net.ipv6.neigh.pan0.base_reachable_time_ms = 30000
' R0 T. l4 w0 k: ]5 c- A. ?net.ipv6.xfrm6_gc_thresh = 2048
4 ]# k9 R5 g, c4 Z2 xnet.ipv6.conf.all.forwarding = 0
' W# U% W) B8 h( g  y/ Rnet.ipv6.conf.all.hop_limit = 64
net.ipv6.conf.all.mtu = 1280
net.ipv6.conf.all.accept_ra = 1
  {1 p5 s2 k8 V" M. U9 n! anet.ipv6.conf.all.accept_redirects = 1
, L; A6 o+ A. @+ L" E0 g( Bnet.ipv6.conf.all.autoconf = 1
net.ipv6.conf.all.dad_transmits = 1
net.ipv6.conf.all.router_solicitations = 3
net.ipv6.conf.all.router_solicitation_interval = 4
net.ipv6.conf.all.router_solicitation_delay = 1
net.ipv6.conf.all.force_mld_version = 0
net.ipv6.conf.all.use_tempaddr = 0
# f: S2 v' x8 T3 onet.ipv6.conf.all.temp_valid_lft = 604800
net.ipv6.conf.all.temp_prefered_lft = 86400
$ D+ f/ `% u; E) Q4 A* S3 w) F8 Inet.ipv6.conf.all.regen_max_retry = 5
net.ipv6.conf.all.max_desync_factor = 600
" \6 F3 M) z) G/ o; Gnet.ipv6.conf.all.max_addresses = 16
) x9 d! D' D, p* J( w& Dnet.ipv6.conf.all.accept_ra_defrtr = 1
' Z# O. [! k! _- U0 Q; v# b: b( @net.ipv6.conf.all.accept_ra_pinfo = 1
+ C5 {* D5 D1 H7 h6 Y0 e7 K: Lnet.ipv6.conf.all.accept_ra_rtr_pref = 1
* v5 l, n5 b# @$ S3 O/ J! Snet.ipv6.conf.all.router_probe_interval = 60
* M9 A" c4 c, F5 C" C8 y; x4 Jnet.ipv6.conf.all.accept_ra_rt_info_max_plen = 0
4 u; L8 c6 Y* T9 onet.ipv6.conf.all.proxy_ndp = 0
1 D  V' I* d+ J. Q2 A4 Fnet.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.all.optimistic_dad = 0
% D9 U, W) f& }5 E+ rnet.ipv6.conf.all.mc_forwarding = 0
) \2 `; m' R. inet.ipv6.conf.all.disable_ipv6 = 0
: k7 X( L$ n- Z% O& ]  snet.ipv6.conf.all.accept_dad = 1
net.ipv6.conf.default.forwarding = 0
net.ipv6.conf.default.hop_limit = 64
; L' b7 W1 a; Knet.ipv6.conf.default.mtu = 1280
0 s# [$ D0 Z. B, G: K1 z8 S4 @net.ipv6.conf.default.accept_ra = 1
% ?# {' D5 ?/ }( cnet.ipv6.conf.default.accept_redirects = 1
net.ipv6.conf.default.autoconf = 1
net.ipv6.conf.default.dad_transmits = 1
net.ipv6.conf.default.router_solicitations = 3
, U& V- l# L  g% k1 H+ |net.ipv6.conf.default.router_solicitation_interval = 4
) C8 o! Q0 g9 B( Q6 R1 a; Rnet.ipv6.conf.default.router_solicitation_delay = 1
% |0 p9 u  Z7 |  ^net.ipv6.conf.default.force_mld_version = 0
( v' v" y& _& F  c& T( ~, Wnet.ipv6.conf.default.use_tempaddr = 0
. g+ V) G* x3 n3 p' N+ fnet.ipv6.conf.default.temp_valid_lft = 604800
& F) r, Y' ^+ nnet.ipv6.conf.default.temp_prefered_lft = 86400
# r$ l& _3 I! {0 _% Snet.ipv6.conf.default.regen_max_retry = 5
net.ipv6.conf.default.max_desync_factor = 600
( }" ~* j1 O" t. k/ ^. V; }& Jnet.ipv6.conf.default.max_addresses = 16
net.ipv6.conf.default.accept_ra_defrtr = 1
net.ipv6.conf.default.accept_ra_pinfo = 1
net.ipv6.conf.default.accept_ra_rtr_pref = 1
$ F  `* e" s& f" L+ n9 p( D* Anet.ipv6.conf.default.router_probe_interval = 60
net.ipv6.conf.default.accept_ra_rt_info_max_plen = 0
) r4 U# l$ r4 Q4 r, S# jnet.ipv6.conf.default.proxy_ndp = 0
net.ipv6.conf.default.accept_source_route = 0
) M  E" |/ B9 N' d6 bnet.ipv6.conf.default.optimistic_dad = 0
net.ipv6.conf.default.mc_forwarding = 0
net.ipv6.conf.default.disable_ipv6 = 0
net.ipv6.conf.default.accept_dad = 1
; U( x1 Y/ J/ @) ~net.ipv6.conf.lo.forwarding = 0
0 v4 E% @5 `4 }% C+ E0 n/ E+ Jnet.ipv6.conf.lo.hop_limit = 64
- P6 q$ m% r  I1 pnet.ipv6.conf.lo.mtu = 65536
) I/ L2 A; x% Q& Y1 E8 Dnet.ipv6.conf.lo.accept_ra = 1
1 V  F8 _; g3 K) v3 J( b! I2 s  \net.ipv6.conf.lo.accept_redirects = 1
net.ipv6.conf.lo.autoconf = 1
net.ipv6.conf.lo.dad_transmits = 1
1 ~2 V0 H: J8 r9 b& ]3 D9 m, Vnet.ipv6.conf.lo.router_solicitations = 3
+ Q$ `. j) e0 ~9 a$ w4 u2 Inet.ipv6.conf.lo.router_solicitation_interval = 4
net.ipv6.conf.lo.router_solicitation_delay = 1
net.ipv6.conf.lo.force_mld_version = 0
net.ipv6.conf.lo.use_tempaddr = -1
net.ipv6.conf.lo.temp_valid_lft = 604800
1 N! k; D& d0 u- n# Q3 @net.ipv6.conf.lo.temp_prefered_lft = 86400
net.ipv6.conf.lo.regen_max_retry = 5
, A7 H/ T3 j2 G) ]1 h" snet.ipv6.conf.lo.max_desync_factor = 600
net.ipv6.conf.lo.max_addresses = 16
net.ipv6.conf.lo.accept_ra_defrtr = 1
net.ipv6.conf.lo.accept_ra_pinfo = 1
- d) [3 o9 l! j; jnet.ipv6.conf.lo.accept_ra_rtr_pref = 1
5 y( h2 P, i  mnet.ipv6.conf.lo.router_probe_interval = 60
/ n3 L$ f* q6 o& E9 J' unet.ipv6.conf.lo.accept_ra_rt_info_max_plen = 0
net.ipv6.conf.lo.proxy_ndp = 0
0 _) q/ o& Z0 Enet.ipv6.conf.lo.accept_source_route = 0
net.ipv6.conf.lo.optimistic_dad = 0
net.ipv6.conf.lo.mc_forwarding = 0
net.ipv6.conf.lo.disable_ipv6 = 0
8 N3 X' g: R% ~- ], E# znet.ipv6.conf.lo.accept_dad = -1
+ K. }$ ?! _- Wnet.ipv6.conf.eth0.forwarding = 0
, f  f% M1 j+ w) q1 [net.ipv6.conf.eth0.hop_limit = 64
net.ipv6.conf.eth0.mtu = 1500
net.ipv6.conf.eth0.accept_ra = 1
net.ipv6.conf.eth0.accept_redirects = 1
net.ipv6.conf.eth0.autoconf = 1
net.ipv6.conf.eth0.dad_transmits = 1
3 u8 ]. V: U, b* D% m/ W: rnet.ipv6.conf.eth0.router_solicitations = 3
" N- a( c" ]2 k9 }! H  Y: ~net.ipv6.conf.eth0.router_solicitation_interval = 4
net.ipv6.conf.eth0.router_solicitation_delay = 1
9 W( L: Y7 |$ q# `net.ipv6.conf.eth0.force_mld_version = 0
* i0 n8 ?- Z7 d# @net.ipv6.conf.eth0.use_tempaddr = 0
& ]& o, p, I7 d& K  b; Z; c" V" tnet.ipv6.conf.eth0.temp_valid_lft = 604800
! F, p8 _2 L6 |7 a6 w7 j3 z1 y) Tnet.ipv6.conf.eth0.temp_prefered_lft = 86400
net.ipv6.conf.eth0.regen_max_retry = 5
net.ipv6.conf.eth0.max_desync_factor = 600
net.ipv6.conf.eth0.max_addresses = 16
, f4 g; i4 Y! O0 Z/ u  Enet.ipv6.conf.eth0.accept_ra_defrtr = 1
8 }5 |# j* f( z& B, O7 W! Fnet.ipv6.conf.eth0.accept_ra_pinfo = 1
% s9 x: w9 p' Y5 `7 D# G/ P) Dnet.ipv6.conf.eth0.accept_ra_rtr_pref = 1
net.ipv6.conf.eth0.router_probe_interval = 60
$ l( [9 G, G# I+ E( B7 R9 R8 snet.ipv6.conf.eth0.accept_ra_rt_info_max_plen = 0
net.ipv6.conf.eth0.proxy_ndp = 0
- ]$ [# K; V. L4 u4 Z, ^net.ipv6.conf.eth0.accept_source_route = 0
( G% {( z" K' m: u! @1 G; |net.ipv6.conf.eth0.optimistic_dad = 0
net.ipv6.conf.eth0.mc_forwarding = 0
$ `( p, O; P- o% C9 snet.ipv6.conf.eth0.disable_ipv6 = 0
% {: D) y# T* J4 K% E9 ~8 }net.ipv6.conf.eth0.accept_dad = 1
net.ipv6.conf.pan0.forwarding = 0
net.ipv6.conf.pan0.hop_limit = 64
net.ipv6.conf.pan0.mtu = 1500
2 `8 R6 e' c6 X) w; ^: Y+ snet.ipv6.conf.pan0.accept_ra = 1
net.ipv6.conf.pan0.accept_redirects = 1
2 |) @/ r# ^- a1 pnet.ipv6.conf.pan0.autoconf = 1
net.ipv6.conf.pan0.dad_transmits = 1
; o* B2 F6 o8 }" znet.ipv6.conf.pan0.router_solicitations = 3
net.ipv6.conf.pan0.router_solicitation_interval = 4
net.ipv6.conf.pan0.router_solicitation_delay = 1
net.ipv6.conf.pan0.force_mld_version = 0
net.ipv6.conf.pan0.use_tempaddr = 0
0 G5 ^7 C+ X! ], Snet.ipv6.conf.pan0.temp_valid_lft = 604800
net.ipv6.conf.pan0.temp_prefered_lft = 86400
. X6 N, J( V+ m. h$ b/ `net.ipv6.conf.pan0.regen_max_retry = 5
net.ipv6.conf.pan0.max_desync_factor = 600
net.ipv6.conf.pan0.max_addresses = 16
net.ipv6.conf.pan0.accept_ra_defrtr = 1
" F0 r! A. [, j% i& ~net.ipv6.conf.pan0.accept_ra_pinfo = 1
net.ipv6.conf.pan0.accept_ra_rtr_pref = 1
; `% `" w" W; y8 unet.ipv6.conf.pan0.router_probe_interval = 60
/ Y/ I/ J3 C% S0 z4 L  E( Bnet.ipv6.conf.pan0.accept_ra_rt_info_max_plen = 0
, l6 l8 d" y4 T# enet.ipv6.conf.pan0.proxy_ndp = 0
! e+ }2 b1 D3 V+ M5 ]' Rnet.ipv6.conf.pan0.accept_source_route = 0
$ x8 J; \- ]/ bnet.ipv6.conf.pan0.optimistic_dad = 0
net.ipv6.conf.pan0.mc_forwarding = 0
net.ipv6.conf.pan0.disable_ipv6 = 0
! Q  n- C/ L  b7 `" c9 b$ xnet.ipv6.conf.pan0.accept_dad = 1
net.ipv6.ip6frag_high_thresh = 4194304
net.ipv6.ip6frag_low_thresh = 3145728
net.ipv6.ip6frag_time = 60
) W% |, `( }7 U7 a$ V* M+ j0 Ynet.ipv6.route.gc_thresh = 1024
net.ipv6.route.max_size = 4096
, o- i& h* Q9 m$ jnet.ipv6.route.gc_min_interval = 0
4 ?1 s6 L) g6 fnet.ipv6.route.gc_timeout = 60
net.ipv6.route.gc_interval = 30
net.ipv6.route.gc_elasticity = 0
net.ipv6.route.mtu_expires = 600
net.ipv6.route.min_adv_mss = 1
3 _" g  N3 c0 ^5 B  R4 dnet.ipv6.route.gc_min_interval_ms = 500
3 k7 k$ E0 n+ I; snet.ipv6.icmp.ratelimit = 1000
net.ipv6.bindv6only = 0
7 r3 B. S' ~' U; K4 p. K7 d! ^net.ipv6.nf_conntrack_frag6_timeout = 60
* @* L6 k9 e0 }" }/ jnet.ipv6.nf_conntrack_frag6_low_thresh = 3145728
net.ipv6.nf_conntrack_frag6_high_thresh = 4194304
net.ipv6.ip6frag_secret_interval = 600
net.ipv6.mld_max_msf = 64
net.nf_conntrack_max = 65536
- x$ X+ E8 @* t1 r: l1 u0 H' wnet.bridge.bridge-nf-call-arptables = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
0 p' K. ]" h+ X7 r2 pnet.bridge.bridge-nf-filter-vlan-tagged = 0
) H1 m9 J6 b* P0 d& C4 Pnet.bridge.bridge-nf-filter-pppoe-tagged = 0
5 @9 C6 u7 n% d9 {& x( y3 M* x. {# Y+ gnet.unix.max_dgram_qlen = 10
* o) T' C% {* ^3 J/ k1 q$ F% `abi.vsyscall32 = 1
8 [4 }4 U! S" G0 Bcrypto.fips_enabled = 0

admin

内存cache
+ Z( J; |) q/ G! o内存cache占用太多，导致告警，清理方法
3 C- `! s" X* K0 |' ^5 \sync用于强制被改变的内容立刻写入磁盘，更新超块信息
1 i/ \. _7 _2 r. Z先敲下： sync 然后顺序执行如下命令：
sync ; echo 1 > /proc/sys/vm/drop_caches
2 u9 q+ D2 m$ j. A( ^3 osync ; echo 2 > /proc/sys/vm/drop_caches
sync ; echo 3 > /proc/sys/vm/drop_caches
就可以将内存的buff/cache 段信息清理。
% X9 z5 E2 r0 r6 M8 e6 Z上面三种方式都是临时释放缓存的方法，要想永久释放缓存，需要在/etc/sysctl.conf文件中配置：vm.drop_caches=1/2/3，然后sysctl -p生效即可！

因此，这里不得不提一下/proc/sys/vm/vfs_cache_pressure这个文件，告诉内核，当清理inoe/dentry缓存时应该用什么样的优先级。
[root@backup ~]# cat /proc/sys/vm/vfs_cache_pressure
& P: l, E6 O: R- n2 w# M* `100
' q! x/ E2 ~3 N9 ]& N( B3 f1 Wvfs_cache_pressure=100 这个是默认值，内核会尝试重新声明dentries和inodes，并采用一种相对于页面缓存和交换缓存比较"合理"的比例。
; }( |0 |. Z. i& F; Y8 K减少vfs_cache_pressure的值，会导致内核倾向于保留dentry和inode缓存。
$ Y; e0 ^* Z/ X/ y& s3 G增加vfs_cache_pressure的值，（即超过100时），则会导致内核倾向于重新声明dentries和inodes
. K, @& N2 H. r0 `  ]+ T4 f总之，vfs_cache_pressure的值：
4 P; |7 h3 `6 ~小于100的值不会导致缓存的大量减少
超过100的值则会告诉内核你希望以高优先级来清理缓存。
4 K1 Q; ]5 i1 Q  Q其实无论vfs_cache_pressure的值采用什么值，内核清理缓存的速度都是比较低的。
如果将此值设置为10000，系统将会将缓存减少到一个合理的水平。
  m$ N8 Z5 r; h) x8 Vcat /proc/sys/vm/vfs_cache_pressure
3 G* `0 w% q& [2 w* Zecho 10000 >/proc/sys/vm/vfs_cache_pressure

admin

sudo su - root
sync; echo 1 > /proc/sys/vm/drop_caches; echo 0 > /proc/sys/vm/drop_caches
8 w" b2 K+ p* C9 s5 A1 S
drop_caches的值可以是0-3之间的数字，代表不同的含义：
; D) e3 `( [- J5 m4 W
0：不释放（系统默认值）;默认情况下表示不释放内存，由操作系统自动管理;
1：释放页缓存;To free pagecache.
9 j6 \; }) V( r5 B3 I2：释放dentries和inodes；To free dentries and inodes.
4 E# G: f* N7 c: a8 a3：释放所有缓存；To free pagecache, dentries and inodes.
- g; O, g  v8 Q9 J; A+ Z  z其中cache缓存清空命令有三个：

9 @  K0 \7 T2 l4 b( u释放完内存后改回去让系统重新自动分配内存。
% Y* N  p8 K9 [: l% H7 J
9 b) C" i- g% K+ ]（1）、清理pagecache（页面缓存）
sync        # sync命令可以多执行几遍；
9 u+ R5 t1 _3 ~4 l6 o9 E& Necho 1 > /proc/sys/vm/drop_caches     或者 sysctl -w vm.drop_caches=1
9 M) v# ?$ ?+ ^  D0 S( z（2）、清理dentries（目录缓存）和inodes
sync        # sync命令可以多执行几遍；
4 }$ B5 j# n' U+ gecho 2 > /proc/sys/vm/drop_caches     或者 sysctl -w vm.drop_caches=2
5 l% X- B9 g5 X3 n$ `（3）、清理pagecache、dentries和inodes
+ O# s" r9 G: l) G, Ksync        # sync命令可以多执行几遍；
echo 3 > /proc/sys/vm/drop_caches     或者 sysctl -w vm.drop_caches=3
（4）、上面三种方式都是临时释放缓存的方法，要想永久释放缓存，需要在/etc/sysctl.conf文件中配置：vm.drop_caches=1/2/3，然后sysctl -p生效即可！
（5）、另外，可以使用sync命令来清理文件系统缓存，还会清理僵尸(zombie)对象和它们占用的内存

- N3 z6 I- O. i: D- ~* u1 J% M  Fecho 0 >/proc/sys/vm/drop_caches
2 r3 `% v, X) E7 L) V注：在2.6.x系列的内核中可以设置为0，3系列的内核中设置为0就会报错，write error: Invalid argument。只能重启服务器恢复。
free -m #看内存是否已经释放掉了。
$ |# K" _1 S3 J9 F; z% Z: R% \
清除Linux中缓存（Cache）
: E/ R/ h. D: d- m1 i% T6 m: |每个 Linux 系统有三种选项来清除缓存而不需要中断任何进程或服务。

! v; q2 y4 E7 ~2 ?（LCTT 译注：Cache，译作“缓存”，指 CPU 和内存之间高速缓存。Buffer，译作“缓冲区”，指在写入磁盘前的存储再内存中的内容。在本文中，Buffer 和 Cache 有时候会通指。）

仅清除页面缓存(To free pagecache)
+ Z# E) C; A& d" [1 a# sync; echo 1 > /proc/sys/vm/drop_caches; echo 0 > /proc/sys/vm/drop_caches
% A( t8 ~2 M) K) S8 I7 E1 Q# S) L
清除目录项和inode(To free dentries and inodes)
# sync; echo 2 > /proc/sys/vm/drop_caches; echo 0 > /proc/sys/vm/drop_caches
   
清除页面缓存，目录项和inode(To free pagecache, dentries and inodes)
# sync; echo 3 > /proc/sys/vm/drop_caches; echo 0 > /proc/sys/vm/drop_caches
0 D2 I3 H5 f" ?3 v4 h1 h9 B上述命令的说明：

sync 将刷新文件系统缓冲区（buffer），命令通过“;”分隔，顺序执行，shell在执行序列中的下一个命令之前会等待命令的终止。正如内核文档中提到的，写入到drop_cache将清空缓存而不会杀死任何应用程序/服务，echo命令做写入文件的工作。

如果你必须清除磁盘高速缓存，第一个命令在企业和生产环境中是最安全，"...echo 1> ..."只会清除页面缓存。 在生产环境中不建议使用上面的第三个选项"...echo 3 > ..." ，除非你明确自己在做什么，因为它会清除缓存页，目录项和inodes。
+ y9 y7 W  \5 e- I* v
说明，释放前最好sync一下，防止丢数据。
因为LINUX的内核机制，一般情况下不需要特意去释放已经使用的cache。这些cache起来的内容可以增加文件以及的读写速度。

清除Linux的交换空间:
swapoff -a && swapon -a
定时释放
" b6 @  H6 ]! p* N. }[root@dehetu]# mkdir -p /root/scripts
[root@dehetu]# vim /root/scripts/freemem.sh
#!/bin/bash

  b( b) `8 e2 H0 |& z# f7 ]# g6 i! ]used=`free -m | awk 'NR==2' | awk '{print $3}'`
free=`free -m | awk 'NR==2' | awk '{print $4}'`

% m% @+ W9 J7 V5 I* m# t& f4 Y0 Aecho "===========================" >> /var/log/mem.log
date >> /var/log/mem.log
echo "Memory usage | [Use：${used}MB][Free：${free}MB]" >> /var/log/mem.log
- K) W) V2 S6 R; P
if [ $free -le 100 ] ; then
! m. U) H. G' F/ L                sync && echo 1 > /proc/sys/vm/drop_caches
4 u" q+ c3 e* u6 B4 i% |/ B                sync && echo 2 > /proc/sys/vm/drop_caches
                sync && echo 3 > /proc/sys/vm/drop_caches
                echo "OK" >> /var/log/mem.log
/ ~& ~: w) F3 X, velse
. d- M6 Z: k* {# P                echo "Not required" >> /var/log/mem.log
. p* s$ c/ x* H$ p) Jfi

将脚本添加到crond任务，定时执行。
" [6 @9 F, i; c4 _[root@dehetu]# echo "*/30 * * * * root /root/scripts/freemem.sh" >> /var/spool/cron/root