Application systems run on top of the operating system, and the performance of the system also affects the performance of the application programs. Here are some key configuration details for optimizing Linux performance.
Disable SELinux Permanently
SELinux enhances system security but can cause many issues, so it is generally recommended to disable it.
[root@localhost ~]# vim /etc/selinux/config
Change SELINUX=enforcing to SELINUX=disabled, save and exit, then reboot for the changes to take effect.
[root@localhost ~]# reboot
Set System Runlevel to 3
To save system resources.
[root@localhost ~]# grep 3:initdefault /etc/inittab
id:3:initdefault:
[root@localhost ~]# init 3
Increase Maximum Value of System File Descriptors
vim /etc/security/limits.conf
Adjust the values as follows:
* soft nofile 65536
* hard nofile 65536
* soft nproc 65536
* hard nproc 65536
Explanation:
-
* represents all users.
-
nproc represents the maximum number of processes.
-
nofile represents the maximum number of open files.
Adjust Kernel Parameters in /etc/sysctl.conf
Configure network parameters to improve system load capacity. If packet loss occurs on the server, consider adjusting the following configurations:
vim /etc/sysctl.conf
net.ipv4.tcp_syncookies = 1
This enables SYN Cookies. When the SYN wait queue overflows, cookies are used to handle it, which can prevent a small number of SYN attacks. The default is 0, which means disabled.
net.ipv4.tcp_tw_reuse = 1
This enables reuse. It allows TIME-WAIT sockets to be reused for new TCP connections. The default is 0, which means disabled.
net.ipv4.tcp_tw_recycle = 1
This enables fast recycling of TIME-WAIT sockets in TCP connections. The default is 0, which means disabled.
net.ipv4.tcp_fin_timeout = 30
This parameter determines how long a socket remains in FIN-WAIT-2 state if it is closed by the local end.
net.ipv4.tcp_keepalive_time = 1200
This indicates the frequency of TCP sending keepalive messages when keepalive is enabled. The default is 2 hours, changed to 20 minutes.
net.ipv4.ip_local_port_range = 1024 65000
This specifies the range of ports used for outgoing connections. By default, it is small: 32768 to 61000, changed to 1024 to 65000.
net.ipv4.tcp_max_syn_backlog = 8192
This indicates the length of the SYN queue, which defaults to 1024. Increasing the queue length to 8192 can accommodate more waiting network connections.
net.nf_conntrack_max = 655360
This is the maximum number of “tasks” (connection tracking entries) that netfilter can handle in kernel memory.
Firewall Configuration
Add the following firewall-related configurations at the end of /etc/sysctl.conf:
This may be in the sysctl.conf.first file.
Enable reuse and recycle socket resources for new TCP connections.
net.ipv4.tcp_tw_reuse=1
Enable recycling:
net.ipv4.tcp_tw_recycle=1
Maximum network connections and timeout configurations:
net.nf_conntrack_max = 25000000
net.netfilter.nf_conntrack_max = 25000000
net.netfilter.nf_conntrack_tcp_timeout_established = 180
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120
net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120
net.nf_conntrack_max
This determines the size of the connection tracking table, with a default value of 65535. A reasonable value can be calculated based on system memory size: > CONNTRACK_MAX = RAMSIZE(in bytes)/16384/(ARCH/32). For example, with 32G of memory, it can be set to 1048576.
nf_conntrack_buckets
This determines the size of the hash table for storing conntrack entries, with a default of 1/4 of nf_conntrack_max. Following this calculation: BUCKETS => CONNTRACK_MAX/4. For example, with 32G of memory, it can be set to 262144.
net.netfilter.nf_conntrack_max
This is the maximum number of connections.
net.netfilter.nf_conntrack_tcp_timeout_established
This determines the timeout for established connections, with a default of 5 days, which can be shortened to 1 hour (3600 seconds).
net.netfilter.nf_conntrack_tcp_timeout_time_wait
This determines the timeout waiting period for connections in the TIME_WAIT state.
net.netfilter.nf_conntrack_tcp_timeout_close_wait
This determines the timeout waiting period for connections in the CLOSE_WAIT state.
net.netfilter.nf_conntrack_tcp_timeout_fin_wait
This determines the timeout waiting period for connections in the FIN_WAIT state.
Make the above configurations effective:
sysctl -p
Common Exceptions
-
Too many open files
This is a common error in Linux systems. Literally, it means that the number of files opened by the program exceeds the limit. However, here, “files” does not only refer to files but also includes open communication links (like sockets), listening ports, etc. Therefore, it can also be referred to as handle count exceeding system limits.
In high concurrency situations or if the program code does not properly close IO, and with a relatively small system limit, this exception is thrown when the number of open handles exceeds the system limit after the system has been running for a while.
Solution: Increase the maximum value of system file descriptors.
-
Connection server timeout
This is generally caused by too many TIME_WAIT processes, usually because the application does not properly close connections, leading to excessive TIME_WAIT processes on the server. Actively closing connections causes TIME_WAIT to occur. First, check the program and the above system configurations.
Solution: Resolve program issues and check system kernel network and firewall kernel settings.
Common Commands
Check the network status of the machine:
netstat -n | awk '/^tcp/ {++state[$NF]} END {for(key in state) print key,"\t",state[key]}'
Status: Description
CLOSED: No connections are active or in progress.LISTEN: The server is waiting for incoming calls.SYN_RECV: A connection request has arrived, waiting for confirmation.SYN_SENT: The application has started to open a connection.ESTABLISHED: Normal data transmission state.FIN_WAIT1: The application says it has completed.FIN_WAIT2: The other side has agreed to release.TIME_WAIT: The other side has initiated a release.LAST_ACK: Waiting for all packets to die.
Conclusion
Linux provides a wealth of kernel parameters for users to adjust. Proper adjustments can significantly enhance the server’s processing capabilities.
Link: https://www.cnblogs.com/pgyLang/p/15769748.html
(Copyright belongs to the original author, please delete if infringed)
WeChat group
For better communication on operation and maintenance-related technical issues, a WeChat group has been created. Friends who want to join the group can scan the QR code below to add me as a friend (note: join group).
Blog
CSDN Blog: https://blog.csdn.net/qq_25599925
Juejin Blog: https://juejin.cn/user/4262187909781751
Knowledge Planet: https://wx.zsxq.com/group/15555885545422
Long press to recognize the QR code to visit the blog website for more quality original content.