Linux Labs
Where to start First steps track · 15 stages
Linux Labs
EN

sysctl — kernel parameters at runtime

9 min Ubuntu 24.04 · procps 4.0

sysctl reads and changes kernel parameters; -w lasts until reboot, a file in /etc/sysctl.d/ makes it permanent.

Cheat sheet

8 commands Printable version
  • sysctl vm.swappiness read a parameter
  • sysctl -n vm.swappiness the value only
  • sudo sysctl -w vm.swappiness=10 until reboot
  • echo 'vm.swappiness = 10' \
  • | sudo tee /etc/sysctl.d/90-swappiness.conf permanently
  • sudo sysctl --system apply all files
  • sudo sysctl -p /etc/sysctl.d/90-swappiness.conf one file
  • sysctl -a 2>/dev/null | grep forward find a parameter

Overview

Kernel parameters are numbers and strings that change kernel behaviour on the fly: the eagerness to swap, packet forwarding, file limits. sysctl reads and changes them without a reboot. A change made with sysctl -w lasts until reboot; a permanent value goes into a file in /etc/sysctl.d/.

Names and /proc/sys

Every parameter is a file in /proc/sys (see proc-filesystem). The parameter name is the file path with slashes replaced by dots: vm.swappiness is /proc/sys/vm/swappiness.

text 
student@ubuntu:~$ sysctl vm.swappiness
vm.swappiness = 60
student@ubuntu:~$ cat /proc/sys/vm/swappiness
60

The first part of the name is the subsystem: vm — memory, net — network, fs — files, kernel — the kernel itself. For the student, sysctl -a shows about 900 parameters; some of them cannot be read, and permission denied on key goes to standard error.

Change it now

text 
student@ubuntu:~$ sudo sysctl net.ipv4.ip_forward=1
net.ipv4.ip_forward = 1
student@ubuntu:~$ cat /proc/sys/net/ipv4/ip_forward
1

The -w key (sudo sysctl -w net.ipv4.ip_forward=1) does the same and can be omitted. There must be no spaces around = on the command line (see troubleshooting). The value lasts until reboot.

Permanently: /etc/sysctl.d

At boot the values come from *.conf files in three directories:

Directory Whose files
/etc/sysctl.d/ the administrator's — put yours here
/run/sysctl.d/ temporary, until reboot (absent on the training machine)
/usr/lib/sysctl.d/ packages': 10-apparmor.conf, 50-pid-max.conf

Files from all directories are sorted by name and applied in order: a parameter from a later file overrides an earlier one. That is why names start with a number — 90-swappiness.conf is applied after 10-… and 50-…. A file in /etc with the same name as one in /usr/lib replaces it entirely. /etc/sysctl.conf is applied last; the link 99-sysctl.conf in /etc/sysctl.d/ points to it.

A file line is name = value; spaces around = are fine here:

bash 
echo 'vm.swappiness = 10' | sudo tee /etc/sysctl.d/90-swappiness.conf
sudo sysctl --system
text 
* Applying /usr/lib/sysctl.d/10-apparmor.conf ...
…
* Applying /etc/sysctl.d/90-swappiness.conf ...
…
vm.swappiness = 10

sysctl --system applies all files the same way as at boot and prints each file and each value. Only *.conf files are read: a 99-z.txt or 99-sysctl.conf.bak file in the same directory is skipped silently.

Options

5

Common parameters:

Parameter What for
vm.swappiness eagerness to swap (60 by default)
net.ipv4.ip_forward packet forwarding: router, NAT, containers
fs.nr_open ceiling of the per-process open files limit
fs.file-max open files for the whole system
fs.inotify.max_user_watches inotify watches (editors, tail -f)
kernel.pid_max the largest PID (4194304 on Ubuntu)
kernel.dmesg_restrict 1 — dmesg for root only
kernel.hung_task_timeout_secs after how many seconds in D the kernel reports a hung task
net.core.somaxconn connection queue of a listening socket

The command's own options are in the table below.

Option What it does Example
-w param=value Change a parameter now; the change lasts until reboot. sudo sysctl -w net.ipv4.ip_forward=1
-a List every kernel parameter — about 900 on the training machine, usually piped through grep. sysctl -a 2>/dev/null | grep forward
--system Apply all sysctl.d files and sysctl.conf in the correct order. sudo sysctl --system
-p FILE Apply parameters from a specific file (defaults to /etc/sysctl.conf). sudo sysctl -p /etc/sysctl.d/99-forward.conf
-n Print only the value, without the parameter name — convenient in scripts. sysctl -n vm.swappiness

Nothing found. Try a shorter query.

Recipes

4

Find a parameter

bash 
sysctl -a 2>/dev/null | grep swappiness
sudo sysctl -a | grep -i forward

2>/dev/null hides the permission denied on key lines; with sudo all parameters are visible.

Check that a value survives a reboot

bash 
grep -r swappiness /etc/sysctl.d/ /etc/sysctl.conf /usr/lib/sysctl.d/
sudo sysctl --system | grep -E 'Applying|swappiness'

If sysctl --system gives the right value, boot will give the same: the systemd-sysctl service reads the same files in the same order.

Who set the value

sysctl --system first prints all the * Applying … lines in order, then all the values. systemd-analyze shows more clearly which file set a parameter last: the files in the order they apply, each after a # /path line:

bash 
systemd-analyze cat-config sysctl.d | grep -B3 'swappiness'
text 
kernel.pid_max = 4194304

# /etc/sysctl.d/95-test.conf
vm.swappiness = 33

A value from a file lower in this list overrides the ones above it.

Return the default value

Remove your file from /etc/sysctl.d/ and set the value by hand (sudo sysctl -w vm.swappiness=60) or reboot — sysctl --system does not restore old values, it only applies files.

Troubleshooting

6

Changed it, reset after a reboot

sysctl -w and writes to /proc/sys last until reboot. You need a *.conf file in /etc/sysctl.d/ (section "Permanently" above).

permission denied on key, yet the value is printed

text 
student@ubuntu:~$ sysctl -w vm.swappiness=20; echo rc=$?
vm.swappiness = 20
sysctl: permission denied on key "vm.swappiness", ignoring
rc=0
student@ubuntu:~$ sysctl vm.swappiness
vm.swappiness = 60

Without sudo, sysctl prints the line with the new value and exits with 0, but does not change the value. The error is on standard error. Repeat with sudo and check by reading.

A file in sysctl.d is not applied

  • The name does not end in .conf — the file is skipped silently.
  • Another file later in alphabetical order sets its own value — find it: grep -r <parameter> /etc/sysctl.d/ /usr/lib/sysctl.d/ /etc/sysctl.conf.
  • A typo in the parameter name: sysctl --system skips it without a message and with exit code 0. sudo sysctl -p <file> shows cannot stat /proc/sys/…: No such file or directory and returns 1.

cannot stat /proc/sys/…: No such file or directory

bash 
sudo sysctl -w net.ipv4.no_such=1   # exit code 1

The answer is sysctl: cannot stat /proc/sys/net/ipv4/no_such: No such file or directory.

There is no such parameter: a typo, or the parameter appears only with a kernel module (for example, net.netfilter.* after nf_conntrack is loaded, see kernel-modules).

invalid syntax, continuing

text 
student@ubuntu:~$ sudo sysctl -w net.ipv4.ip_forward = 1
sysctl: command line(0): invalid syntax, continuing...

On the command line name=value has no spaces. In sysctl.d files spaces around = are fine.

Forwarding is on, but packets do not pass

Besides net.ipv4.ip_forward = 1 you need routes (ip) and allowing firewall rules, plus a masquerade rule for NAT.

Danger zone

1

sysctl --system --dry-run writes to the kernel

--dry-run should only show what would be applied. In procps 4.0.4 the order of keys matters: sudo sysctl --dry-run --system changes nothing, while sudo sysctl --system --dry-run applies the files for real. Checked on the training machine: after the second command vm.swappiness went from 60 to 33. To try a file, use sudo sysctl --dry-run -p <file>.

See also

Found an inaccuracy? Report an error in the article

Practice on this topic

Lessons on this topic

Topics
Loading…