Skip to content

Common sysctl parameters

Synopsis

sysctl NAME…                     read parameters
sysctl -w NAME=VALUE…            set parameters until the next boot
sysctl -p [FILE]                 apply a file (default /etc/sysctl.conf)
sysctl --system                  apply every configuration file, in boot order
sysctl -a                        list every parameter and its value

/etc/sysctl.d/*.conf             NAME = VALUE, one per line; # or ; starts a comment

Description

Kernel parameters, often called sysctl parameters, are run-time settings of the Linux kernel, exposed as files below /proc/sys/. A parameter's name is its path with dots instead of slashes: vm.swappiness is /proc/sys/vm/swappiness. Reading a parameter needs no privileges (with a few exceptions); writing one needs root, or the capability that guards it. Values written at run time are lost at reboot; settings in the configuration files below are applied again at every boot. Making a change persistent is covered in How to change kernel parameters persistently.

The values in the tables are those observed on the lab images used to verify this knowledge base: the official cloud images of each distribution (Gentoo's converted to OpenRC), each with 2 CPUs and 2 GiB of memory, on x86-64. Several defaults depend on memory size, kernel version, the kernel command line or installed packages, and on an installed system can differ from these images, as noted. The values were read with sysctl from procps-ng 4.0.4 to 4.0.7, on Linux 6.12 (Debian 13, AlmaLinux 10, Rocky Linux 10), 6.18 (Gentoo), 7.0 (Ubuntu 26.04) and 7.2 (Arch Linux), in November 2026.

The tables' columns are Debian 13, Ubuntu 26.04, AlmaLinux 10, Rocky Linux 10, Arch Linux and Gentoo with OpenRC.

Memory (vm.*)

Parameter Controls
vm.swappiness How readily the kernel reclaims anonymous memory (by swapping) relative to page cache, 0 to 200. Lower values favour keeping process memory in RAM
vm.overcommit_memory Allocation policy: 0 heuristic overcommit, 1 always allow, 2 strict accounting against CommitLimit
vm.overcommit_ratio With policy 2: the percentage of RAM that, added to swap, makes up CommitLimit
vm.overcommit_kbytes With policy 2: an absolute amount used instead of vm.overcommit_ratio when non-zero
vm.dirty_ratio Percentage of available memory that may hold dirty (unwritten) page cache before processes writing data are made to write it out themselves
vm.dirty_background_ratio Percentage of available memory holding dirty pages at which background writeback starts
vm.vfs_cache_pressure How readily the kernel reclaims the directory entry and inode caches relative to page cache; 100 is neutral
vm.min_free_kbytes Memory, in KiB, the kernel keeps free for its own urgent allocations
vm.max_map_count Maximum number of memory mappings per process
vm.panic_on_oom 1 or 2: panic instead of running the OOM killer
Parameter Debian Ubuntu AlmaLinux Rocky Arch Gentoo
vm.swappiness 60 60 30 ¹ 60 60 60
vm.overcommit_memory 0 0 0 0 0 0
vm.overcommit_ratio 50 50 50 50 50 50
vm.overcommit_kbytes 0 0 0 0 0 0
vm.dirty_ratio 20 20 30 ¹ 20 20 20
vm.dirty_background_ratio 10 10 10 10 10 10
vm.vfs_cache_pressure 100 100 100 100 100 100
vm.min_free_kbytes ² 45056 45056 45056 45056 45056 45056
vm.max_map_count 1048576 1048576 1048576 1048576 1048576 65530
vm.panic_on_oom 0 0 0 0 0 0

¹ Set by the tuned service's virtual-guest profile, which is installed and active on AlmaLinux's cloud image. Rocky Linux's cloud image doesn't include tuned; an installed RHEL-family system usually has it, with a profile chosen for the hardware. ² Calculated by the kernel from the amount of memory.

vm.max_map_count is 65530 in the kernel; the distributions that show 1048576 raise it in a file in /usr/lib/sysctl.d/.

Kernel (kernel.*)

Parameter Controls
kernel.dmesg_restrict 1: only processes with CAP_SYSLOG (in practice, root) can read the kernel log with dmesg
kernel.kptr_restrict Hiding of kernel addresses in /proc and logs: 0 no restriction, 1 hidden from users without CAP_SYSLOG, 2 hidden from everyone
kernel.sysrq Which Magic SysRq functions are allowed: 0 none, 1 all, or a bit mask of allowed groups of functions (16 = sync only; 176 = sync, remount read-only and reboot or power off; 438 = everything except debugging dumps and signalling processes)
kernel.panic Seconds to wait before rebooting after a kernel panic; 0 waits forever
kernel.panic_on_oops 1: turn a kernel oops into a panic
kernel.pid_max Highest PID plus one; PIDs wrap around at this value
kernel.threads-max Maximum number of threads system-wide; calculated from memory size
kernel.randomize_va_space Address space layout randomisation: 0 off, 1 stack, libraries and mappings, 2 also the heap
kernel.yama.ptrace_scope Who may attach debuggers with ptrace(): 0 any process of the same user, 1 only ancestors, 2 only with CAP_SYS_PTRACE, 3 nobody
kernel.unprivileged_bpf_disabled 1 or 2: unprivileged users can't load BPF programs (2 can be changed back by root)
kernel.perf_event_paranoid Restrictions on performance monitoring for unprivileged users; higher is stricter. Values above 2 come from distribution patches
kernel.unprivileged_userns_clone 1: unprivileged users may create user namespaces. A patch in the Debian, Ubuntu and Arch Linux kernels; not present in other kernels
kernel.apparmor_restrict_unprivileged_userns 1: AppArmor restricts user namespaces created by unconfined unprivileged programs. Ubuntu only
Parameter Debian Ubuntu AlmaLinux Rocky Arch Gentoo
kernel.dmesg_restrict 1 1 1 1 1 1
kernel.kptr_restrict 0 1 1 1 0 0
kernel.sysrq 438 176 16 16 16 16
kernel.panic 0 0 0 0 0 0
kernel.panic_on_oops 0 0 1 1 0 0
kernel.pid_max 4194304 4194304 4194304 4194304 4194304 4194304
kernel.randomize_va_space 2 2 2 2 2 2
kernel.yama.ptrace_scope 0 1 0 0 1 1
kernel.unprivileged_bpf_disabled 2 2 2 2 2 2
kernel.perf_event_paranoid 3 4 2 2 2 2
kernel.unprivileged_userns_clone 1 1 – – 1 –
kernel.apparmor_restrict_unprivileged_userns – 1 – – – –

A dash means the parameter doesn't exist on that kernel. kernel.pid_max is 4194304 everywhere because systemd's 50-pid-max.conf sets it; Gentoo installs that file with sys-apps/systemd-utils on OpenRC systems too.

Filesystems (fs.*)

Parameter Controls
fs.file-max Maximum number of open files system-wide
fs.file-nr Read-only: allocated file handles, free allocated handles (always 0 on current kernels), and fs.file-max
fs.nr_open Highest value a process's open-files limit (RLIMIT_NOFILE) can be raised to
fs.inotify.max_user_watches Maximum inotify watches per user; calculated from memory size unless set
fs.inotify.max_user_instances Maximum inotify instances per user
fs.protected_symlinks, fs.protected_hardlinks 1: restrict following symbolic links and creating hard links in world-writable sticky directories such as /tmp, to prevent link attacks
fs.protected_fifos, fs.protected_regular Restrict opening named pipes (FIFO files) and regular files owned by others in world-writable sticky directories: 1 in world-writable directories, 2 also in group-writable ones
fs.suid_dumpable Core dumps of set-user-ID programs: 0 none, 1 all, 2 readable by root only
Parameter Debian Ubuntu AlmaLinux Rocky Arch Gentoo
fs.file-max 9223372036854775807 9223372036854775807 9223372036854775807 9223372036854775807 9223372036854775807 189748 ²
fs.nr_open 1073741816 2147483584 1073741816 1073741816 2147483584 1048576
fs.inotify.max_user_watches ² 15393 15243 14974 13352 524288 15157
fs.inotify.max_user_instances 128 128 128 128 1024 128
fs.protected_symlinks 1 1 1 1 1 1
fs.protected_hardlinks 1 1 1 1 1 1
fs.protected_fifos 1 1 1 1 1 1
fs.protected_regular 2 2 1 1 1 1
fs.suid_dumpable 0 2 2 2 2 0

² Calculated by the kernel from the amount of memory; Arch sets a fixed value in /usr/lib/sysctl.d/10-arch.conf.

On the systemd distributions, fs.file-max is the largest 64-bit signed integer, which means "no system-wide limit": systemd raises it, and raises fs.nr_open to the highest value the kernel accepts, when it starts. Gentoo with OpenRC keeps the kernel's own defaults, a fs.file-max calculated from the amount of memory and a fs.nr_open of 1048576. In practice the number of open files is limited per process by RLIMIT_NOFILE (see Process information fields).

Networking (net.*)

Parameter Controls
net.ipv4.ip_forward 1: forward IPv4 packets between interfaces (act as a router). Also sets net.ipv4.conf.all.forwarding
net.ipv6.conf.all.forwarding 1: forward IPv6 packets between interfaces
net.core.somaxconn Upper limit on the backlog (queue of completed connections awaiting accept()) a program can request for a listening socket
net.ipv4.tcp_max_syn_backlog Maximum queued connection requests that haven't completed the TCP handshake; calculated from memory size
net.core.netdev_max_backlog Maximum packets queued on input when an interface receives faster than the kernel processes
net.core.rmem_max, net.core.wmem_max Largest receive and send buffer, in bytes, a program can set with setsockopt()
net.core.default_qdisc Queueing discipline for network interfaces that don't configure one
net.ipv4.tcp_congestion_control Default TCP congestion control algorithm
net.ipv4.tcp_syncookies 1: use SYN cookies when the SYN queue overflows, to resist SYN floods
net.ipv4.ip_local_port_range Range of local ports used for outgoing connections
net.ipv4.conf.all.rp_filter, net.ipv4.conf.default.rp_filter Reverse path filtering: 0 off, 1 strict, 2 loose. The effective value for an interface is the higher of all and the interface's own value; default is copied to interfaces created later
net.ipv4.conf.all.accept_redirects 1: accept ICMP redirects, which tell the host to use a different router
net.ipv4.conf.all.accept_source_route 1: accept source-routed packets
net.ipv4.icmp_echo_ignore_broadcasts 1: don't answer pings sent to broadcast addresses
net.ipv4.ping_group_range Groups whose members may create ICMP echo sockets, so ping works without privileges
net.ipv4.tcp_keepalive_time Seconds a TCP connection with keepalive enabled is idle before probes start
net.ipv4.tcp_fin_timeout Seconds an orphaned connection stays in the FIN-WAIT-2 state
Parameter Debian Ubuntu AlmaLinux Rocky Arch Gentoo
net.ipv4.ip_forward 0 0 0 0 0 0
net.ipv6.conf.all.forwarding 0 0 0 0 0 0
net.core.somaxconn 4096 4096 4096 4096 4096 4096
net.ipv4.tcp_max_syn_backlog ² 128 128 128 128 128 128
net.core.netdev_max_backlog 1000 1000 1000 1000 1000 1000
net.core.rmem_max 212992 4194304 212992 212992 4194304 4194304
net.core.wmem_max 212992 4194304 212992 212992 4194304 4194304
net.core.default_qdisc fq_codel fq_codel fq_codel fq_codel fq_codel fq_codel
net.ipv4.tcp_congestion_control cubic cubic cubic cubic cubic cubic
net.ipv4.tcp_syncookies 1 1 1 1 1 1
net.ipv4.ip_local_port_range 32768 60999 32768 60999 32768 60999 32768 60999 32768 60999 32768 60999
net.ipv4.conf.all.rp_filter 0 2 0 0 0 0
net.ipv4.conf.default.rp_filter 2 2 1 1 2 2
net.ipv4.conf.all.accept_redirects 1 1 1 1 1 1
net.ipv4.conf.all.accept_source_route 0 0 0 0 0 0
net.ipv4.icmp_echo_ignore_broadcasts 1 1 1 1 1 1
net.ipv4.ping_group_range 0 2147483647 0 2147483647 0 2147483647 0 2147483647 0 2147483647 0 2147483647
net.ipv4.tcp_keepalive_time 7200 7200 7200 7200 120 ³ 7200
net.ipv4.tcp_fin_timeout 60 60 60 60 60 60

² Calculated by the kernel from the amount of memory.

³ Set in /usr/lib/sysctl.d/10-arch.conf.

The rmem_max and wmem_max values follow the kernel version: 212992 on the Linux 6.12 kernels, 4194304 on the newer ones. Container engines and some network services set net.ipv4.ip_forward to 1 when they start, so a running system can differ from its configuration files.

Where the defaults come from

A parameter's value is the kernel's built-in default unless a configuration file sets it. The files read at boot on the lab images, other than the README files:

Distribution Files that set parameters
Debian 13 /usr/lib/sysctl.d/10-coredump-debian.conf, 50-default.conf, 50-pid-max.conf
Ubuntu 26.04 As Debian, plus /usr/lib/sysctl.d/10-apparmor.conf and the 55-*.conf files (including 55-kernel-hardening.conf, 55-magic-sysrq.conf, 55-network-security.conf and 55-ptrace.conf), and /etc/sysctl.d/99-cloudimg-ipv6.conf in the cloud image
AlmaLinux 10, Rocky Linux 10 /usr/lib/sysctl.d/10-default-yama-scope.conf, 10-map-count.conf, 50-coredump.conf, 50-default.conf, 50-libkcapi-optmem_max.conf, 50-pid-max.conf, 50-redhat.conf; /etc/sysctl.conf through the link /etc/sysctl.d/99-sysctl.conf; and, when tuned runs, its profile
Arch Linux /usr/lib/sysctl.d/10-arch.conf, 50-coredump.conf, 50-default.conf, 50-pid-max.conf; /run/sysctl.d/60-coredump.conf, generated at boot by systemd-coredump, which sets kernel.core_pattern
Gentoo (OpenRC) /usr/lib/sysctl.d/00protected-links.conf, 40-ping_group_range.conf, 50-default.conf, 50-pid-max.conf

50-default.conf and 50-pid-max.conf are systemd's files, which each distribution adapts slightly. On Debian and Ubuntu, 50-default.conf belongs to the linux-sysctl-defaults package; on Gentoo, both are installed by sys-apps/systemd-utils with its sysctl USE flag (on by default), also on OpenRC systems.

Files

Path Purpose
/proc/sys/ The parameters themselves
/etc/sysctl.d/*.conf Local settings; a file here replaces a file of the same name in the directories below
/run/sysctl.d/*.conf Settings generated at run time
/usr/local/lib/sysctl.d/*.conf Locally installed packages' settings (read by systemd-sysctl and by sysctl --system)
/usr/lib/sysctl.d/*.conf Settings installed by packages
/etc/sysctl.conf Legacy single file, read last by sysctl --system. Read at boot on the RHEL family (through /etc/sysctl.d/99-sysctl.conf) and on Gentoo with OpenRC (whose sysctl service runs sysctl --system), if it exists; not read at boot by systemd-sysctl on Debian, Ubuntu and Arch. Absent by default on Debian, Ubuntu, Arch and Gentoo

All files are read together and applied in the lexical order of their file names; a later setting of the same parameter overrides an earlier one. At boot, systemd-sysctl.service applies them on the systemd distributions, and the sysctl service in OpenRC's boot runlevel runs sysctl --system on Gentoo.

See also

  • sysctl(8), sysctl.conf(5) (procps-ng 4.0), sysctl.d(5) and systemd-sysctl.service(8) (systemd 257 to 262)
  • The kernel's Documentation for /proc/sys, with pages for kernel, vm, fs and net
  • The kernel's IP sysctl documentation for net.ipv4.* and net.ipv6.*