System tuning

/etc/sysctl

Wykonanie wpisów sysctl, aby system działał sprawniej

# --- sterowanie liczbą socketów --------------------------------
#
kern.ipc.maxsockbuf=16777216
##kern.ipc.nmbclusters=32768
kern.ipc.somaxconn=32768
kern.maxfiles=65536
kern.maxfilesperproc=32768
kern.maxvnodes=800000

# --- ograniczenie liczby pakietów FRAGmented dla IPFilter ------
#
# (szczeg/olnie wa/zne dla systemów > 10.x - IPFilter coraz bardziej
# odstaje od systemu - brak aktualizacji)
#
net.inet.ipf.fr_statesize=65536
net.inet.ipf.fr_statemax=65536

Serwer proxy wraz z unbound (resolver)

Na podstawie artykułów ze strony https://calomel.org:

sysctl.conf

# --- unbound resources -----------------------------------------------------
#
net.inet.tcp.recvbuf_inc=65535
net.inet.tcp.sendbuf_inc=16384

# --- IPFilter FRAGmented packets -------------------------------------------
#
net.inet.ipf.fr_statesize=65536
net.inet.ipf.fr_statemax=65536

# --- network security ------------------------------------------------------
#
net.inet.icmp.bmcastecho=0
net.inet.icmp.drop_redirect=1
net.inet.icmp.log_redirect=1
net.inet.tcp.drop_synfin=1

# Na podsawie https://calomel.org/freebsd_network_tuning.html
#
kern.ipc.maxsockbuf=4194304
#net.inet.tcp.cc.algorithm=htcp
net.inet.tcp.cc.htcp.adaptive_backoff=1
net.inet.tcp.cc.htcp.rtt_scaling=1
kern.ipc.soacceptqueue=1024
net.inet.tcp.sack.enable=1

# --- przyspieszenie ruchu dla loopback -------------------------------------
#
net.inet.tcp.nolocaltimewait=1
net.local.stream.sendspace=164240  # (default 8192)
net.local.stream.recvspace=164240  # (default 8192)

# --- ustawienia dotycz/ace spe/lnienia RFC ---------------------------------
#
net.inet.tcp.rfc1323=1  # (default 1)
net.inet.tcp.rfc3390=1  # (default 1)

# --- sterowanie wielko/sci/a okna pakietu TCP ------------------------------
#
net.inet.tcp.minmss=1300
net.inet.tcp.mssdflt=1460
kern.ipc.soacceptqueue=1024

# --- bezpiecze/nstwo dla IPv6 ----------------------------------------------
#
net.inet6.icmp6.nodeinfo=0
net.inet6.ip6.use_tempaddr=1
net.inet6.ip6.prefer_tempaddr=1
net.inet6.icmp6.rediraccept=0

/boot/loader.conf

#
# loader.conf
#
# Lokalna konfiguracja bootowania systemu operacyjnego
#

geom_mirror_load="YES"
opensolaris_load="YES"
zfs_load="YES"

kern.geom.label.disk_ident.enable="0"
kern.geom.label.gpt.enable="1"
kern.geom.label.gptid.enable="0"

# --- karta sieciowa ----------------------------------
#
miibus_load="YES"
if_bge_load="YES"

# --- wielokonsolowo/s/c ------------------------------
#
# Zgodnie z informacjami znalezionymi w sieci HP ML 110 G6 posiada emulacj/e PS/2
# opart/a na USB. Jednocze/snie nie mo/zna ustawi/c "USB Legacy", a zatem w trakcie
# bootowania nie ma klawiatury
# Poprzez przekierowanie konsoli na ttyu0 mo/zna sterowa/c procesem bootowania poprzez
# dedykowany port "MGMT" w serwerze
# Linki w sieci:
# https://www.freebsd.org/doc/handbook/serialconsole-setup.html
# http://h30499.www3.hp.com/t5/ProLiant-Servers-ML-DL-SL/ML110-G6-ILO-Password/td-p/2326467
# http://h20000.www2.hp.com/bc/docs/support/SupportManual/c02063205/c02063205.pdf
#
boot_multicons="YES"
boot_serial="YES"
comconsole_speed="9600"
console="comconsole,vidconsole"

# --- Konfiguracja rozmiaru pami/eci dla kernela oraz ZFS -------------------
#
vm.kmem_size="6G"
vfs.zfs.arc_max="3G"

# accf accept filters are used so the server will not have to context switch several times
# before performing the initial parsing of the request. This could decrease server load by
# reducing the amount of CPU time to handle incoming requests.

# Wait for data accept filter. For nginx https servers add "listen
# 127.0.0.1:443 ssl spdy accept_filter=dataready;"
##accf_data_load="YES"

# buffer incoming connections until complete HTTP requests arrive (nginx
# apache) for nginx http add, "listen 127.0.0.1:80 accept_filter=httpready;"
##accf_http_load="YES"

# Wait for full DNS request accept filter (unbound)
accf_dns_load="YES"

# Je/zeli nie jest wkompilowane w kernel:
# Advanced Host Controller Interface (AHCI)
#ahci_load="YES"

# Asynchronous I/O, or non-blocking I/O is a form of input/output processing
# permiting other processing to continue before the transmission has finished.
# AIO is used for accelerating Nginx on ZFS. Check for our tutorials on both.
aio_load="YES"

# thermal sensors for intel or amd cpus
coretemp_load="YES"
#amdtemp_load="YES"

# Increase VDEV read ahead cache size. This reduces scrub times and
# metadata-intensive tasks for a small cost in RAM. The vdev cache uses a
# simple FIFO rolling data set.
vfs.zfs.vdev.cache.size="64M"
vfs.zfs.vdev.cache.max="65536"

tuning, sysctl, kernel

-  ⇤ ← Wersja 1 z 2014-11-26 00:33:12 → 
  Rozmiar: 645
  Edytor: wtps0n
  Komentarz: *** KREACJA ***
+   ← Wersja 4 z 2018-03-16 16:59:49 → ⇥
  Rozmiar: 5148
  Edytor: wtps0n
  Komentarz: + highlight
-Usunięcia zostały oznaczone w ten sposób.
+Dodatki zostały oznaczone w ten sposób.
 Linia 3:
+<<Action(print,Wydrukuj ten dokument)>><<BR>>
<<TableOfContents()>><<BR>>
-Linia 8:
+Linia 11:
-{{{#!shell numbers=off
+{{{#!highlight bash numbers=off
-Linia 26:
+Linia 29:
+}}}
-Linia 27:
+Linia 31:
+== Serwer proxy wraz z unbound (resolver) ==
Na podstawie artykułów ze strony [[https://calomel.org||target="_blank"]]:

=== sysctl.conf ===
{{{#!highlight ini numbers=off
# --- unbound resources -----------------------------------------------------
#
net.inet.tcp.recvbuf_inc=65535
net.inet.tcp.sendbuf_inc=16384

# --- IPFilter FRAGmented packets -------------------------------------------
#
net.inet.ipf.fr_statesize=65536
net.inet.ipf.fr_statemax=65536

# --- network security ------------------------------------------------------
#
net.inet.icmp.bmcastecho=0
net.inet.icmp.drop_redirect=1
net.inet.icmp.log_redirect=1
net.inet.tcp.drop_synfin=1

# Na podsawie https://calomel.org/freebsd_network_tuning.html
#
kern.ipc.maxsockbuf=4194304
#net.inet.tcp.cc.algorithm=htcp
net.inet.tcp.cc.htcp.adaptive_backoff=1
net.inet.tcp.cc.htcp.rtt_scaling=1
kern.ipc.soacceptqueue=1024
net.inet.tcp.sack.enable=1

# --- przyspieszenie ruchu dla loopback -------------------------------------
#
net.inet.tcp.nolocaltimewait=1
net.local.stream.sendspace=164240  # (default 8192)
net.local.stream.recvspace=164240  # (default 8192)

# --- ustawienia dotycz/ace spe/lnienia RFC ---------------------------------
#
net.inet.tcp.rfc1323=1  # (default 1)
net.inet.tcp.rfc3390=1  # (default 1)

# --- sterowanie wielko/sci/a okna pakietu TCP ------------------------------
#
net.inet.tcp.minmss=1300
net.inet.tcp.mssdflt=1460
kern.ipc.soacceptqueue=1024

# --- bezpiecze/nstwo dla IPv6 ----------------------------------------------
#
net.inet6.icmp6.nodeinfo=0
net.inet6.ip6.use_tempaddr=1
net.inet6.ip6.prefer_tempaddr=1
net.inet6.icmp6.rediraccept=0
-Linia 28:
+Linia 86:
+=== /boot/loader.conf ===
{{{#!highlight bash numbers=off
#
# loader.conf
#
# Lokalna konfiguracja bootowania systemu operacyjnego
#

geom_mirror_load="YES"
opensolaris_load="YES"
zfs_load="YES"

kern.geom.label.disk_ident.enable="0"
kern.geom.label.gpt.enable="1"
kern.geom.label.gptid.enable="0"

# --- karta sieciowa ----------------------------------
#
miibus_load="YES"
if_bge_load="YES"

# --- wielokonsolowo/s/c ------------------------------
#
# Zgodnie z informacjami znalezionymi w sieci HP ML 110 G6 posiada emulacj/e PS/2
# opart/a na USB. Jednocze/snie nie mo/zna ustawi/c "USB Legacy", a zatem w trakcie
# bootowania nie ma klawiatury
# Poprzez przekierowanie konsoli na ttyu0 mo/zna sterowa/c procesem bootowania poprzez
# dedykowany port "MGMT" w serwerze
# Linki w sieci:
# https://www.freebsd.org/doc/handbook/serialconsole-setup.html
# http://h30499.www3.hp.com/t5/ProLiant-Servers-ML-DL-SL/ML110-G6-ILO-Password/td-p/2326467
# http://h20000.www2.hp.com/bc/docs/support/SupportManual/c02063205/c02063205.pdf
#
boot_multicons="YES"
boot_serial="YES"
comconsole_speed="9600"
console="comconsole,vidconsole"

# --- Konfiguracja rozmiaru pami/eci dla kernela oraz ZFS -------------------
#
vm.kmem_size="6G"
vfs.zfs.arc_max="3G"

# accf accept filters are used so the server will not have to context switch several times
# before performing the initial parsing of the request. This could decrease server load by
# reducing the amount of CPU time to handle incoming requests.

# Wait for data accept filter. For nginx https servers add "listen
# 127.0.0.1:443 ssl spdy accept_filter=dataready;"
##accf_data_load="YES"

# buffer incoming connections until complete HTTP requests arrive (nginx
# apache) for nginx http add, "listen 127.0.0.1:80 accept_filter=httpready;"
##accf_http_load="YES"

# Wait for full DNS request accept filter (unbound)
accf_dns_load="YES"

# Je/zeli nie jest wkompilowane w kernel:
# Advanced Host Controller Interface (AHCI)
#ahci_load="YES"

# Asynchronous I/O, or non-blocking I/O is a form of input/output processing
# permiting other processing to continue before the transmission has finished.
# AIO is used for accelerating Nginx on ZFS. Check for our tutorials on both.
aio_load="YES"

# thermal sensors for intel or amd cpus
coretemp_load="YES"
#amdtemp_load="YES"

# Increase VDEV read ahead cache size. This reduces scrub times and
# metadata-intensive tasks for a small cost in RAM. The vdev cache uses a
# simple FIFO rolling data set.
vfs.zfs.vdev.cache.size="64M"
vfs.zfs.vdev.cache.max="65536"
}}}

----
tuning, sysctl, kernel
----
{i} ` `<<GetVal(SlownikNewBsd,adm-podpis)>>

Różnice "SysTuning"

System tuning

/etc/sysctl

Serwer proxy wraz z unbound (resolver)

sysctl.conf

/boot/loader.conf