System Service Name | Service Description | Default Installation | Recommendation | Enabling Condition |
crond.service | Scheduling of background tasks as scheduled. | Yes | Enabled | - |
getty@.service | Terminal service. | Yes | Enabled | - |
irqbalance.service | Service for distributing hardware interrupts in multi-processor systems. | Yes | Enabled | - |
kdump.service | Kernel failure dump service. | Yes | Enabled | Enable it to collect information for kernel failure diagnosis. |
kpatch.service | Service for loading the kernel patch module during startup. | Yes | Enabled | Used when hot patches are available. |
mcelog.service | Hardware alarm log service. | Yes | Disabled | Enable it for physical servers and disable it for virtual machines. |
rsyslog.service | System log service. | No | Enabled | - |
sshd.service | SSH service. | Yes | Enabled | - |
sysstat.service | System status statistics service. | No | Enabled | - |
dm-event.socket | Device-mapper device event. | Yes | Disabled | Enable it when the system uses device-mapper devices. |
autovt@.service | Virtual terminal. | Yes | Enabled | - |
abrt-ccpp.service | C/C++ issue collection. | No | Disabled | Enable it for submission by the ABRT. |
abrtd.service | Automatic bug reporting service. | No | Disabled | Enable it for submission by the ABRT. |
abrt-oops.service | Tool for collecting the kernel oops exception information. | No | Disabled | Enable it for submission by the ABRT. |
abrt-pstoreoops.service | Oops information storage service. | No | Disabled | Enable it for submission by the ABRT. |
abrt-vmcore.service | vmcore file copy and processing service. | No | Disabled | Enable it for submission by the ABRT. |
abrt-xorg.service | Xorg exception information collection. | No | Disabled | Enable it for submission by the ABRT. |
arp-ethers.service | Network exception information collection. | Yes | Disabled | Enable it for submission by the ABRT. |
atd.service | At service. | Yes | Disabled | Enable it when a scheduled execution is needed. |
auditd.service | System audit service. | Yes | Enabled | Enable it when the audit feature is needed. |
chronyd.service | Time synchronization service. | Yes | Disabled | It replaces the NTP service. Enable it as needed. |
dm-event.service | Device-mapper event service. | Yes | Disabled | Enable it when device-mapper devices are used. |
ebtables.service | Bridge filtering service. | Yes | Disabled | Enable it when linkage-layer filtering rules are needed. |
firewalld.service | Firewall service. | Yes | Disabled | Enable it when firewall rules are needed. |
fstrim.timer | SSD TRIM service. | Yes | Disabled | Enable it when SSD trimming is needed. |
gssproxy.service | Generic Security Services API (GSSAPI) proxy service. | No | Disabled | It replaces rpc.svcgssd. Enable it when GSSAPI authentication is needed. |
iprdump.service | IBM Power RAID adapter dump service. | Yes | Disabled | Disable it for all virtual machines. |
iprinit.service | IBM Power RAID adapter initialization service. | Yes | Disabled | Disable it for all virtual machines. |
iprupdate.service | IBM Power RAID adapter update service. | Yes | Disabled | Disable it for all virtual machines. |
iprutils.target | IBM Power RAID adapter management service. | Yes | Disabled | Disable it for all virtual machines. |
ipsec.service | IPSec service. | No | Disabled | Enable it when the IPSec security protocol is needed. |
kexec.target | Kernel reboot and loading through kexec. | Yes | Disabled | Enable it for reboot and load kernels through kexec. |
libstoragemgmt.service | lsmd service. | Yes | Disabled | Enable it for managing supported SAN and RAID cards. It is disabled for all virtual machines. |
lvm2-lvmpolld.service | LVM2 polling daemon process. | Yes | Disabled | Enable it when the use_lvmpolld feature is needed. |
lvm2-monitor.service | lvm2 mirror monitoring process. | Yes | Disabled | Enable it when the LVM2 monitoring process is needed. |
mdmonitor.service | MD software RAID monitoring process. | Yes | Disabled | Enable it when MD software RAID is used. |
microcode.service | Hardware microcode update service. | Yes | Disabled | Enable it when microcode needs to be updated. |
nfs-blkmap.service | Parallel NFS (pNFS) service process. | No | Disabled | Enable it when pNFS is used. |
nfs-server.service | NFS server service. | No | Disabled | Enable it when the NFS server provides services. |
nfs-client.target | NFS client service. | No | Disabled | Enable it when the NFS client provides services. |
plymouth* | GPU-based rendering service. | No | Disabled | Enable it when direct rendering with GPUs is needed. |
pmcd.service | Performance metric collection service. | No | Disabled | Enable it for obtaining performance parameters using Performance Co-Pilot (PCP). |
pmie.service | Performance metric API service. | No | Disabled | Enable it for obtaining performance parameters using Performance Co-Pilot (PCP). |
pmlogger.service | Performance metrics log service. | No | Disabled | Enable it for obtaining performance parameters using Performance Co-Pilot (PCP). |
pmproxy.service | Performance metric proxy service. | No | Disabled | Enable it for obtaining performance parameters using Performance Co-Pilot (PCP). |
powertop.service | Power management service. | No | Disabled | Enable it for power consumption diagnosis and power management. |
psacct.service | Kernel process counting service. | Yes | Disabled | Enable it for performing statistics on the number and activity of processes. |
rasdaemon.service | Reliability, Availability, and Serviceability (RAS) log service. | No | Disabled | Enable it when the RAS management service is needed. |
ras-mc-ctl.service | RAS memory control service. | No | Disabled | Enable it when the RAS management service is needed. |
rdisc.service | ICMP route discovery service. | Yes | Disabled | Enable it when the ICMP routing service is needed. |
named.service | DNS server service. | No | Disabled | Enable it when the DNS service is needed. |
rngd.service | Service for collecting random numbers generated by the hardware random number generator (RNG). | No | Disabled | Enable it when random numbers generated by the RNG need to be collected. |
rpc-rquotad.service | RPC disk quota service. | No | Disabled | Enable it when the remote disk quota service is needed. |
rsyncd.service | Remote synchronization service. | No | Disabled | Enable it when the remote synchronization service is needed. |
smartd.service | Smart card service. | Yes | Disabled | Enable it when smart cards are needed. |
snmpd | SNMP service. | No | Disabled | Enable it when the SNMP service is needed. |
tcsd.service | User space process service for Trusted Platform Module (TPM) devices. | Yes | Disabled | Enable it when TPM devices are needed. |
tuned.service | Service for monitoring system component usage and dynamically adjusting system settings. | Yes | Disabled | Enable it when system performance monitoring is needed. |
xinetd.service | Super service. | No | Disabled | Enable it when xinetd is needed to manage services. |
postfix | Mail service. | No | Disabled | - |
NetworkManager.service | Network management. | Yes | Enabled | - |
systemd-hibernate.service | System hibernation. | Yes | Disabled | - |
rdma-hw.target | RDMA | Yes | Disabled | Enable it if RDMA hardware exists. |
Systemd-journald | Log service | Yes | Enabled | It is recommended to keep the default storage configurations (auto by default). Additionally, it is recommended to create a log directory during deployment to reduce memory consumption by logs. (If no log directory is created, logs will be stored in memory by default.) mkdir -p /var/log/journal/ |
Category | Parameter Name | Description |
System parameter | Running Level | Controls the run mode that the system enters after startup. multi-user(3) is the multi-user text mode, and graphical(5) is the graphical interface mode. In server environments, it is recommended to use the text mode to reduce resource consumption. If a graphical interface is required, install the corresponding components separately and switch the run level. |
| data seg size | Limits the maximum size of the process data segment, that is, the maximum memory that a process can allocate through the brk/sbrk system calls. Setting this parameter to Unlimited means that the size of the process data segment is not limited. |
| File size | Limits the maximum size of a single file that a process can create. Setting this parameter to Unlimited means that the file size is not limited, allowing processes to create files of any size. |
| Open file | Limits the maximum number of file descriptors that a single process can open simultaneously. This parameter affects the number of resources such as files, sockets, and pipes that a process can open at the same time. In high-concurrency server scenarios, it is usually necessary to increase this value. |
| Message queues | Limits the maximum memory in bytes that a user can allocate to POSIX message queues. Message queues are used for inter-process communication, and this value determines the total memory upper limit that a single user can allocate to all message queues. |
| Stack size | Limits the maximum size of the process stack space (in KB). The stack space is used to store function call information, local variables, and so on. If it is too small, stack overflow may occur. If it is too large, virtual address space is wasted. |
| Max user processes | Limits the maximum number of processes/threads that a single user can create simultaneously. This value affects the total number of processes that the system can run at the same time. In high-concurrency scenarios, increase this value appropriately. |
| /etc/selinux/config | Global configuration file for SELinux (Security-Enhanced Linux), used to set the operating mode of SELinux. enforcing is the enforcing mode, permissive is the permissive mode (logs but does not block), and disabled means completely disabled. After modification, restart the system for the change to take effect. To make the change take effect immediately on a temporary basis, run the setenforce command. |
Memory Capacity | vm.swappiness | Controls how aggressively the kernel swaps memory pages to the swap partition. The value ranges from 0 to 100. A lower value makes the kernel more inclined to keep pages in physical memory and reduce swap usage. A higher value makes the kernel more aggressively swap out inactive pages to swap. In server environments, it is recommended to set a lower value to prioritize the use of physical memory. |
| vm.dirty_background_ratio | When the percentage of dirty pages (cache pages that have been modified but not written to disk) in the file system reaches this threshold of the total system memory, the kernel starts the background writeback (pdflush/flush) process to write dirty pages to disk asynchronously. This parameter controls when background asynchronous writeback is triggered. |
| vm.dirty_ratio | When the percentage of dirty pages in the file system reaches this threshold of the total system memory, the process generating the dirty pages is blocked, and the kernel forcibly writes the dirty pages to disk synchronously. This parameter prevents excessive dirty pages from accumulating in memory and avoids sudden large amounts of disk I/O. |
Scheduling | kernel.sched_min_granularity_ns | Minimum scheduling granularity of the CFS scheduler (in nanoseconds). When the number of processes on a CPU run queue exceeds the sched_nr_latency threshold, the scheduling period equals this value multiplied by the number of processes. This parameter ensures the minimum CPU time slice that each process obtains, preventing frequent context switching. |
| kernel.sched_latency_ns | Target scheduling period of the CFS scheduler (in nanoseconds). When the number of processes on a CPU run queue is less than sched_nr_latency, this value is used as the scheduling period. All runnable processes run at least once within this period. |
Network | net.ipv4.tcp_keepalive_time | Waiting time (in seconds) before the kernel starts sending keepalive probe packets after a TCP connection becomes idle. When no data is transmitted over the TCP connection within this period, the kernel starts sending probe packets to detect whether the peer is still alive. |
| net.ipv4.tcp_retries2 | Maximum number of TCP packet retransmissions. When an established TCP connection sends data but does not receive an acknowledgment, the kernel retransmits the data. After this number is exceeded, the kernel stops retransmitting and closes the connection. This value affects the connection's tolerance to network instability. |
| net.ipv4.tcp_syn_retries | Maximum number of retries for SYN packets when TCP actively establishes a connection. If the client does not receive a SYN+ACK response after sending a SYN request, it retries sending SYN packets. After this number is exceeded, the client gives up the connection. |
| net.ipv4.tcp_keepalive_probes | Maximum number of TCP keepalive probes. After keepalive probing starts, if no response is received from the peer after this number of probe packets is sent consecutively, the kernel considers the connection invalid and sends an RST to close the connection. |
| net.ipv4.tcp_keepalive_intvl | Interval (in seconds) between TCP keepalive probe packets. After the first keepalive probe is sent, if no response is received, subsequent probes are sent repeatedly at this interval until the maximum number of probes is reached. |
| net.ipv4.ip_local_port_range | Defines the available range of local TCP/UDP ports. When an application does not specify a source port for a connection, the kernel selects an available port from this range. Increasing the range supports more concurrent connections. |
| net.ipv4.ip_forward | Controls whether to enable IPv4 packet forwarding. When set to 1, the system can act as a router to forward packets between network interfaces. When set to 0, forwarding is disabled. Regular servers typically do not need to enable this feature. |
| net.ipv4.conf.all.send_redirects | Controls whether the system sends ICMP redirect messages to all network interfaces. ICMP redirects are used to inform the sender of a better routing path. For security reasons, disabling this feature is recommended on non-router devices. |
| net.ipv4.conf.default.send_redirects | Controls whether the system sends ICMP redirect messages to newly created network interfaces by default. Similar to conf.all.send_redirects, but applies only to the default configuration of newly created network interfaces. |
| net.ipv4.conf.all.accept_source_route | Controls whether to accept IP source route options on all interfaces. Source routing allows the sender to specify the routing path that packets traverse, which can be exploited by attackers for IP address spoofing. Disabling this feature is recommended. |
| net.ipv4.conf.default.accept_source_route | Controls whether newly created network interfaces accept IP source route options by default. Similar to conf.all.accept_source_route, but applies only to the default behavior of newly created interfaces. |
| net.ipv4.conf.all.accept_redirects | Controls whether to accept ICMP redirect messages on all interfaces. Accepting redirects can be exploited by attackers to tamper with the routing table. Disabling this feature is recommended on non-router devices. |
| net.ipv4.conf.all.secure_redirects | Controls whether to accept ICMP redirect messages only from gateways in the gateway list. Even if accept_redirects is enabled, this parameter can restrict the acceptance of redirects to trusted gateways only. |
| net.ipv4.conf.default.secure_redirects | Controls whether newly created network interfaces accept only secure ICMP redirect messages from gateways in the gateway list by default. |
| net.ipv4.conf.all.log_martians | Controls whether to log packets with invalid source addresses (martian packets) on all interfaces. When this feature is enabled, the kernel logs packets with unreasonable source addresses (such as private addresses appearing on public network interfaces) to the system log, which facilitates security auditing. |
| net.ipv4.conf.default.log_martians | Controls whether newly created network interfaces log packets with invalid source addresses by default. |
| net.ipv4.icmp_echo_ignore_broadcasts | Controls whether to ignore ICMP Echo requests sent to broadcast addresses (ping broadcasts). Enabling this feature prevents smurf attacks, in which attackers send ping requests to broadcast addresses with forged source addresses to amplify attack traffic. |
| net.ipv4.icmp_ignore_bogus_error_responses | Controls whether to suppress kernel alarm logs for abnormal ICMP error responses that do not comply with RFC 1122. When this parameter is enabled, its main purpose is to reduce log noise from such bogus error responses, rather than serving as a general-purpose ICMP packet filtering switch. |
| net.ipv4.conf.all.rp_filter | Controls the reverse path Filtering mode on all interfaces. 0 disables source address validation. 1 indicates strict mode, where a packet passes only when the best reverse path for its source address is the receiving interface. 2 indicates loose mode, where a packet passes as long as the system has a reachable route to the source address. Loose mode is typically more suitable for multihomed or asymmetric routing scenarios. |
| net.ipv4.conf.default.rp_filter | Controls the reverse path filtering mode adopted by newly created network interfaces by default. Its value semantics are consistent with conf.all.rp_filter: 0 disables it, 1 indicates strict mode, and 2 indicates loose mode. It affects only the default behavior of newly created interfaces. |
| net.ipv4.tcp_syncookies | Controls whether to enable the TCP SYN Cookie mechanism. When the SYN queue overflows, the kernel uses the SYN Cookie technique to process connection requests without allocating resources, effectively defending against SYN Flood attacks. |
| net.ipv6.conf.all.accept_ra | Controls whether all interfaces accept IPv6 Router Advertisements. Router Advertisements are used for IPv6 Stateless Address Autoconfiguration (SLAAC). Disabling this feature is recommended in scenarios where IPv6 autoconfiguration is not required. |
| net.ipv6.conf.default.accept_ra | Controls whether newly created network interfaces accept IPv6 Router Advertisements by default. The functionality is the same as conf.all.accept_ra, but it affects only the default behavior of newly created interfaces. |
| net.ipv6.conf.all.accept_redirects | Controls whether all interfaces accept IPv6 ICMP redirect messages. For security reasons, disabling this feature is recommended on non-routing devices to prevent the routing table from being maliciously tampered with. |
| net.ipv6.conf.default.accept_redirects | Controls whether newly created network interfaces accept IPv6 ICMP redirect messages by default. |
| net.core.rmem_default | Sets the default size of the socket receive buffer in bytes. When an application does not explicitly set the receive buffer size, this default value is used. For network-intensive workloads, you can increase this value appropriately to improve throughput. |
| net.core.rmem_max | Sets the maximum allowed size of the socket receive buffer in bytes. When an application sets SO_RCVBUF through setsockopt, the value cannot exceed this upper limit. For high-throughput scenarios, you need to increase this value. |
| net.core.wmem_default | Sets the default size of the socket send buffer in bytes. When an application does not explicitly set the send buffer size, this default value is used. |
| net.core.wmem_max | Sets the maximum allowed size of the socket send buffer in bytes. When an application sets SO_SNDBUF through setsockopt, the value cannot exceed this upper limit. |
| net.ipv4.tcp_rmem | Sets the size of the TCP socket receive buffer, which contains three values: minimum value, default value, and maximum value in bytes. The kernel dynamically adjusts the receive buffer size of each TCP connection within this range based on available memory. |
| net.ipv4.tcp_wmem | Sets the size of the TCP socket send buffer, which contains three values: minimum value, default value, and maximum value in bytes. The kernel dynamically adjusts the send buffer size of each TCP connection within this range based on available memory. |
| net.core.somaxconn | Sets the maximum length of the backlog queue for the socket listen() function, which is the upper limit of the connection queue for connections that have completed the three-way handshake and are waiting for accept() processing. High-concurrency servers need to increase this value to prevent connections from being rejected. |
| net.ipv4.ipfrag_time | Sets the maximum time that IPv4 fragments are retained in memory in seconds. IP fragments that have not been reassembled after this time elapses are discarded. This parameter affects the timeout behavior of IPv4 fragment reassembly. |
| net.ipv4.tcp_tw_reuse | Controls whether sockets in the TIME_WAIT state can be reused for new TCP connections. When this feature is enabled, port resources can be quickly reclaimed in high-concurrency short-connection scenarios, reducing resource usage of connections in the TIME_WAIT state. |
| net.ipv4.tcp_fin_timeout | Sets the timeout period for TCP connections in the FIN_WAIT_2 state in seconds. During connection closure, if the peer does not send a FIN packet, the kernel forcibly closes the connection and reclaims resources after this timeout period elapses. |
| net.ipv4.tcp_orphan_retries | Sets the number of retries for orphan TCP connections before they are closed. An orphan connection is a TCP connection that is no longer associated with any process but is still in the closing process. Reducing this value can accelerate the reclamation of orphan connections. |
| net.ipv4.tcp_synack_retries | Sets the maximum number of retries for SYN+ACK packets when TCP passively establishes a connection. After the server receives a SYN and replies with a SYN+ACK, if it does not receive an ACK confirmation from the client, it retransmits the SYN+ACK. After this number is exceeded, the server gives up the connection. |
| net.ipv4.tcp_max_orphans | Sets the maximum number of orphan TCP connections allowed in the system. When the number of orphan connections exceeds this threshold, the kernel prints a warning and starts forcibly closing orphan connections. This parameter is used to prevent orphan connections from occupying excessive kernel resources. |
| net.ipv4.tcp_slow_start_after_idle | Controls whether a TCP connection re-enters the slow start phase after being idle. When this parameter is set to 1, the congestion window is reset to the initial value after the connection is idle, and slow start is re-entered. When this parameter is set to 0, the previous congestion window size is retained. Setting this parameter to 0 in a private network environment can improve performance. |
| net.ipv6.conf.all.disable_ipv6 | Controls whether to disable the IPv6 protocol on all network interfaces. When set to 1, IPv6 is completely disabled. When set to 0, IPv6 is enabled. In environments where IPv6 is not required, disabling it is recommended to reduce the attack surface. |
| net.ipv6.conf.default.disable_ipv6 | Controls whether newly created network interfaces disable the IPv6 protocol by default. Similar to conf.all.disable_ipv6, but it affects only the default behavior of newly created interfaces. |
Testing | kernel.printk | Controls the output level of kernel logs on the console, which usually corresponds to four integers: console_loglevel, default_message_loglevel, minimum_console_loglevel, and default_console_loglevel. When only a single number is written, only the first parameter (the current console_loglevel) is modified, and the other three parameters remain unchanged. |
| kernel.hung_task_panic | Controls whether the kernel triggers a panic when a hung task (a process that remains in the uninterruptible sleep state D for a long time) is detected. When set to 1, the kernel panics to collect debugging information through kdump. When set to 0, only an alarm log is recorded. |
| kernel.panic_on_oops | Controls whether the kernel triggers a panic when an oops (a kernel runtime error) occurs. When set to 1, the kernel panics immediately after an oops, which helps capture the fault site through kdump. When set to 0, only oops information is recorded, and the system may continue running but in an unreliable state. |
| kernel.panic_on_rcu_stall | Controls whether the kernel triggers a panic when an RCU (Read-Copy-Update) CPU stall (RCU callbacks have not been executed for a long time) is detected. When set to 1, a panic is triggered for debugging. When set to 0, only an alarm message is printed. |
| kernel.softlockup_panic | Controls whether the kernel triggers a panic when a soft lockup (the CPU has not yielded scheduling for a long time) is detected. When set to 1, a panic is triggered to collect information through kdump for problem locating. When set to 0, only an alarm log is recorded. |
| vm.panic_on_oom | Controls whether the kernel triggers a panic when an OOM (Out Of Memory) event occurs. When set to 1, the kernel panics without invoking the OOM Killer. When set to 0, the kernel invokes the OOM Killer to select and kill processes to free memory. |
フィードバック