Tuning Linux systems

Changing TCP parameters

• Description: Linux offers a number of tunable TCP parameters whose default values might be sufficient for WebSphere Application Server. It might be necessary to tune these parameters in some exceptional cases. For example, you might reduce the number of sockets in specific states such as TIME_WAIT, modify the TCP keepalive operation, or modify other functions.
• How to view or set:

  Consult the detailed information available under "man tcp" under your Linux distribution.

Linux file descriptors (ulimit)

• Description: Specifies the number of open files that are supported. The default setting is typically sufficient for most applications. If the value set for this parameter is too low, a file open error, memory allocation failure, or connection establishment error might be displayed.
• How to view or set: Check the UNIX reference pages on the ulimit command for the syntax of different shells. To set the ulimit command to 8000 for the KornShell shell (ksh), issue the ulimit -n 8000 command. Use the ulimit -a command to display the current values for all limitations on system resources.
• Default value: For SUSE Linux Enterprise Server 9 (SLES 9), the default is 1024.
• Recommended value: 8000

Considerations for setting resource limits in Linux

By default, many resource limits in typical Linux distributions are set to unlimited, including some memory-related limits such as ulimit -v, ulimit -m, and ulimit -d. If these limits are set too low, it can cause an application server to fail. Therefore, the best practice is to keep or not change the limit from unlimited.

Avoid trouble: To set a specific limit, you must ensure it accommodates the expected virtual memory size of each process. The VSZ column of the ps output displays the virtual memory size of a Java process. This column reflects the memory that is used directly by the JVM. It also reflects the memory that is required for the Java heap and the stack space that is allocated for each thread in the process.

Connection backlog

• Description: Change the following parameters when a high rate of incoming connection requests result in connection failures:

  echo 3000 > /proc/sys/net/core/netdev_max_backlog
  echo 3000 > /proc/sys/net/core/somaxconn

TCP keepalive

Firewalls typically have a connection expiration timeout. If there is no activity on a connection within the timeout interval, the connection is removed from the firewall routing tables. If connections between servers, such as a connection pool between a server and a backend database, are timed out by a firewall between the systems, attempts to reuse the connection fail until the connection is reestablished, causing errors and performance issues.

To avoid this type of problem, you can configure the TCP keepalive function to operate on an interval that is shorter than the firewall timeout. The TCP keepalive activity informs the firewall that the connection is still in use, so the connection does not expire and be flushed from the firewall tables.

To perform this tuning, first determine the firewall connection expiration timeout. The network administrator typically knows this information. Next, set the following three TCP tuning options to run TCP keepalive at an interval comfortably shorter than connection expiration timeout. Thus, for a firewall connection expiration timeout of 75 seconds, set the TCP tuning options to run TCP keepalive at an interval less than 75 seconds. Add the options to the /etc/sysctl.conf file to survive restarts.

TCP_KEEPALIVE_TIME

• Description: Determines the time until a socket is first considered idle and keepalive probes are sent.
• How to view or set: Issue the following command to set the value:

  echo 45 > /proc/sys/net/ipv4/tcp_keepalive_time

• Default value: 7200 seconds
• Recommended value: Less than any firewall idle timeouts (for example, 45 seconds)

TCP_KEEPALIVE_INTERVAL

• Description: Determines the wait time between isAlive interval probes.
• How to view or set: Issue the following command to set the value:

  echo 15 > /proc/sys/net/ipv4/tcp_keepalive_intvl

• Default value: 75 seconds
• Recommended value: 15 seconds

TCP_KEEPALIVE_PROBES

• Description: Determines the number of probes before timing out.
• How to view or set: Issue the following command to set the value:

  echo 5  > /proc/sys/net/ipv4/tcp_keepalive_probes

• Default value: 9
• Recommended value: 5