sysctl cookbook


Description

Set sysctl system control parameters via Chef

Platforms

• Debian/Ubuntu (chefdk tested)
• RHEL/CentOS (chefdk tested)
• Scientific Linux
• PLD Linux
• Exherbo
• Archlinux

Usage

There are two main ways to interact with the cookbook. This is via chef attributes or via the provided LWRP.

Cookbook Attributes

• node['sysctl']['params'] - A namespace for setting sysctl parameters.
• node['sysctl']['conf_dir'] - Specifies the sysctl.d directory to be used. Defaults to /etc/sysctl.d on the Debian and RHEL platform families, otherwise nil
• node['sysctl']['allow_sysctl_conf'] - Defaults to false. Using conf_dir is highly recommended. On some platforms that is not supported. For those platforms, set this to true and the cookbook will rewrite the /etc/sysctl.conf file directly with the params provided. Be sure to save any local edits of /etc/sysctl.conf before enabling this to avoid losing them.

Note: if node['sysctl']['conf_dir'] is set to nil and node['sysctl']['allow_sysctl_conf'] is not set, no config will be written

Setting Sysctl Parameters

Using Attributes

Setting variables in the node['sysctl']['params'] hash will allow you to easily set common kernel parameters across a lot of nodes. All you need to do to have them loaded is to include sysctl::apply anywhere in your run list of the node. It is recommended to do this early in the run list, so any recipe that gets applied afterwards that may depend on the set parameters will find them to be set.

The attributes method is easiest to implement if you manage the kernel parameters at the system level opposed to a per cookbook level approach. The configuration will be written out when sysctl::apply gets run, which allows the parameters set to be persisted during a reboot.

Examples

Set vm.swapiness to 20 via attributes

    node.default['sysctl']['params']['vm']['swappiness'] = 20

    include_recipe 'sysctl::apply'

Using LWRPs

The sysctl_param LWRP can be called from wrapper and application cookbooks to immediately set the kernel parameter and cue the kernel parameter to be written out to the configuration file.

This also requires that your run_list include the sysctl::default recipe in order to persist the settings.

sysctl_param

Actions

• apply (default)
• remove
• nothing

Attributes

• key
• value

Examples

Set vm.swapiness to 20 via sysctl_param LWRP

    include_recipe 'sysctl::default'

    sysctl_param 'vm.swappiness' do
      value 20
    end

Remove sysctl parameter and set net.ipv4.tcp_fin_timeout back to default

    sysctl_param 'net.ipv4.tcp_fin_timeout' do
      value 30
      action :remove
    end

Reading Sysctl Parameters

Ohai Plugin

The cookbook also includes an Ohai 7 plugin that can be installed by adding sysctl::ohai_plugin to your run_list. This will populate node['sys'] with automatic attributes that mirror the layout of /proc/sys.

To see ohai plugin output manually, you can run ohai -d /etc/chef/ohai_plugins sys on the command line.

Development

We have written unit tests using chefspec and integration tests in serverspec executed via test-kitchen. Much of the tooling around this cookbook is exposed via guard and test kitchen, so it is highly recommended to learn more about those tools. The easiest way to get started is to install the Chef Development Kit

Running tests

The following commands will run the tests:

chef exec bundle install
chef exec rubocop
chef exec foodcritic .
chef exec rspec
chef exec kitchen test default-ubuntu-1404
chef exec kitchen test default-centos-70

The above will do ruby style (rubocop) and cookbook style (foodcritic) checks followed by rspec unit tests ensuring proper cookbook operation. Integration tests will be run next on two separate linux platforms (Ubuntu 14.04 LTS Precise 64-bit and CentOS 7.0). Please run the tests on any pull requests that you are about to submit and write tests for defects or new features to ensure backwards compatibility and a stable cookbook that we can all rely upon.

Running tests continuously with guard

This cookbook is also setup to run the checks while you work via the guard gem.

bundle install
bundle exec guard start

ChefSpec LWRP Matchers

The cookbook exposes a chefspec matcher to be used by wrapper cookbooks to test the cookbooks LWRP. See library/matchers.rb for basic usage.

Links

There are a lot of different documents that talk about system control parameters, the hope here is to point to some of the most useful ones to provide more guidance as to what the possible kernel parameters are and what they mean.

• Linux Kernel Sysctl
• Linux Kernel IP Sysctl
• THE /proc FILESYSTEM (Jun 2009)
• RHEL 5 VM/Page Cache Tuning Presentation (2009) pdf
  • Note that RHEL 6.2 or later support /etc/sysctl.d, and using 'service sysctl reload' to load attributes.
• Arch Linux SysCtl Tutorial (Feb 2013)
• Old RedHat System Tuning Overview (2001!)
• Tuning TCP For The Web at Velocity 2013 (video), slides
• Adventures in Linux TCP Tuning (Nov 2013)
• Part 1: Lessons learned tuning TCP and Nginx in EC2 (Jan 2014)
• How to harden a new server with Chef about the TelekomLabs Hardening Framework (May 2014)