systemd-sysctl.service, systemd-sysctl — Configure kernel parameters at boot
/usr/lib/systemd/systemd-sysctl [OPTIONS...] [CONFIGFILE...]
systemd-sysctl.service
systemd-sysctl.service is an early boot
service that configures
sysctl(8)
kernel parameters by invoking /usr/lib/systemd/systemd-sysctl.
When invoked with no arguments, /usr/lib/systemd/systemd-sysctl applies
all directives from configuration files listed in
sysctl.d(5).
When invoked with positional arguments, the configuration specified by the command line arguments is
executed. If the string "-" is specified instead of a filename, the configuration is
read from standard input. If the argument is a file name (without any slashes), all configuration
directories are searched for a matching file and the file found that has the highest priority is
executed. If the argument is a path, that file is used directly without searching the configuration
directories for any other matching file.
In addition, --prefix= option may be used to limit which sysctl
settings are applied.
See
sysctl.d(5)
for information about the configuration of sysctl settings. After sysctl configuration is
changed on disk, it must be written to the files in /proc/sys/ before it
takes effect. It is possible to update specific settings, or simply to reload all configuration,
see Examples below.
--prefix=¶Only apply rules with the specified prefix.
--strict¶Always return non-zero exit code on failure (including invalid sysctl variable name and insufficient permissions), unless the sysctl variable name is prefixed with a "-" character.
--verify¶After systemd-sysctl successfully writes a value to a sysctl variable, the
variable is read back and verified to match the value that was written. If the variable cannot be
read back, or if the returned value differs from the written value, the write operation is
considered to have failed. To detect such failures reliably, it is recommended to also specify
--strict, and to ensure that the settings being applied are not prefixed with
"-" (see
sysctl.d(5)
for details). This mode is disabled by default, since the format accepted by the kernel may differ
from the format returned when the variable is read back, or the kernel may normalize the input. As
a result, verification may not work reliably in all cases. Therefore, this option is best used
together with explicitly specified configuration files or settings provided through
--inline, or with --prefix= to restrict the set of sysctl
variables being written.
--inline¶Treat each positional argument as a separate configuration line instead of a file name. When specified, at least one positional argument must be specified.
--save=FILENAME¶Before applying the loaded sysctl settings, write them to /run/sysctl.d/
using the specified filename. If the filename does not end with .conf, the
suffix is appended. This option requires one or more positional arguments. May be combined with
--inline. This may be useful for creating runtime sysctl configuration files or
overriding existing sysctl configuration files.
--revert=FILENAME¶Before loading and applying the sysctl settings, removes the specified sysctl configuration
file under /run/sysctl.d/. If the filename does not end with
.conf, the suffix is appended. This may be useful for removing configuration
files created by --save=.
--cat-config¶Copy the contents of config files to standard output. Before each file, the filename is printed as a comment.
--tldr¶Copy the contents of config files to standard output. Only the "interesting" parts of the configuration files are printed, comments and empty lines are skipped. Before each file, the filename is printed as a comment.
--no-pager¶Do not pipe output into a pager.
-h, --help¶--version¶Print a short version string and exit.
systemd-sysctl supports the service credentials logic as implemented by
ImportCredential=/LoadCredential=/SetCredential=
(see systemd.exec(5) for
details). The following credentials are used when passed in:
sysctl.extra¶The contents of this credential may contain additional lines to operate on. The
credential contents should follow the same format as any other sysctl.d/ drop-in
configuration file. If this credential is passed it is processed after all of the drop-in files read
from the file system. The settings configured in the credential hence take precedence over those in
the file system.
Note that by default the systemd-sysctl.service unit file is set up to inherit
the "sysctl.extra" credential from the service manager.
Example 2. View coredump handler configuration
# sysctl kernel.core_pattern kernel.core_pattern = |/usr/libexec/abrt-hook-ccpp %s %c %p %u %g %t %P %I
Example 3. Update and verify coredump handler configuration
# /usr/lib/systemd/systemd-sysctl --prefix kernel.core_pattern --strict --verify
This searches all the directories listed in
sysctl.d(5) for
configuration files and writes /proc/sys/kernel/core_pattern. The sysctl variable
is read back and verified. If writing or verification fails, the command exits with a non-zero status,
unless the corresponding setting is prefixed with "-".
Example 4. Update coredump handler configuration according to a specific file
# /usr/lib/systemd/systemd-sysctl 50-coredump.conf
This applies all the settings found in 50-coredump.conf.
Either /etc/sysctl.d/50-coredump.conf, or
/run/sysctl.d/50-coredump.conf, or
/usr/lib/sysctl.d/50-coredump.conf will be used, in the order
of preference.
Example 5. Disable IPv6 on an interface and save the specified setting
# /usr/lib/systemd/systemd-sysctl --save=99-disable-ipv6-foo - <<EOF net.ipv6.conf.foo.disable_ipv6=1 EOF
This disables IPv6 on the network interface foo, and creates
/run/sysctl.d/99-disable-ipv6-foo.conf.
Example 6. Remove a runtime sysctl configuration file
# /usr/lib/systemd/systemd-sysctl --revert=99-disable-ipv6-foo --prefix=/net/ipv6/conf/foo
This removes /run/sysctl.d/99-disable-ipv6-foo.conf, and applies the
remaining sysctl settings for the network interface foo.
See sysctl(8) for various ways to directly apply sysctl settings.