ntpdate stdtime.gov.hk ; hwclock -w &> /dev/null echo ‘01 03 * * * /usr/sbin/ntpdate stdtime.gov.hk’ |tee -a /var/spool/cron/root #同步系统时间
sed -i ‘s/^SELINUX=enforcing/SELINUX=disabled/’ /etc/selinux/config #关闭SELinux
sed -i ‘s/HISTSIZE=1000/HISTSIZE=200/’ /etc/profile #设置linux命令保存的条数
sed -i ‘s/^id:5:initdefault:/id:3:initdefault:/’ /etc/inittab #将linxu图像模式改成命令模式
sed -i ‘s/4096/65535/’ /etc/security/limits.d/20-nproc.conf #设置linxu最大打开进程数量
sed -i ‘s/^MAILTO=root/MAILTO=""/’ /etc/crontab #设置计划任务的使用者为空（所以）
sed -i ‘s/^mail.*/mail.err/’ /etc/rsyslog.conf #
echo ‘HISTFILESIZE=4000’ |tee -a /etc/bashrc &> /dev/null #保存命令的记录总数4000
echo ‘HISTSIZE=4000’ |tee -a /etc/bashrc &> /dev/null #输出history文件中的最后HISTSIZE行
echo ‘HISTTIMEFORMAT=" whoami %F %T "’ |tee -a /etc/bashrc &> /dev/null #显示命令的执行时间，执行者 echo 'ulimit -S -c 0 > /dev/null 2>&1 ’ |tee -a /etc/profile &> /dev/null #设置core文件大小为0，然后输出信息以及错误信息都不输出在显示器上
echo ‘ulimit -s unlimited’ |tee -a /etc/profile &> /dev/null #设置堆栈大小
echo ‘ulimit -SHn 65535’ |tee -a /etc/profile &> /dev/null #设置连接数最大值
echo ‘* soft nofile 65535’ |tee -a /etc/security/limits.conf &> /dev/null #最大文件打开数优化
echo ‘* hard nofile 65535’ |tee -a /etc/security/limits.conf &> /dev/null #最大文件打开数优化
echo ‘* soft nproc 65535’ |tee -a /etc/security/limits.conf &> /dev/null #最大文件打开数优化
echo ‘* hard nproc 65535’ |tee -a /etc/security/limits.conf &> /dev/null #最大文件打开数优化 以上是基本配置调优，还有内核参数的调优 vim /etc/sysctl.conf net.ipv4.ip_forward = 1
#~#开启路由功能net.ipv4.conf.default.rp_filter = 1 #~#禁用所有IP源路由net.ipv4.conf.default.accept_source_route = 0 #~#禁用icmp源路由选项kernel.sysrq = 0 #~#关闭SysRq功能，SysRq代表的是Magic System Request Key kernel.core_uses_pid = 1 #~#控制core文件的文件名是否添加pid作为扩展 net.ipv4.tcp_syncookies = 1 ##默认的每个消息队列的最大尺寸（byte），默认为16384 kernel.shmmax = 68719476736 kernel.shmall = 4294967296 fs.file-max = 6553600 #~#系统级最大打开文件数，还要结合limits.conf的soft和hard限制net.ipv4.tcp_max_tw_buckets = 262144 net.ipv4.tcp_sack = 1 #~#定义SYN重试次数net.ipv4.tcp_window_scaling = 1 #~~~~~~~#开启窗口缩放功能net.ipv4.tcp_rmem = 4096 87380 6291456
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#socket的发送缓存区分配的MIN，DEFAULT,MAX
net.core.netdev_max_backlog = 200000
net.core.somaxconn = 65535
net.core.wmem_default = 8388608
net.core.rmem_max = 16777216
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#表示套接字发送缓冲区大小的最大值,会覆盖net.ipv4.tcp_wmem的MAX值
net.ipv4.tcp_timestamps = 0
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#禁用时间戳，时间戳可以避免序列号的卷绕
net.ipv4.tcp_synack_retries = 2
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#syn-ack握手状态重试次数，默认5，遭受syn-flood攻击时改为1或2
net.ipv4.tcp_syn_retries = 2
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#外向syn握手重试次数，默认4
net.ipv4.tcp_tw_recycle = 1
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_mem = 3097431 4129911 6194862
net.ipv4.tcp_max_orphans = 3276800
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#选项用于设定系统中最多有多少个TCP套接字不被关联到任何一个用户文件
句柄上，
net.ipv4.tcp_fin_timeout = 2
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#修改系統默认的 TIMEOUT 时间
net.ipv4.tcp_keepalive_time = 30
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#表示当keepalive起用的时候，TCP发送keepalive消息的频度。缺省是2小>时，改为5分钟。
net.ipv4.ip_local_port_range = 1024 65535
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#表示用于向外连接的端口范围。缺省情况下过窄：32768到61000，改为1024到65535
#vm.overcommit_memory = 1
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#设置redis,内存模式
net.nf_conntrack_max = 25000000
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#增大iptables状态跟踪表
net.ipv4.conf.all.arp_notify = 1 vm.swappiness = 5
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#100-1=99%内存时才使用swap
net.netfilter.nf_conntrack_max = 25000000 #~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#设置默认 TCP 连接时长为180秒，Iptables
net.netfilter.nf_conntrack_tcp_timeout_established = 180 #~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#设置默认 TCP 连接时长为180秒，Iptables #modprobe nf_conntrack
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 120 net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60 net.netfilter.nf_conntrack_tcp_timeout_fin_wait = 120
