SYSTEMD-SYSCTL.SERVICE(8)

✨ SYSTEMD-SYSCTL.SERVICE(8) ✨

okay bestie, so this is the manual for systemd-sysctl.service and systemd-sysctl, living in the systemd-sysctl.service section of the systemd docs 💖 pull up a chair, we're configuring kernel parameters at boot and it's honestly iconic.

---

🌸 NAME 🌸

systemd-sysctl.service, systemd-sysctl — configure kernel parameters at boot 🫶

---

✨ SYNOPSIS ✨

/usr/lib/systemd/systemd-sysctl [OPTIONS...] [CONFIGFILE...]

systemd-sysctl.service

---

💅 DESCRIPTION 💅

So systemd-sysctl.service is an early boot service that sets up your sysctl(8) kernel parameters by calling /usr/lib/systemd/systemd-sysctl. Like, before you've even had your coffee, she's already out there doing the work 👑

When you run /usr/lib/systemd/systemd-sysctl with no arguments, it applies all the directives from the configuration files listed in sysctl.d(5). But when you hit it with positional arguments, it executes exactly the config you asked for on the command line. The deets:

• If you pass the string - instead of a filename, the configuration is read from standard input 🙈
• If your argument is a file name (no slashes anywhere), all the configuration directories get searched for a matching file, and the one with the highest priority wins and gets executed.
• If your argument is a path, that file is used directly — no searching the config directories for other matching files, periodt.

Also, the --prefix= option can be used to limit which sysctl settings get applied. So like, a little vibe check on what actually runs ✨

Peep sysctl.d(5) for info about configuring sysctl settings. And heads up: after the sysctl config is changed on disk, it must be written to the files in /proc/sys/ before it actually takes effect. You can update specific settings, or just reload all the config — check the Examples below 🌈

---

🎀 OPTIONS 🎀

• --prefix= — Only apply rules with the specified prefix.

Added in version 230.

• --strict — Always return a non-zero exit code on failure (including an invalid sysctl variable name and insufficient permissions), unless the sysctl variable name is prefixed with a - character.

Added in version 252.

• --verify — After systemd-sysctl successfully writes a value to a sysctl variable, the variable gets read back and verified to match the value that was written. If it can't be read back, or if the value that comes back differs from what was written, the write operation counts as failed 💀 To detect these failures reliably, it's recommended to also specify --strict, and to make sure the settings being applied are not prefixed with - (see sysctl.d(5) for the details). This mode is disabled by default, since the format the kernel accepts may differ from the format returned when the variable is read back, or the kernel may normalize the input. Because of that, verification may not work reliably in all cases. So this option is best used together with explicitly specified configuration files, or settings provided through --inline, or with --prefix= to restrict the set of sysctl variables being written.

Added in version 262.

• --inline — Treat each positional argument as a separate configuration line instead of a file name. When you use this, at least one positional argument must be specified.

Added in version 259.

• --save=FILENAME — Before applying the loaded sysctl settings, write them to /run/sysctl.d/ using the specified filename. If the filename doesn't end with .conf, the suffix gets appended. This option requires one or more positional arguments. May be combined with --inline. This is useful for creating runtime sysctl configuration files or overriding existing sysctl configuration files 🔥

Added in version 262.

• --revert=FILENAME — Before loading and applying the sysctl settings, removes the specified sysctl configuration file under /run/sysctl.d/. If the filename doesn't end with .conf, the suffix gets appended. This is handy for removing configuration files that were created by --save=.

Added in version 262.

• --cat-config — Copy the contents of config files to standard output. Before each file, the filename gets printed as a comment.
• --tldr — Copy the contents of config files to standard output. Only the "interesting" parts of the configuration files get printed — comments and empty lines are skipped. Before each file, the filename gets printed as a comment. (ngl this is the one for when you have zero attention span, no shade 😭)
• --no-pager — Do not pipe output into a pager.
• -h, --help — Print a short help text and exit.
• --version — Print a short version string and exit.

---

🦋 CREDENTIALS 🦋

systemd-sysctl supports the service credentials logic as implemented by ImportCredential=/LoadCredential=/SetCredential= (peep systemd.exec(5) for the details). Here's which credentials get used when passed in:

• sysctl.extra — The contents of this credential may contain additional lines to operate on. The credential contents should follow the same format as any other sysctl.d/ drop-in configuration file. If this credential is passed, it gets processed after all of the drop-in files read from the file system. So the settings configured in the credential take precedence over the ones in the file system 👑

Added in version 252.

ngl, by default the systemd-sysctl.service unit file is set up to inherit the "sysctl.extra" credential from the service manager. so that's just happening, bestie.

---

🍓 EXAMPLES 🍓

Example 1. Reset all sysctl settings

systemctl restart systemd-sysctl

Example 2. View coredump handler configuration

# sysctl kernel.core_pattern
kernel.core_pattern = |/usr/libexec/abrt-hook-ccpp %s %c %p %u %g %t %P %I

Example 3. Update and verify coredump handler configuration

# /usr/lib/systemd/systemd-sysctl --prefix kernel.core_pattern --strict --verify

This searches all the directories listed in sysctl.d(5) for configuration files and writes /proc/sys/kernel/core_pattern. The sysctl variable gets read back and verified. If the writing or the verification fails, the command exits with a non-zero status — unless the corresponding setting is prefixed with -.

Example 4. Update coredump handler configuration according to a specific file

# /usr/lib/systemd/systemd-sysctl 50-coredump.conf

This applies all the settings found in 50-coredump.conf. Either /etc/sysctl.d/50-coredump.conf, or /run/sysctl.d/50-coredump.conf, or /usr/lib/sysctl.d/50-coredump.conf will be used, in the order of preference.

Example 5. Disable IPv6 on an interface and save the specified setting

# /usr/lib/systemd/systemd-sysctl --save=99-disable-ipv6-foo - <<EOF
net.ipv6.conf.foo.disable_ipv6=1
EOF

This disables IPv6 on the network interface foo, and creates /run/sysctl.d/99-disable-ipv6-foo.conf ✨

Example 6. Remove a runtime sysctl configuration file

# /usr/lib/systemd/systemd-sysctl --revert=99-disable-ipv6-foo --prefix=/net/ipv6/conf/foo

This removes /run/sysctl.d/99-disable-ipv6-foo.conf, and applies the remaining sysctl settings for the network interface foo.

Also peep sysctl(8) for various ways to directly apply sysctl settings, iykyk 💜

---

🌟 SEE ALSO 🌟

systemd(1), sysctl.d(5), sysctl(8)

---

and that's the whole page, bestie!! 🎀 this one's from systemd 262.1, and it's the SYSTEMD-SYSCTL.SERVICE(8) manual page — go configure those kernel parameters, you absolute main character 👑💖